The IRS will no longer require taxpayers to use third-party facial recognition software to authenticate their online accounts, the agency announced Monday.
The agency previously announced that starting this summer, taxpayers would have had to authenticate their online accounts through third-party software company ID.me by providing a government document with a photo, such as a driver's license, state ID or passport, and taking a video selfie with their smartphone or computer.
While taxpayers wouldn't have necessarily had to create an account to file a tax return or pay a tax bill, it would have been required to access other information like tax transcripts, apply for payment plans or use the Child Tax Credit portal.
The move was met with alarm from privacy experts, who questioned the need for the government to partner with an outside firm to collect biometric data.
"We don't know how this information could be used in the future," says Jeramie Scott, senior counsel at the Electronic Privacy Information Center. "You're ceding control to a company who may not be incentivized in the same way you are to protect your data."
Scott also said that facial recognition software has been shown to have bias and inaccuracies that disproportionately affect people of color.
If the IRS or another government agency were to implement facial recognition software, it should be on an opt-in basis, like two-factor authentication, says Rick Song, CEO of Persona, an identity verification company. (Other agencies and departments do in fact use ID.me to verify online accounts, including the Social Security Administration, Veteran's Affairs and many state governments.)
"It's strange to force my data to be trusted with, essentially, a corporation, to get access to a government service," Song says. "If I'm going to be providing my data to the government, I'd prefer to provide it directly to them, not through an intermediary."
There are also accessibility issues: Not everyone has access to a smartphone or computer with a camera, which would be required to make and login to an IRS account.
The move had also gotten blowback from lawmakers. Last week, a group of Republican senators sent a letter to IRS Commissioner Chuck Rettig, asking him to "immediately discontinue any programs that collect, process and store facial recognition or other types of biometric data of American taxpayers."
Earlier on Monday, a group of Democratic members of the House of Representatives sent a similar letter, as did Sen. Ron Wyden, D-OR, chairman of the Senate Finance Committee.
The transition away from ID.me should happen in the next few weeks so that it does not cause disruptions this tax season, the agency said. It will develop an "additional authentication process that does not involve facial recognition."
"The IRS takes taxpayer privacy and security seriously, and we understand the concerns that have been raised," Rettig said in a press statement. "Everyone should feel comfortable with how their personal information is secured, and we are quickly pursuing short-term options that do not involve facial recognition."
