GOP lawmakers move to stop IRS facial recognition technology

Republicans in Congress are raising concerns about the Internal Revenue Service’s move to use facial recognition technology to authenticate taxpayers before they can access their online accounts, introducing a bill that would ban the practice.

The IRS has contracted with ID.me, a third-party provider of authentication technology, to help deter identity theft by requiring taxpayers to send a selfie along with an image of a government document like a passport or driver’s license before they can access their online taxpayer account or use tools like Get Transcript (see story). Although the new technology is intended to protect taxpayers from cybercriminals, it also has raised privacy concerns. The IRS has emphasized that taxpayers won’t need such measures to file their taxes or pay taxes online. The agency began rolling out the technology this year for new taxpayer accounts and it’s expected to be in place by this summer for existing accounts as well.

Andrew Harrer/Bloomberg

The Treasury is already looking into alternatives to ID.me over privacy concerns amid reports that the company has amassed images of tens of millions of faces from its contracts with other federal and state government agencies and businesses (see story). But if Congress bans the use of such technology, or discourages the IRS from requiring it, that could prompt the agency to find other ways to authenticate users besides selfies.

In a letter Thursday, a group of Senate Republicans, led by Senate Finance Committee ranking member Mike Crapo, R-Idaho, questioned the IRS’s plans to expand its collaboration with ID.me by requiring taxpayers to have an ID.me account to access some of the main IRS online resources. To register with ID.me, taxpayers will need to submit to ID.me personal information, including sensitive biometric data, starting this summer.

“The IRS has unilaterally decided to allow an outside contractor to stand as the gatekeeper between citizens and necessary government services,” the senators wrote in a letter to IRS Commissioner Chuck Rettig. “The decision millions of Americans are forced to make is to pay the toll of giving up their most personal information, biometric data, to an outside contractor or return to the era of a paper-driven bureaucracy where information moves slow, is inaccurate, and some would say is processed in ways incompatible with contemporary life.”

They pointed to a number of issues, pointing out that a “selfie” couldn’t be changed if it’s compromised, unlike a password. They also asked about cybersecurity standards, and how the sensitive data would be stored and protected. The lawmakers also pointed out that ID.me is not subject to the same oversight rules as a government agency, and asked what assurances and rights would be allowed taxpayers under the collaboration, as taxpayers apparently would be subject to multiple terms of agreement filled with dense legal print.

ID.me defended its technology. “We are committed to working together with the IRS to implement the best identity verification solutions to prevent fraud, protect Americans’ privacy, and ensure equitable, bias-free access to government services,” said the company in a statement. “To date, IRS and ID.me have worked together to substantially increase the identity verification pass rates from previous levels. These services are essential to helping prevent government benefits fraud that is occurring on a massive scale.”

In the House, Rep. Jackie Walorski, R-Indiana, a senior member of the tax-writing House Ways and Means Committee, introduced the Save Taxpayers’ Privacy Act, which would prevent the IRS from requiring facial recognition technology to pay taxes or access account information. The bill would prohibit the Treasury from requiring the technology for access to any IRS online account or service.

“It is outrageous that the IRS is planning to force American taxpayers to submit to dangerous facial recognition software in order to fulfill their basic civic responsibility,” Walorski said in a statement Friday. “Given the agency’s previous failures to safeguard Americans’ private data and prevent political weaponization within its ranks, emboldening the IRS with any additional sensitive data or personal information would be a disservice to taxpayers and an affront to their rights. In the 21st century, the IRS can use secure alternatives to confirm taxpayers’ identities without resorting to facial recognition surveillance. To protect taxpayers’ privacy and security, I introduced legislation to stop IRS spying and defend citizens’ right to privacy.”