After face-recognition backlash, ID.me says government agencies will get more verification options

On Monday, the Internal Revenue Service halted a plan that would have forced taxpayers to verify their identities with facial recognition software before signing on to its website.

A day later, the company behind that software, ID.me, said it will make it possible for people to skip the controversial technology to prove who they are before accessing some online services from government agencies.

ID.me CEO and founder Blake Hall said in a press release Tuesday that the company is making it possible for government agencies to give users the option to verify their identity — a one-time process — by talking to a human agent, rather than using ID.me’s software. Otherwise, a user would need to take a picture of a photo ID, like a driver’s license or passport, and then take a video selfie with a smartphone or computer so software could compare the two.

This is a change from what the company typically does, as users tend to only be routed to a video call with a human agent if they fail the facial-recognition step a few times.

McLean, Virginia-based ID.me is a fast-growing company that often uses facial recognition software as part of its identity-verification process. ID.me also verifies identities for 30 state unemployment agencies, as well as a growing number of US federal agencies, including the Treasury Department and the Social Security Administration.

The company has faced concerns from privacy advocates over its use of facial-recognition technology, as well as complaints from users who say they have spent hours waiting to have their identities verified via video chat after failing to pass the company’s facial recognition step.

ID.me also said that, starting March 1, it will allow ID.me users to delete the selfie tied to their account online at account.ID.me. In the past, ID.me has said it does not sell its user data — which includes biometric and related information, such as selfies people upload, data related to facial analyses, and recordings of user video chats — but it does keep such information. Biometric data, like the facial geometry produced from a user’s selfie, may be kept for years after a user closes their account.

The changes come shortly after the IRS, following backlash from lawmakers and privacy groups, said on Monday that it would “transition away” from using facial recognition software via ID.me to verify people for online accounts. Once a user had been authenticated via ID.me, they would be able to sign on to the IRS’s website to request an online tax transcript or see information regarding tax payments or economic impact payments. The process had been optional for those who already had an IRS username and password, but those were set to stop working this summer.

The IRS’s plan was announced in November, but gained attention and scrutiny from privacy advocates as tax season begins and millions of people visit the agency’s site.

Some other federal agencies are also weighing whether tocontinue using ID.me. Drew Hirshfeld, performing the functions and duties of the director of the United States Patent and Trademark Office, told CNN Business in a statement on Tuesday that USPTO is “re-evaluating” its options “in light of recent reports.” As of April 9, USPTO is set to start requiring anyone who wants to file for a trademark to first verify their identity with ID.me or with a paper form through the mail.

A spokesperson for the Department of Veterans Affairs, which offers ID.me as an option for logging in to its website but does not use facial-recognition software for its authentication process, said the agency’s current “option year” on its contract with the company ends April 30. The VA has two more option years available after that, and the spokesperson said it’s “in the process of reviewing market research results” to decide what to do next.