Facing mounting criticism, the Internal Revenue Service (IRS) is dropping its plan to implement facial recognition via a third-party company, the agency announced on Monday.
“The IRS takes taxpayer privacy and security seriously, and we understand the concerns that have been raised,” said IRS Commissioner Chuck Rettig in an online statement. “Everyone should feel comfortable with how their personal information is secured, and we are quickly pursuing short-term options that do not involve facial recognition.”
In November, the IRS announced it planned to transition to a new identity verification system using an outside company called ID.me. The process would have required video selfies to verify users who want to access basic services like seeing payment history, setting up payments, and the Child Tax Credit Portal. (The selfie would reportedly not have been necessary for filing taxes, though.)
Last month, the news came under additional scrutiny as details emerged about the selfie system. Privacy experts expressed concerns, noting the potential pitfalls of having to share personal data with an outside company that has its own terms and conditions. Some cited equity issues, as well, due to the need for people to have camera access to complete this step. Studies have also shown that facial recognition systems are typically less accurate for people of color.
[Related: Why the IRS wants you to log in with a video selfie]
The plan attracted bipartisan backlash, with Senator Ron Wyden (D-OR) saying he was “very disturbed” with it and Representative Rep. Bill Huizenga (R-MI) introducing legislation last week that would ban the IRS from using facial recognition software. And the General Services Administration (GSA), which is responsible for the government’s own secure sign-in system, Login.gov, told The Washington Post that the GSA is avoiding using this and “any other emerging technology for use with government benefits and services” until there has been a “rigorous review” showing it will not harm vulnerable populations.
The IRS says it will be moving away from ID.me in “coming weeks” and will still add an “additional authentication process,” but it will not require facial recognition. While the statement didn’t offer any additional insights into what that might entail, the agency said it will work with “cross-government partners” to develop it. None of this should impact users logging on to pay taxes, the agency added.
ID.me has not responded publicly to the change, though it previously acknowledged concerns in a statement from CEO and founder Blake Hall. Hall likened the “face match” technology the company uses to a smartphone’s face ID, rather than facial recognition that scans a user against a database of images. The statement also says the company does not sell user’s personal information, though ID.me’s privacy policy does have stipulations for sharing it, including with government bodies and authorities. ID.me is already used by hundreds of companies, as well as 30 states and 10 federal agencies.