A proposed framework under discussion at the U.S. Treasury Department and the Internal Revenue Service would allow identity verification contractor ID.me to retain taxpayers’ biometric data far longer than it does now, according to internal slides and documents reviewed by Politico. ID.me already administers photo and video identity verification for several federal websites, including IRS.gov, which is used by tens of millions of people.
The central change concerns retention. The IRS currently states that biometric data collected during account registration is deleted automatically, and an agency document cited in the Politico report says it must be deleted within 24 hours. Under the proposed framework, ID.me would instead hold a user’s biometric scans for as long as their IRS.gov account is active, and then for 36 months after the account is deleted. Treasury presented the proposal to IRS staff in a slideshow on April 16.
The documents indicate that the government could access the retained data only as part of law-enforcement or inspector general investigations, and that the IRS and Treasury would have to serve ID.me with a subpoena, warrant, or other legally compelling justification to obtain it, consistent with ID.me’s privacy policy. The 36-month period would be far longer than the retention policy Treasury and ID.me agreed on in 2022.
A second element of the proposal would let ID.me apply one-to-many matching, also called 1:N, during identity proofing. That technique cross-references a person’s biometric data against ID.me’s databases, rather than the one-to-one check ID.me currently uses to compare a user’s selfie against their identification document. An IRS spokesperson confirmed that the IRS and Treasury have discussed recommendations to implement expanded data-retention timeframes and 1:many matching to counter emerging fraud, including deepfakes. Privacy advocates and researchers have criticized one-to-many matching as invasive and prone to error, particularly for people of color, and the IRS has acknowledged such concerns in a separate document.
ID.me responded that the federal government cannot share its biometric data across agencies because the company does not share that data with the government unless compelled through a mandatory legal process such as a warrant or subpoena. ID.me also provides verification for other federal agencies, including the Centers for Medicare and Medicaid Services.
The proposal revives a long-running tension. The IRS dropped a facial-recognition requirement for online accounts in 2022 after objections from lawmakers and privacy groups, adding a live-agent video option. The IRS has said the retention changes are under discussion and not finalized.
–
By the ID Tech Editorial Team
