IRS will pivot to GSA's Login.gov after this tax season

The Internal Revenue Service will shift to the General Services Administration's Login.gov identity authentication service after the current tax filing season, the agency announced on Monday. 

The move comes amid a growing controversy over the tax agency's use of ID.me, a digital identity verification service that includes the collection of user images. The IRS had been working with ID.me for identity proofing for online IRS accounts. It has a two-year, $86 million contract with the firm.

"This is consistent with the IRS’s commitment earlier this month to transition away from the requirement for taxpayers creating an IRS online account to provide a selfie to a third-party service to help authenticate their identity," the agency said in a release announcing the decision.

ID.me has relied on biometrics for verifying identities, although it recently announced more options for identity verification that don't rely on facial recognition. The company announced changes to some of its practices in response to criticism from members of Congress and digital privacy activists. 

For the current tax season, the IRS is sticking with ID.me, but with new online account authentication options that rely on live, virtual interviews with agents – something that doesn't require any of the biometric data collection. However, live interviews are already part of the ID.me confirmation process in cases where identity matches aren't made from submitted data. This process, according to multiple reports, can be subject to delays. ID.me recently announced its intention to hire 750 additional staff to support increased demand for its services.

Americans will still be able to use ID.me's facial recognition tech for now if they choose to do so. The IRS says that for those people, there are now "new requirements … to ensure images provided by taxpayers are deleted for the account being created." 

The IRS also says that existing biometrics already collected for IRS online accounts "will also be permanently deleted over the course of the next few weeks."

An ID.me press representative told FCW last week that the company is updating its privacy policy, which currently states that it keeps data for seven and a half years, to reflect new changes. 

IRS had previously considered Login.gov as a solution for identity authentication, but decided against it because it didn't offer high enough levels of assurance. Login.gov has primarily offered shared sign-on services, although GSA has made clear that it intends to expand the service in the next year.

"The General Services Administration is currently working with the IRS to achieve the security standards and scale required of Login.Gov, with the goal of moving toward introducing this option after the 2022 filing deadline," the IRS said.

The IRS is among at least 10 other agency customers using ID.me

Caitlin Seeley George, campaign director at Fight for the Future, a nonprofit digital rights advocacy group, told FCW that  the move away from ID.me to Login.gov "makes a lot of sense when it comes to protecting and securing peoples’ personal information."

But Fight for the Future is continuing to push for a "governmental investigation" into why federal agencies went with the company, she says, and argues that facial recognition shouldn't be an option for verification at all. 

Some lawmakers are also pressuring the Labor Department to move unemployment services away from the company. The department has a blanket purchase agreement with ID.me and other vendors for identity verification, and states can and have also accessed the company apart from this BPA.