The IRS reversed course Monday on earlier plans to require taxpayers to authenticate their identities with a nongovernmental facial-recognition service to use certain online services.
In a news release, the IRS announced it will "transition away from using a third-party service for facial recognition to help authenticate people creating new online accounts." The authentication method is already in use for some interactions and optionally for taxpayers creating or using online accounts and other services. In November, the IRS announced that a new account and sign-in process would be mandatory starting sometime in summer 2022.
The process, also used by other federal and state services, relies upon technology provider ID.me and requires users to upload a "selfie" photo of themselves as part of the authentication process. The procedure and arrangement, channeling sensitive personal information and photos through a private company, has raised concerns among privacy advocates and others.
ID.me has said that its service uses "1:1" facial-matching technology, which is "comparable to taking a selfie to unlock a smartphone," and that the company does not use "1:many" matching. However, that denial fails to mention that it does use 1:many to guard against fraud in some government programs, its founder and CEO, Blake Hall, acknowledged in a LinkedIn post.
Moreover, a group of Senate Republicans wrote to IRS Commissioner Charles Rettig on Feb. 3, raising issues and questions concerning the IRS's planned expansion of its use of ID.me and safeguarding of the resulting huge trove of Americans' biometric and other personal data.
"The government and private companies have an unfortunate history of data breaches," the senators wrote. And, they noted, as a private business, ID.me "is not subject to the same oversight rules as a government agency."
In Monday's announcement, Rettig said the IRS will instead rely on authentication not involving facial recognition.
"The IRS takes taxpayer privacy and security seriously, and we understand the concerns that have been raised," Rettig said in the statement. "Everyone should feel comfortable with how their personal information is secured, and we are quickly pursuing short-term options that do not involve facial recognition."
ID.me has been available for use with the IRS's Child Tax Credit Update Portal and online access to taxpayer accounts, as well as its Get Transcript Online, Get an Identity Protection PIN, and Online Payment Agreement services. The IRS also offers it for logging in to the Tax Pro Account and Submit Forms 2848 and 8821 Online services for tax professionals.
The November announcement said the procedure would be expanded to additional applications and become mandatory in summer 2022. For now, taxpayers and tax professionals have been able to use their existing credentials to create an account or sign in but have been encouraged to create an ID.me account "as soon as possible."
In its transition reversing that plan, the IRS said Monday it will seek to avoid any disruption to the current tax filing season.
The AICPA continues to advocate for better IRS services; visit the webpage describing AICPA advocacy efforts to learn more.
— To comment on this article or to suggest an idea for another article, contact Paul Bonner at Paul.Bonner@aicpa-cima.com.
