In a major turn of events, embattled identity verification company ID.me says it will make facial recognition verification optional for all of its public sector government partners. Additionally, starting March 1, the company says all ID.me users will be able to delete their face scans.
That reversal comes just one day after the Internal Revenue Service said it would scrap ID.me’s facial recognition service for users trying to access online IRS services amid an outpouring of criticism from civil liberty groups and a bipartisan collection of lawmakers.
“We have listened to the feedback about facial recognition and are making this important change, adding an option for users to verify directly with a human agent to ensure consumers have even more choice and control over their personal data,” ID.me founder and CEO Blake Hall said in a statement.
In the past, ID.me users would submit a face scan to verify their identity against a government document. If ID.me’s system failed to validate that scan, the users would then join a recorded video call with an ID.me representative called a “Trusted Referee.” Moving forward it appears that all ID.me users attempting to access public sector government partners will be able to use a similar human identity verification method without first submitting a face scan. In some cases, users can also opt for an in-person verification if the relevant agency has opted into ID.me’s offline option.
“ID.me is an identity verification company, not a biometrics company,” the company said in its press release.
The change comes as multiple privacy groups, including Fight for the Future and the American Civil Liberties Union, have called on other government agencies to follow the IRS’s lead and abandon ID.me’s facial recognition service.
Though the policy change will likely come as welcome news to some who expressed criticism over ID.me’s use of biometrics, other privacy experts like like the Surveillance Technology Oversight Project’s Executive Director Albert Fox Cahn remained skeptical.
“This is too little too late,” Fox Cahn told Gizmodo. “If ID.me agrees that facial recognition is too invasive for some customers, why can’t they agree it’s wrong for all Americans? And if they had this alternative option all along, why did they rely on biometric tracking to begin with?”
ID.me found itself in the hot seat several weeks ago after Hall revealed the company, in some cases, was using a more expansive type of facial recognition technology than previously known. Lawmakers began speaking out against the IRS’ relationship with ID.me last week, beginning with a letter sent by Republican senators on the Finance Committee, who called on the IRS to cut ties with ID.me.
“The decision millions of Americans are forced to make is to pay the toll of giving up their most personal information, biometric data, to an outside contractor or return to the era of a paper-driven bureaucracy where information moves slow, is inaccurate, and some would say is processed in ways incompatible with contemporary life,” the senators wrote.
Days later, Senate Finance Committee Chairman Ron Wyden wrote his own letter to the IRS commissioner urging the IRS to end its use of facial recognition which he described as “unacceptable.” Within hours of Wyden’s letter, the IRS issued a statement saying it would transition away from using ID.me’s facial recognition.
Now, the path forward remains murky at best. In an email to Gizmodo, ACLU Racial Justice Project Staff Attorney Olga Akselrod welcomed ID.me’s announcement, but said but there were still many questions left unanswered.
“States still need to procure the offline options and it’s not entirely clear how ID.me’s offline option will work or what it entails,” Akselrod said. “We don’t yet know what extra hoops people who opt out of biometrics will have to jump through, what notice people will have about deletion, or when the company will release more information about what its 1:many video search involves.”