ID.me is making moves in the gov space. Critics aren’t so sure about the privacy of its tech

Much like all of us when April comes around, McLean, Virginia identity tech firm ID.me is having some trouble with taxes.

This summer, the Internal Revenue Service (IRS) and ID.me are teaming up to create a photo-based, multi-factor identity verification requirement for your taxes — a move that was actually made in November, but popped into public consciousness this month, thanks to a Krebson Security post. To clarify, you probably won’t need to snap a selfie when filing your taxes this April, as identity verification is not required for filing. But you will if you’re looking to check in on the account online or seeking a digital transcript.

There are pros here, including a potential lessening of tax fraud, for one. And if you’re already using ID.me for your financials, it may feel natural to continue that into tax records. But now, some have raised concerns about the digital wallet company creeping into the federal government and other aspects of everyday life in a move mildly reminiscent of “The Circle.”

There are few sectors that identity verification doesn’t touch, so perhaps it’s inevitable that we’d get here as a tech-driven society. Some have noted the potential privacy loss in requiring this move, while others have pointed to the well-established bias of facial recognition software and AI.

Coming off massive success in 2021, though, the NoVa verification company thinks it’s the right partner for the federal government as we push forward in the digital age.

“For decades, government agencies have relied upon data brokers alone to verify identity for access to online services,” ID.me wrote in an email statement to Technical.ly. “These solution providers leave many groups behind. … Relative to the low access rates tied to data brokers, which completely exclude certain groups, ID.me is a demonstrably more accessible and secure solution, which is why we have been so widely adopted.”

Here’s everything we know so far about the company’s future govtech plans — and the current privacy concerns.

Growth so far and future plans

Ahead of its most recent privacy pitfall, ID.me was coming off of its best year ever. In 2021, the company raised not one but two $100 million megarounds, vaulting to unicorn status and adding 1,300 members to its team. Amid DC’s huge $5 billion year for VC, in pure dollar amounts, the only company to surpass ID.me’s 2021 funds was Robotic Research’s $228 million Series A. The software is already used in 27 state workforce agencies with plans to reach 100 million users by the end of 2021. All in all, ID.me had such a banner year that our audience voted them Growth Company of the Year in our 2021 Technical.ly Awards in DC. And, in June of last year, the company was applauded for finding an alleged $400 billion in fraud in unemployment benefits, though that number has also been scrutinized.

Upon its second funding round of the year, ID.me said it would be working on solving the need for multiple passwords on different sites, hoping to streamline the process by creating one centralized login credential instead of a new set for each site.

“One of our missions for the past year has been to help states get individuals the benefits they deserve while battling massive identity fraud,” Hall said in a statement at the time. “Not only are we streamlining an inefficient process, but we’re also giving individuals full control of their personal data, which is currently scooped up by data brokers. In short, we’re creating the identity layer of the internet.”

Late in the year, it also got into the vaccine verification game via a partnership with local event tech company Cvent, and expanded its locations for in-person identity verification. But with the availability of the in-person option, Hall and ID.me think that they’ve found a solution to the online shortcomings.

“Being able to show up in person to prove who you are is a really important relief valve to just push the edge for access closer and closer to communities that have traditionally been left behind and may be facing more of a digital divide,” Hall told Technical.ly in September. “So we’re constantly trying to push the envelope.”

Privacy concerns

But the IRS move has some on edge about the privacy of users who elect to partake in ID.me’s verification software, even though the company has been working with the entity for years; it started a pilot process with the IRS in 2017 before launching a Child Advance Tax Credit program last summer. (In all, it has 600 partners, government and non.) Still, ID.me is a third party collecting information from users, which on the whole makes many nervous about their data. And its terms do include provisions that it may share your info with entities such as law enforcement, if necessary.

To quell those concerns, ID stands by its software, noting that it’s the only verification software company that offers self-serve, video and in-person options. In a company statement, Hall said that 90% of individuals who complete verification online do it successfully in a short time, and the other 10% do have the option of speaking to a live person. If that doesn’t work, he pointed to the option of in-person verification, which ID.me has available at 650 locations across the country, in partnership with background check company Sterling. Hall also pointed out that its authentication services are offered in 13 languages, nine languages for its self-service option and 16 languages in video chat, all of which ID.me says comes with a stamp of data protection.

“We are committed to making sure that people, and not data brokers, are the sole controllers of their personal data,” the company said. A statement from ID.me also declared that it does not sell user information, in accordance with its public Privacy Bill of Rights.

But even with these reassurances, some are questioning the reliability of its facial recognition option. ID.me has said that its software is different from that of facial recognition used by entities such as law enforcement, which pair a new photo with a library of existing ones from previous arrests. Instead, as Hall noted, the Virginia company’s software is only comparing a new photo with a driver’s license or passport to see if it matches — a process it says is comparable to using facial recognition to unlock a smartphone.

Hall adjusted those statements this week, stating that ID.me does also compare a small number of submitted video selfies to others in its database.

The digital divide

Complaints are popping up about the potential racial bias and overall difficulty in the verification process, especially considering that many don’t have regular access to a smartphone or webcam needed to take a photo. Bloomberg reported that a Black woman in Pennsylvania trying to get unemployment benefits was unable to verify herself for weeks, eventually needing to reach out to a lawyer to arrange a video call for verification. And after a host of issues with unemployment claims, a California senator wrote in January of last year that the company had “put thousands of legitimate claims in limbo” with no way out.

With the existing concerns and the new moves, Caitlin Seeley George, campaign director at tech advocacy nonprofit Fight For the Future, told Axios that there was little doubt that the company would cause harm to personal privacy.

“When ID.me was rolled out for state unemployment benefits we heard from many people who had issues with the system,” Seeley George told Axios. “Not only is it an issue that ID.me misidentifies people of color, gender-nonconforming people and women, but this system requires people to have a smartphone or a web camera in order to submit photos, which means economically disadvantaged and older people are going to have greater challenges getting through the system.”

What comes next

As of now, it’s hard to tell what this moment will mean for ID.me, or quite where the company is headed next. Last year, fresh off their funding round and new unicorn status, Hall told Technical.ly in March that he had plans to IPO and even reach a trillion-dollar valuation. Back then, future moves into the govtech space seemed inevitable. In an email to Technical.ly this week, ID.me said it would welcome the chance to grow in the govtech space or engage in future partnerships, reaffirming plans that Hall had put forth last year.

“We really are creating an app store, where once you’re logged into ID.me, you can open up these federal agencies as apps without being challenged for login,” Hall said then. “And that is just transformational.”