London Daily

Focus on the big picture.
Saturday, Oct 25, 2025

The IRS is working with a startup called ID.me that stores the 'inferred citizenship' of some users. That creates a huge new pool of personal data for police and other authorities to tap into.

The IRS is working with a startup called ID.me that stores the 'inferred citizenship' of some users. That creates a huge new pool of personal data for police and other authorities to tap into.

Observers worry how much information ID.me collects and how willing the company seems to be to share it with authorities when asked.
A possible collaboration between the Internal Revenue Service and a startup called ID.me is alarming privacy experts and civil-rights advocates who say the partnership will create a massive new pool of sensitive personal data that could be tapped by the police, immigration enforcement, and other authorities.

ID.me verifies people's identities by asking them to upload information, including their Social Security number, a selfie, and pictures of a government-issued ID. It then uses facial recognition and "liveness detection" on the pictures, and compares the submitted information to data from "telecommunications networks, credit card bureaus, financial institutions," and other sources, according to its privacy policy.

The company also stores the "inferred citizenship" of some users "based on passport information," along with facial images, voiceprints, location data, and information from documents such as postal addresses, Social Security numbers, driver's license numbers, passport-card numbers, and more, according to the policy.

Last month, the IRS said it would start requiring people logging into their accounts on the IRS website to use ID.me to verify their identities. The agency is considering alternative providers, but if the deal goes through, it would likely add millions to the company's user base, which already exceeds 60 million members. The technology is now used for identity verification to access benefits in 27 states.

What really worries observers is how much information ID.me collects and how willing the company seems to be to share that with authorities when asked.

"It feels like the IRS has integrated this service into its website without a lot of vetting or really necessarily thinking through these issues," Jeramie Scott, a senior counsel for the Electronic Privacy Information Center, told Insider.

The company states in its privacy policy that it will "access, preserve and share" personal information with law enforcement if asked. "We reserve the right to disclose your Personally Identifiable Information as required by law and when we believe that disclosure is necessary to protect you, our rights and/or comply with a judicial proceeding, court order, or legal process," ID.me writes.

Big Tech platforms, including Google, Facebook, and Apple, host billions of pieces of personal data and are regularly subpoenaed by law-enforcement agencies. These companies often comply, but they also push back sometimes. For instance, Apple has fought law-enforcement requests to unlock the iPhones of some suspects.

Samir Jain, director of policy for the Center for Democracy & Technology, told Insider that the way ID.me talks about law-enforcement compliance is broader than other companies and implies that ID.me can and will comply with police requests voluntarily, even when it's not strictly required by law or court order.

"You read a lot of privacy policies and they say, 'warning, that data we collect will be provided to law enforcement where the law requires it,'" Jain said. "Their privacy policy says, 'We will comply with this request voluntarily where the law doesn't prevent it.' Basically, putting the world on notice that they're going to voluntarily cooperate with law enforcement in sharing of people's data."

Patrick Dorton, who works for a PR firm ID.me hired, said biometric data "is not shared with the IRS or any government agencies absent the receipt of a subpoena or as part of an investigation into an identity theft or fraud case only at the specific agency where the ID.me account was involved."

He did not address several specific questions from Insider, including under what circumstances ID.me would push back against a law-enforcement request like a subpoena, how many times ID.me has complied with law-enforcement requests, and whether ID.me would push back on a hypothetical request from Customs and Border Protection for the data of all ID.me users who are inferred noncitizens.

There are US laws that limit the collection of personal data in certain circumstances. One federal law prevents the Department of Homeland Security from routinely accessing people's tax returns.

Jay Stanley, a senior policy analyst for the American Civil Liberties Union, told Insider that this law — Title 26, Section 6103 of the Internal Revenue Code — generally applies to information submitted to the IRS as part of the tax-filing process.

But ID.me technically isn't part of the tax-filing process. Rather, it would act as an identity confirmation tool for logging into an IRS.gov account. This could lead the DHS to believe that ID.me isn't subject to the law.

"Ideally, the law would cover the biometric data and other personal information collected by ID.me, and generally prevent that information from being disclosed to a law enforcement agency like DHS," Stanley said. "It's not completely clear to me that it does. And consequently, it likely means that DHS would interpret it as not covering this particular information." DHS did not respond to a request for comment on Thursday.

The IRS code has exemptions that allow DHS agencies to access people's tax-return information but only under extreme conditions, such as a person under investigation for tax fraud.

A 2018 letter from the ACLU to the Social Security Administration argued that "immigration enforcement" isn't a legal exemption that would permit sharing data with DHS. "The strict confidentiality of tax returns and related return information is critical to encourage and ensure public compliance with the federal tax laws," the letter said.

The IRS spokesperson Robert Marvin said a lack of funding for IT modernization has made it impossible for the IRS to invest in state-of-the-art technology."

"The IRS today uses third-party service providers to validate the identification of individuals attempting to improperly gain access to taxpayer accounts," Marvin added in a statement that he asked to be attributed to the US Treasury Department. "This includes ID.me, which is compliant with the National Institute of Security Technology standards and used by multiple agencies across the government."

The Treasury Department recently said it was looking into alternatives to ID.me for the IRS after a Bloomberg reported that some people have been unable to get unemployment benefits due to problems using ID.me's service. A Cyberscoop article also showed that ID.me misrepresented how it uses facial recognition. The company claimed to do one-to-one face matching, such as determining whether a selfie matches a driver's license provided by a user. In fact, it uses a method known as one-to-many matching, which compares images to a stored database of photos, but ID.me hasn't disclosed how many images it has or how it got them.

"We shouldn't be required to trust that ID.me will push back on those kinds of requests if they receive them," said Scott from the Electronic Privacy Information Center. It's critical for government agencies to evaluate any company they may work with, especially what data the company is getting, and how it can use or disclose that information, he added.

The IRS' evaluation of ID.me "really isn't being done appropriately," Scott said.
Comments

General Butler 4 year ago
This world has really gone to shit.

Newsletter

Related Articles

0:00
0:00
Close
Microsoft AI CEO: ‘We’re making an AI that you can trust your kids to use’ — but can Microsoft rebuild its own trust before fixing the industry’s?
China and Russia Deploy Seductive Espionage Networks to Infiltrate U.S. Tech Sector
Apple’s ‘iPhone Air’ Collapses After One Month — Another Major Misstep for the Tech Giant
Graham Potter Begins New Chapter as Sweden Head Coach on Short-Term Deal
Ecuadorian President Daniel Noboa Alleges Poison Plot via Chocolate and Jam
Lakestar to Halt External Fundraising as Investor in Revolut and Spotify
U.S. Innovation Ranking Under Scrutiny as China Leads Output Outputs but Ranks 10th
Three Men Arrested in London on Suspicion of Spying for Russia
Porsche Reverses EV Strategy as New CEO Bets on Petrol and Hybrids
Singapore’s Prime Minister Warns of ‘Messy’ Transition to Post-American Global Order
Andreessen Horowitz Sets Sights on Ten-Billion-Dollar Fund for Tech Surge
US Administration Under President Donald Trump Reportedly Lifts Ban on Ukraine’s Use of Storm Shadow Missiles Against Russia
‘Frightening’ First Night in Prison for Sarkozy: Inmates Riot and Shout ‘Little Nicolas’
White House Announces No Imminent Summit Between Trump and Putin
US and Qatar Warn EU of Trade and Energy Risks from Tough Climate Regulation
Apple Challenges EU Digital Markets Act Crackdown in Landmark Court Battle
Nicolas Sarkozy begins five-year prison term at La Santé in Paris
Japan stocks surge to record as Sanae Takaichi becomes Prime Minister
This Is How the 'Heist of the Century' Was Carried Out at the Louvre in Seven Minutes: France Humiliated as Crown with 2,000 Diamonds Vanishes
China Warns UK of ‘Consequences’ After Delay to London Embassy Approval
France’s Wealthy Shift Billions to Luxembourg and Switzerland Amid Tax and Political Turmoil
"Sniper Position": Observation Post Targeting 'Air Force One' Found Before Trump’s Arrival in Florida
Shouting Match at the White House: 'Trump Cursed, Threw Maps, and Told Zelensky – "Putin Will Destroy You"'
Windows’ Own ‘Siri’ Has Arrived: You Can Now Talk to Your Computer
Thailand and Singapore Investigate Cambodian-Based Prince Group as U.S. and U.K. Sanctions Unfold
‘No Kings’ Protests Inflate Numbers — But History Shows Nations Collapse Without Strong Executive Power
Chinese Tech Giants Halt Stablecoin Launches After Beijing’s Regulatory Intervention
Manhattan Jury Holds BNP Paribas Liable for Enabling Sudanese Government Abuses
Trump Orders Immediate Release of Former Congressman George Santos After Commuting Prison Sentence
S&P Downgrades France’s Credit Rating, Citing Soaring Debt and Political Instability
Ofcom Rules BBC’s Gaza Documentary ‘Materially Misleading’ Over Narrator’s Hamas Ties
Diane Keaton’s Cause of Death Revealed as Pneumonia, Family Confirms
Former Lostprophets Frontman Ian Watkins Stabbed to Death in British Prison
"The Tsunami Is Coming, and It’s Massive": The World’s Richest Man Unveils a New AI Vision
Outsider, Heroine, Trailblazer: Diane Keaton Was Always a Little Strange — and Forever One of a Kind
Dramatic Development in the Death of 'Mango' Founder: Billionaire's Son Suspected of Murder
Two Years of Darkness: The Harrowing Testimonies of Israeli Hostages Emerging From Gaza Captivity
EU Moves to Use Frozen Russian Assets to Buy U.S. Weapons for Ukraine
Europe Emerges as the Biggest Casualty in U.S.-China Rare Earth Rivalry
HSBC Confronts Strategic Crossroads as NAB Seeks Only Retail Arm in Australia Exit
U.S. Chamber Sues Trump Over $100,000 H-1B Visa Fee
Shenzhen Expo Spotlights China’s Quantum Step in Semiconductor Self-Reliance
China Accelerates to the Forefront in Global Nuclear Fusion Race
Yachts, Private Jets, and a Picasso Painting: Exposed as 'One of the Largest Frauds in History'
Australia’s Wedgetail Spies Aid NATO Response as Russian MiGs Breach Estonian Airspace
McGowan Urges Chalmers to Cut Spending Over Tax Hike to Close $20 Billion Budget Gap
Victoria Orders Review of Transgender Prison Placement Amid Safety Concerns for Female Inmates
U.S. Treasury Mobilises New $20 Billion Debt Facility to Stabilise Argentina
French Business Leaders Decry Budget as Macron’s Pro-Enterprise Promise Undermined
Trump Claims Modi Pledged India Would End Russian Oil Imports Amid U.S. Tariff Pressure
×