The agency requires photo identification for certain services using a face match system from digital ID vendor ID.me, but privacy advocates say the technology is prone to bias.
The Internal Revenue Service's plans to require taxpayers to verify their identity by uploading a selfie to a third-party website has triggered criticism by privacy advocates.
The IRS first revealed its partnership with digital identification vendor ID.me in November in a blog post saying that starting summer 2022, taxpayers who want tax credits through the Child Tax Credit Update Portal, to obtain an identity protection PIN or to apply for detailed tax transcripts will have to verify their identity with ID.me.
Taxpayers will need to upload proof of their identity such as a driver's license, state ID or passport, and take a photo of themselves with a smartphone, computer or webcam.
In a statement to TechTarget, the IRS said "taxpayers can pay or file their taxes without submitting a selfie or other information to a third-party identity verification company."
1:1 vs 1:many
On Monday, ID.me released a statement from CEO and founder Blake Hall about what the vendor said is its commitment to federal guidelines for facial recognitiontechnology. Hall said the vendor uses one-to-one face match technology and not one-to-many facial recognition.
One-to-one face match is a simple application of the technology that is comparable to using one's face to unlock a smartphone or be verified at an airport, Hall said in an interview with TechTarget.
"It's something that Americans do broadly all across the country when they're proving their identity in person," Hall said. "What it specifically is not is like taking one person's photo and then taking like a city's worth of images and trying to like match that person's face."
Hall's distinction between 1:1 face match as opposed to 1:many facial recognition technology isn't sufficient, said Kathleen Walch, an analyst at Cognilytica.
When it comes to AI, there are societal ethics concerns that can arise and these were not addressed by either ID.me or the IRS.
Kathleen WalchAnalyst, Cognilytica
"When it comes to AI, there are societal ethics concerns that can arise, and these were not addressed by either ID.me or the IRS," Walch said. Those concerns address how the systems work, human values and issues related to bias, diversity and inclusivity, she said.
"By only addressing the type of face-match technology used after people raised alarms, the company has lost the trust with the public, " Walch said. "And once trust is lost, it is very hard to gain it back."
ID.me provides a live agent to assist users with their identity verification using a video chat platform.
Hall said the feature helps create an inclusive pathway for people who are homeless, live overseas or lack credit histories to verify their identity.
The problem of bias
But for privacy advocates, the use of facial recognition to access tax resources is concerning because of previous problems that have been linked to various forms of the technology.
"Anytime we see biometric data being collected, it's problematic," said Albert Fox Cahn, executive director at the Surveillance Technology Oversight Project.
Cahn said facial recognition technologies have been known to be biased and invasive.
"The fear is that we will see the bias in this algorithm," Cahn said. "We have seen a lot of algorithms in the past that have human review but are still sort of broken or biased."
However, Hall said that according to the National Institute of Standards and Technology's (NIST) 2019 studyon facial recognition, there are fewer chances for false negatives in one-to-one face matching for Asian and Black faces compared with whites.
Other than the study, NIST also rates Paravision, the facial recognition platform that ID.me uses, as one of the top technologies in its class with a low false negative identification rate.
"It's irresponsible to conflate surveillance and tracking and law enforcement applications with one-to-one matching," Hall said.
Issue of privacy and security
Other than bias, observers raised privacy and security questions.
"You can change your credit card data, you can change your Social Security number, but you can't change your face," Cahn said. "If your face gets hacked, it can compromise your privacy for the rest of your life."
To keep people's data secure, Hall said ID.me has passed the government's audit for security for these types of transactions.
He added that state customers such as Georgia, New Jersey, California and Arizona have used ID.me to prevent fraud.
For some criminals, the only thing that keeps them from being able to steal all your information is the selfie, Hall said.
"If criminals have now harvested not just your data, but images of your ID cards, and they've got access to your telecom accounts, what's left to prove that you're you and to keep you safe from identity theft?" Hall continued. ""It really comes down to this selfie step."
Moreover, users of ID.me have control over the kind of data they want to keep active, Hall said. They can delete their account or decide to remove a part of their account such as their address, for example.
"When companies are transparent and keep users informed on what they are doing to ensure protection of data, that helps put customers at ease," Walch added.
A need for transparency
The missing piece in ID.me's approach is transparency, said Beena Ammanath, executive director of the Global Deloitte AI Institute.
Both the IRS and ID.me need to explain plainly to consumers how the technology will be used and what will be done with the data, she said.
"We hear enough about the fear around facial recognition. I think it's super important to make sure that everybody understands what's really happening," Ammanath said.
Also missing is assurance that the IRS's plan to use taxpayers' photos does not contribute to inequality, Ammanath added.
"Not everybody has access to tech," she said. "What happens to people who don't have access to tech or are not tech savvy? Are they going to get left behind?"
When asked about inequality, Hall said people have access to computers in public places such as libraries and community centers. He also said that there should always be an in-person verification center run by the government.
The question of need
Meanwhile, critics suggested that there ought to be a way for the IRS to verify taxpayers' identity without facial recognition technology.
While similar face match technology is widely used by tech giants such as Apple and Samsung and is a verification step to even book an Airbnb, the government's use of it remains concerning to some.
"If you don't respond to tax notices quickly, you can get fined and go to jail," Cahn said. "When the government rolls out these services, the consequences are much more different."
He added that the IRS already has unique methods to confirm taxpayers' identity without images of their faces.
"They have way more information to confirm out identity without a website," Cahn said, noting that the agency already has taxpayers' Social Security and bank account information. "If you needed ID technology, you can do that without relying on something like facial recognition."
But the benefits outweigh the risks, said supporters of the technology.
"This is kind of like people objecting to telephones because there's a chance the police will wiretap your phone," said James Lewis, an analyst at the Center for Strategic & International Studies.
He said the facial recognition technology will help protect against tax identity fraud.
"I don't know if it's the perfect solution for authentication of identity, but it's a solution," Lewis said. "And we've been wrestling this for more than two decades. If you get the right guardrails around … transparency, then this is a perfectly safe technology."
Forrester analyst Merritt Maxim said most taxpayers would probably welcome the IRS move if they think it will prevent fraud.
"Any kind of offering that provides a mechanism that [tax fraud and payment fraud] can be reduced … is something that you know consumers will be interested in," he said.
