The US Internal Revenue Service (IRS) is considering extending the period that third-party contractor ID.me can retain taxpayers' biometric data, from 24 hours after account deletion to 36 months, according to a presentation shown to Treasury staff. The move aims to combat increasing fraud using artificial intelligence.
Currently, ID.me must delete biometric information within 24 hours of an account being closed. Under the proposed changes, the company could keep records for as long as an account is active and for a further 36 months after deletion. Access to the data would require a subpoena, warrant or other legally compelling justification from law enforcement or inspector general probes.
An ID.me spokesperson stated that the federal government cannot share biometric data across agencies because ID.me does not provide the data to the government unless compelled by a court through a mandatory legal process. An IRS spokesperson confirmed that changes to data-retention policies are under discussion but declined to elaborate.
The proposals also include introducing a 'one-to-many comparison' technique to help detect deepfake-based fraud by cross-referencing biometric data. Privacy experts have criticised this approach as unreliable and intrusive. Virginia Democratic Senator Mark Warner urged the IRS to safeguard taxpayer privacy, warning against repeating past abuses.
An anonymous IRS employee described the three-year retention period as 'scary', highlighting that many users may forget to delete old accounts. Nina Olson, executive director of the Centre for Taxpayer Rights, expressed concern about agencies' ability to oversee private firms like ID.me following workforce cuts by DOGE, and predicted that taxpayers would become more reluctant to share information if they felt it was not handled securely.
