The U.S. Internal Revenue Service (IRS) is considering new proposals that would allow third-party contractor ID.me to retain taxpayers' biometric data for up to three years after their accounts are closed, raising significant privacy concerns. Currently, ID.me is required to delete such information within 24 hours of account closure.
Background of the Proposal
The IRS and the Treasury Department are reviewing their relationship with ID.me, which handles identity verification for federal websites. The changes, outlined in a presentation shown to Treasury staff on April 16, aim to combat the growing threat of AI-powered fraud. Under the new rules, ID.me could keep biometric records for as long as an account is active and for an additional 36 months after deletion.
Privacy and Security Concerns
While the extended retention period alarms privacy activists, the use of biometric data by the federal government is strictly controlled. Data can only be accessed for law enforcement investigations or inspector general probes, and only with a subpoena, warrant, or other legal justification. An ID.me spokesperson stated that the government cannot share biometric data across agencies because the company does not share it with the government unless compelled by a court.
An anonymous IRS employee called the three-year retention period "scary," noting that many users have dormant accounts they forget to delete. Another controversial change is the introduction of "one-to-many comparison" analytics to detect deepfake fraud, which privacy experts criticize as unreliable and intrusive.
Political and Advocacy Reactions
Virginia Democratic Sen. Mark Warner urged the IRS to carefully safeguard taxpayer biometric data, citing historical abuses of taxpayer privacy. Nina Olson, executive director of the Center for Taxpayer Rights, expressed concern about agencies' ability to oversee private contractors like ID.me, especially after workforce cuts by Elon Musk's DOGE last year. She warned that taxpayers might become reluctant to share information if they doubt its security.
Growing Fraud Threat
The government began collecting biometrics to combat AI-enabled fraud, which ID.me reports surged over 1,210 percent in 2025. However, previous data-sharing agreements, such as between the IRS and ICE, have faced litigation. The IRS spokesperson declined to discuss details of the proposed changes, which remain under discussion.
