Activists pushed the IRS to drop facial recognition. They won, but they're not done yet

(CNN) In mid-February, privacy and digital rights activists were buzzing about a recent victory: Earlier in the month, the Internal Revenue Service said it would back away from a controversial plan to force taxpayers to use facial-recognition software before they could log in to its website.

"This has definitely been a major team effort — the hook, right, left uppercut," Joy Buolamwini, the founder and executive director of the Algorithmic Justice League, said excitedly during a Twitter Spaces session. "So many people coming together for this win."

In addition to the Algorithmic Justice League, which raises awareness of the consequences of artificial intelligence, these people came from groups such as Fight for the Future, the Electronic Privacy Information Center and the American Civil Liberties Union. All have been vociferous critics of the IRS in recent months, contacting reporters and urging individuals, legislators, and the IRS itself to halt a plan that, starting this summer, would have required taxpayers who wanted to access certain online services to first confirm their identities with facial-recognition software from a rapidly growing startup called ID.me.

The activists got what they wanted. Months after announcing its intentions, the IRS backed away from the use of face scans, saying on February 7 that it would "transition away from using a third-party verification service involving facial recognition." The IRS later said it will keep using facial-recognition software to verify taxpayers' identities for the rest of the tax-filing season, but people who want to avoid turning over their biometric data can now speak to a human via video chat instead to prove they are who they say they are. After this tax season, the agency plans to use Login.Gov, which is a single sign-on method used on many federal government websites (it doesn't currently use facial recognition).

Facial recognition has emerged as a hot-button issue where activists who oppose it see a chance to win. Even as the technology has proliferated and been embraced by law enforcement, lawmakers on both sides of the political aisle have expressed serious concerns about its deployment. And while most legislation regarding its usage has been passed at a more local level, this recent decision by a federal agency could mean more widespread limitations are achievable — or so the activists hope.

"This is one of many important wins to come, and I think everyone really has to ask, 'What kind of society do we want to live in? Do we want the face to be the final frontier of privacy?'" Buolamwini said in an interview with CNN Business. "What excites me is the answer isn't written in stone. It's up to us."

So while Buolamwini and other activists sounded celebratory — and relieved — following the IRS' decision, they also knew their work was far from finished.

Facial recognition for taxpayers didn't happen overnight

Facial-recognition software has been blasted by privacy and digital rights groups for years over privacy issues and other real and potential dangers. Buolamwini, a computer scientist known as a pioneer for her work on racial and gender bias in facial-recognition technology, has highlighted many issues in her research, showing how poorly commercial facial-recognition software worked when attempting to classify women and people of color. Several Black men, at least, have also been wrongfully arrested due to the use of facial recognition.

Still, the technology has become increasingly common across the US. Many Americans encountered it for the first time during the pandemic, as state employment agencies started working with ID.me to verify users online in hopes of cutting down on a surge of fraudulent claims for state and federal benefits that cropped up alongside a tidal wave of authentic unemployment claims. Now, more than half of such state agencies use ID.me, as well as numerous federal agencies.

Some argue the government's use of this controversial technology has the potential to normalize it in everyday life, and make it even more likely that such surveillance technology will pop up everywhere from concerts to grocery stores. As of Monday, the IRS continued to urge people logging on to its website to create an ID.me account, and this alone is something that worries EPIC senior counsel Jeramie Scott, who said it may suggest to the user that the technology is "safe and okay to use." (The Treasury Department, which oversees the IRS, declined to comment for this piece.)

When ID.me is used along with facial-recognition software to verify a person's identity, the person is first asked to submit a picture of a photo ID and then take a video selfie with a smartphone or computer so software can compare the two. This one-time procedure uses a type of facial-recognition known as facial verification. (The company recently disclosed that it also uses what's known as one-to-many facial recognition — the software a police department might use — by checking users' images against an internal database, in an effort to prevent identity theft.)

In a statement, ID.me spokesman Patrick Dorton said the company understands that people may have privacy concerns. Dorton noted that the company enables government agencies to let people avoid verification with facial recognition and verify in other ways, such as via a video chat with another human. He also pointed out that ID.me makes it possible for those without a credit history to access government services online — something that has historically been a barrier for many people — and that multiple states have credited it with preventing fraud.

Regardless, privacy and digital rights groups had already opposed the use of ID.me and its facial-recognition software, such as at state employment agencies for accessing benefits. And the IRS's announcement in November that anyone who wanted to log in to its website would encounter such technology seemed like an opportunity to raise issues surrounding the technology on a national scale, said Caitlin Seeley George, program director at Fight for the Future.

"To our organization and definitely to me it felt like a really critical issue, and really a critical line to draw in the sand: That we cannot allow this to become the price for accessing our governmental resources," she said.

The tactics the advocates used

Getting the attention and shifting the actions of an entity like the IRS required the groups to lean on all their strengths. As tax season ramped up in the United States in January, a coalition including Fight for the Future, the Algorithmic Justice League and EPIC launched a website called DumpID.me with an online petition visitors could sign to ask the IRS to stop using facial-recognition technology. Buolamwini sent a letter to the White House Office of Science and Technology Policy, underscoring her concerns about ID.me with a copy of a company white paper that she extensively annotated; she also authored a piece for The Atlantic, urging the IRS not to use the technology. Press releases were issued, and media coverage ramped up.

Activists emailed legislators, pressing them to write to the IRS and ask questions about how the decision to use the technology was made. A number of them did, including a group of 15 Republican Senators expressing "deep concerns" and asking questions about ID.me. Democratic Sens. Roy Blunt and Jeff Merkley asked the agency to stop using biometric-related technology on taxpayers.

"The IRS touches just about everyone in this country. I think that kind of widespread adoption is what finally got the broader public to really pay attention," said Olga Akselrod, a senior staff attorney at the ACLU who last summer began filing public-records requests for a slew of documents related to ID.me's contracts at employment agencies in states such as Oregon and New York.

On Monday, Feb. 7, the IRS responded to the criticism by saying it would not require the use of facial-recognition software for online account access.

"Everyone should feel comfortable with how their personal information is secured, and we are quickly pursuing short-term options that do not involve facial recognition," IRS commissioner Chuck Rettig said in a statement at the time

The response, Seeley George said, is "exactly what you want to hear. It's like they actually heard the message, and they're responding to it in a way that makes us feel pretty comfortable that we're not going to have to fight another tool of facial recognition, and hopefully not another tool of biometrics."

"We need to keep pushing"

While activists were excited by the agency's decision, they want state and federal agencies to stop using facial-recognition software, and legislation to regulate it. In hopes of keeping up momentum, a coalition of 45 groups, including the ACLU, Fight for the Future, Algorithmic Justice League, and EPIC, posted a letter on February 14 thanking the IRS and US Treasury for its decision to stop using facial-recognition technology for login verification and calling on agencies to do likewise.

"We need to keep pushing until it's taken out of all those areas," Buolamwini said.

In the wake of the IRS's decision, some government agencies are rethinking their need for facial-recognition technology. The United States Patent and Trademark Office told CNN Business it's continuing to re-evaluate a plan that, as of April 9, is set to require anyone who wants to file for a trademark to first verify their identity with ID.me or with a paper form through the mail. It has also an uncertain future at the Department of Veterans Affairs, which offers ID.me as an option for logging in to its website but doesn't use facial-recognition software for its authentication process. A spokesperson said the agency's current "option year" on its contract with the company ends April 30. While the VA has two more option years available after that, the spokesperson said it's still "in the process of reviewing market research results" to decide what to do next.

In Massachusetts, a spokesperson for the Executive Office of Labor and Workforce Development confirmed in late February to CNN that the state's Department of Unemployment Assistance planned to stop using ID.me "in the coming weeks," citing a drop in "pandemic-driven fraud and claimant volumes."

Across the country, California's Legislative Analyst's Office said in a recent report that using ID.me to automate identity verification for unemployment benefit seekers helped pay benefits promptly and likely cut down on fraud during the pandemic, but pointed to warnings from privacy experts about issues such as errors and racial bias.

"Now that this critical period has passed, we recommend the Legislature pause and carefully consider the implications of requiring third-party biometric scanning — in this case, facial recognition performed by artificial intelligence," the report said.