ID.me, Inc. is an American online identity network company that allows people to provide proof of their legal identity online. ID.me digital credentials can be used to access government services, healthcare logins, or discounts from retailers. The company is based in McLean, Virginia.[2]
In the wake of the economic downturn caused by the COVID-19 pandemic, ID.me was contracted by numerous state unemployment agencies to verify the identities of claimants. The US Internal Revenue Service also uses ID.me as its only online option in accessing its online taxpayer tools.[3]
History
Origins as TroopSwap and Troop ID
ID.me was founded in early 2010 by Blake Hall and Matt Thompson as TroopSwap, a daily deal website similar to Groupon and LivingSocial with a focus on the American military community.[4][2] The company evolved into Troop ID, which provided digital identity verification for military personnel and veterans.[2] Troop ID allowed service members and veterans to access online benefits from retailers, such as military discounts, as well as government agencies like the United States Department of Veterans Affairs.[5]
Rebrand to ID.me
In 2013, the company rebranded again as ID.me with the goal of providing a ubiquitous secure identity verification network.[4] To that end, they expanded to include verification of credentials for first responders, nurses, and students for discounts. In 2013, ID.me was awarded a two-year grant by the United States Chamber of Commerce to participate in the President's National Strategy for Trusted Identities in Cyberspace (NSTIC), a pilot project intended to help develop secure digital identification methods.[6]
In late 2014, ID.me won a contract with the General Services Administration to provide digital identity credentials with Connect.gov. Co-founder Matt Thompson left the company in 2015. In March 2017, ID.me received $19 million in its Series B funding round. In 2018, ID.me became the first digital identity provider to be certified by the Kantara Initiative at the National Institute of Standards and Technology’s (NIST) IAL2 level.[7]
In 2019, ID.me signed a contract with the Department of Veterans Affairs (VA) to offer “virtual in-person identity proofing”, allowing veterans to verify their identity with the VA via video call.[8] ID.me also signed a contract with the Social Security Administration for single sign-on, identity management, and multifactor authentication in 2020.[9] ID.me also began work with the state of California in 2019 to provide REAL ID document pre-screening for DMVs. Listed partners for discounts on ID.me’s website also include Under Armour, Apple, and Lenovo.[10]
In late 2020, the California Employment Development Department (EDD) notified 1.4 million accounts that the EDD suspected were fraudulent that their benefits would be suspended in 30 days unless they were verified by ID.me.[13] News coverage at that time focused on legitimately unemployed individuals who complained that it took as long as two to three days to speak with a referee or that the EDD did not resume benefits even after they completed the ID.me verification process.[14][15][16]
Federal government
In November 2021, the Internal Revenue Service announced plans to replace their current log-in systems with a third-party verification system, along with replacing their old log-in system with ID.me by mid-2022.[17] However, researchers raised concerns about lack of evidence of accuracy, false negatives which prevent dark-skinned or transgender people from accessing their own information, false positives which let third parties impersonate a taxpayer to access tax information, and citizens' right to refuse to give their biometric information to the government and its contractors.[18] On January 28, 2022, the United States Department of the Treasury, the parent agency of the IRS, announced that it may consider alternatives due to privacy concerns.[19]
The IRS has not abandoned plans to use ID.me, but has instead made changes to how users are verified.[20] On February 21, 2022, the IRS announced that a new option in the agency's authentication system, referring to ID.me, was available for taxpayers to sign up for IRS online accounts without the use of any biometric data, including facial recognition. This was consistent with the IRS's commitment earlier to transition away from the requirement for taxpayers creating an IRS online account to provide a selfie to a third-party service to help authenticate their identity. Taxpayers also had the option of verifying their identity during a live, virtual interview with agents; no biometric data – including facial recognition – was required if taxpayers chose to authenticate their identity through a virtual interview. IRS uses still had the option to verify their identity automatically through the use of biometric verification through ID.me's self-assistance tool if they chose. For taxpayers who selected this option, new requirements were in place to ensure images provided by taxpayers are deleted for the account being created. Any existing biometric data from taxpayers who previously created an online account on IRS.gov that has already been collected will also be permanently deleted within a few weeks. It was stated that while this short-term solution is in place for this year's filing season, the IRS will work closely with partners across government to roll out Login.gov as an authentication tool. The General Services Administration was said to be working with the IRS to achieve the security standards and scale required of Login.gov, with the goal of moving toward introducing this option after the 2022 filing deadline.[21]
Services
ID.me offers numerous identity verification products,[10] supplied by third parties. For "high-assurance" identity verification, the company verifies personal data, including drivers' licenses, passports, and social security numbers.[22] Users must also take a video selfie with their phones, using the ID.me photo app.[2] If ID.me fails to verify users through this information, users are directed to talk to a "Trusted Referee" video call.[23] ID.me users have expressed frustration due to long delays on its video call line.
As part of its identification system, the company collects a wide range of personal information, including photographs and identification documents.[24] The company verifies information by sending it to a number of "government agencies, telecommunications networks, financial institutions" and other companies which the company trusts and considers reliable. The company treats Internet Protocol addresses and unique device identifiers as non-personally identifiable, and releases them to third parties, along with location, occupation, language, the list of pages browsed at ID.me, and the URLs visited before and after using ID.me.[24]
ID.me is one of three companies, along with USAA and Zentry, certified to Security Assertion Markup Language (SAML) Level of Assurance 3.[25] ID.me's privacy policy states that users must consent before any information is shared with third-party sources. However, its policy also states that "by utilizing your ID.me Account at Third-Party Websites, you are expressly authorizing [ID.me] to share certain Personally Identifiable Information or Sensitive Information tied to your ID.me Account with such Third-Party Websites."[26]
ID.me said in a press release that their products use one-to-one facial recognition technology that matches a photo taken from an individual to a Government ID.[27] Co-founder and CEO Blake Hall also confirmed the one-time use of one-to-many facial recognition, which matches an image against a database of other faces, to identify people who are known for committing fraud. This information has sparked concerns from privacy activists and organizations. It also led to concerns about people with limited access to technology that they are required to use a third-party company to access the services that they can use.[28] In an interview with Axios, Hall has defended its practices, citing that the company is working to make its service both equitable and available.[29][30]
