May 18, 2022

Wyden, Colleagues Urge FTC to Investigate ID.me for Deceptive Statements about Facial Recognition

Washington, D.C. – U.S. Senator Ron Wyden, D-Ore., today sent a letter to the Federal Trade Commission (FTC) urging the agency to investigate evidence that ID.me — a provider of identity verification services widely used by federal and state government agencies — made multiple misleading statements about its use of facial recognition. The letter was joined by U.S. Senators Cory Booker, D-N.J., Edward J. Markey, D-Mass., and Alex Padilla, D-Calif.

In blog posts and public statements, from at least June 2021, ID.me claimed its “one-to-one” facial recognition technology was superior to “one-to-many” facial recognition, in which a person’s photo is queried against a “digital lineup” of other people’s photos. Experts have criticized one-to-many facial recognition due to privacy concerns and evidence that such systems are less accurate at identifying people of color, and ID.me repeated these criticisms as it sought to distance itself from them. On January 24, 2022, after the backlash against the IRS’ plans to require facial recognition through ID.me, the company’s Chief Executive Officer Blake Hall published a statement in which he emphasized once again that ID.me “does not use 1:many [one-to-many] facial recognition,” calling it “problematic” and “tied to surveillance applications.”

Just two days after this unqualified public denial, Mr. Hall reversed course, in a LinkedIn post in which he admitted that ID.me uses one-to-many facial recognition as part of its identity verification process. Blog posts and other materials on the company’s website were edited after his announcement to amend the company’s previous statements about one-to-many facial recognition. 

“ID.me’s statements, therefore, appear deceptive, and were harmful in two ways. First, they likely misled consumers about how the company was using their sensitive biometric data, including that it would be stored in a database and cross-referenced using facial recognition whenever new accounts were created in the future. Second, the statements may have influenced officials at state and federal agencies as they chose an identity verification provider for government services. These officials had the right to know that selecting ID.me would force millions of Americans – many of them in desperate circumstances – to submit to scanning using a facial recognition technique that ID.me itself acknowledged was problematic. We therefore request that you investigate evidence of ID.me’s deceptive public statements to determine whether they constitute deceptive and unfair business practices under the Section 5 of the FTC Act,” the senators concluded in their letter to FTC Chair Lina Khan. 

The secret use of a large facial recognition database both violated customer privacy and raised the possibility that individuals were wrongly denied government services, senators wrote.

“This risk is especially acute for people of color: NIST’s [National Institute of Standards and Technology] Facial Recognition Vendor Test found that many facial recognition algorithms have rates of false matches that are as much as 100 times higher for individuals from countries in West Africa, East Africa and East Asia than for individuals from Eastern European countries. This means Black and Asian Americans could be disproportionately likely to be denied benefits due to a false match in a one-to-many facial recognition system,” the senators continued. 

Federal and state government agencies have turned to ID.me, a commercial digital identity provider, to verify online applicants for government services. In January, the Internal Revenue Service’s (IRS) use of ID.me set off a long-overdue public debate about the appropriateness of requiring facial recognition technology as a condition of accessing government services. To the IRS’ credit, after Sen. Wyden urged the IRS to change course, the agency announced on February 7, 2022, that it would no longer require the use of facial recognition. However, dozens of other federal and state agencies continue to require applicants to submit to facial recognition scanning by ID.me in order to access essential services like state Unemployment Insurance.

The full text of the letter is here. 

###