The IRS is reportedly reconsidering its previously-announced plan to require taxpayers to share facial images and other personal data with an unregulated private company, ID.me, in order to file tax returns online or access information about their filings, payments, and returns through the IRS website.

The hesitation by the IRS comes after ID.me was caught lying about whether it uses “one to many” facial recognition to try to identify facial images against large databases of selfies or other mug shots. ID.me had falsely claimed that it only uses “1 to 1” matching to “verify” that a selfie matches previously stored images of a specific person. But the company has now admitted that’s incorrect. ID.me actually  compares selfies submitted by taxpayers (or by hackers or identity thieves, who could easily copy a facial image from a targeted victim’s or their friend’s social media posts) to its own “internal” database of images of tens of millions of people aggregated from unknown sources.

An IRS spokesperson told Jennifer Epstein, Shawn Donnan, Dina Bass of Bloomberg News that “any taxpayer who does not want to use ID.me can opt against filing his or her taxes online.”

That’s sort-of true, but misleading: There are already some tax-related forms, such as the FBAR (Foreign Bank Account Report), that can only be filed online and not in person or in any paper format. Most of the people subject to the onerous annual FBAR filing requirement are immigrants, dual citizens, expats, and/or green-card holders who maintain bank accounts in their countries of origin and/or residence for routine and legitimate personal and family reasons — not the rich criminals evading US taxes or hiding their ill-gotten gains abroad at whom it is ostensibly targeted.

For now, an FBAR can be filed online without setting up an account with ID.me or accepting  ID.me’s arbitration and other terms. But how long will that remain the case? And how would that work for the sort of people who need to file an FBAR, since many people have reported that setting up an account with ID.me requires a US mobile phone number?  There is currently no paper option, so if ID.me were required for online FBAR filing, it would be required for all FBAR filers.

In the real world of government agencies in many states that already require ID.me for online access to government programs, paper-based or ID-me.not alternatives that exist “on paper” may be hard-to-find or nonexistent in practice.

As Irina Ivanova  of CBS News reported:

Several people reached out to CBS MoneyWatch to describe being caught in limbo after they were unable to verify themselves on ID.me.

Arizona resident Michelle Ludlow said she tried to get a new driver’s license last summer at the height of the pandemic. Because government offices were closed for in-person business, Ludlow tried verifying herself online with ID.me — trying for half an hour, over several days, with and without glasses. But the system wouldn’t recognize her face as the one on her license, she said.

“There was no alternative route to go if ID.me couldn’t make a match with a selfie,” she said in an email.

Our recent experience renewing a (non-REAL-ID) California drivers’ license is instructive.

We got a paper notice in the mail that since we hadn’t had a new drivers’ license photo taken recently enough, we weren’t eligible to renew our license by mail, and would have to go to a Department of Motor Vehicles (DMV) office to renew our license in person.

But we weren’t sent a renewal application in the mail. Instead, we were told that the first step in renewing our license “in person” was to complete the application online. (Huh?)When we followed the link to fill out the application, we were taken not to a  printable form, but to a form to sign up for an account with ID.me:

You can use a non-ID.me account with the DMV, apparently, if you already had one before ID.me got involved. But you can’t create a new DMV account without going through ID.me.

Questions about this DMV policy are, unhelpfully and improperly,  directed not to the agency but to — you guessed it — ID.me.

Unable to get any further on the DMV website, we followed the instructions to, “Please visit a DMV field office if you do not want to make a… ID.me account.”

Easier said then done.

At least we were able to make an appointment without an ID.me account. At the door of the DMV office in San Francisco, we showed a printout of our appointment confirmation and were told which line to wait in. When  we got to the front of the line, we explained that we needed to fill out the application in person because we weren’t willing to agree to ID.me’s terms to create an online account.

In response, we were directed to another section of the office with an array of workstations on which to complete the online application… starting with signing up with Id.me!

Back at the first window, after another wait, we explained our situation again. This time we were told to wait (again) while the clerk went off to consult a supervisor. After another long wait, they emerged from a back office and enlisted several other staff members to try to find a paper application form, ransacking desk drawers, file cabinets, and piles of forms and paperwork throughout the array of desks and cubicles.

Finally one of them returned triumphantly with a copy of the license renewal form, which they told us to fill out and then wait in another line for a different window.

At the new window, which seemed to be for a variety of “exceptional” cases, the clerk took one look at our form and turned around to ask several of their nearby colleagues, “Do we still accept paper forms?” After a huddled consultation, the supervisor told them, “Just enter it in the system the way we used to do.”

Luckily, the clerk we were dealing with at this point had been around long enough to remember how to process a paper application, and did so without further delay. In fact, it took them much less time to enter the data from our form than it would have taken us to do it ourselves.

To their credit, none of the DMV staff we dealt with were overtly hostile. They were just confused by our request to do something none of the front-line staff thought was allowed.

At the end of the day, we were able to renew our drivers’ license without signing up with ID.me. But what if we weren’t so persistent? This was at a large DMV office, serving the entire city and county of San Francisco. What would have happened at a smaller DMV office? Would they have been able to find a paper form? Would they have even tried?

Nor can we be confident that we or anyone else will again be able to opt-out of ID.me’s terms the next time our license is up for renewal:

The FAQ on the California DMV website says that “A new paper version of the driver’s license application is available in field offices for customers who choose not to complete the electronic version. Although, DMV is moving towards a completely paperless process and will begin to phase out the paper application.”

The DMV website doesn’t say anything about the basis for this “phase out”. More importantly, regardless of whether the application is completed on paper, online from home, or on a workstation in a DMV office, we’ve found no provision of California law or DMV regulations that would authorize the DMV to require Californians to provide information to, much less consent to terms of, ID.me or any other private third party as a condition  or applying for or receiving a drivers’ license or state ID.

Please let us know if you are denied a California drivers’ license or ID because you don’t consent to hand over your biometric or other data to ID.me, or accept their terms.