IRS Keeps Private IDMe Between Taxpayers and Services

The IRS still uses the private identity-verification platform IDMe, despite saying it planned to move to the government’s Login.gov. That leaves taxpayers caught in a dispute over who controls access to online tax services. Senators Ron Wyden (D-Ore.) and Elizabeth Warren (D-Mass.) want Treasury Secretary Scott Bessent and IRS Chief Executive Officer Frank Bisignano to explain why IDMe remains in use, including for the 2027 filing season.

A private checkpoint for public services

The senators said the IRS pledged in 2022 to move away from IDMe. Yet taxpayers still see IRS instructions saying they need IDMe to access most accounts and services, even as Treasury expands its use of the platform. For people seeking those services, identity verification means handing personal information to a private company or using the government alternative the IRS says is also available.

In a letter to Bessent and Bisignano, Wyden and Warren warned that reliance on IDMe raises concerns about “privacy, cybersecurity and data breaches and accountability and oversight.” They also pointed to federal law requiring agencies to use the government’s single-sign-on platform unless a statutory exception applies. If Treasury or the IRS believes an exception applies, the senators wrote, it must explain that decision to Congress.

The senators said the technical case for continuing to require IDMe remains unclear. Login.gov meets IAL2 identity-verification requirements and offers multifactor authentication, fraud prevention, U.S. passport verification and in-person verification at participating U.S. Postal Service locations, they said. Login.gov serves more than 180 million users across 54 agencies and states.

The choice taxpayers were promised

The IRS told Federal News Network that it offers “multiple ways for taxpayers to verify their identity and access IRS online services.” The agency said taxpayers could use either Login.gov or IDMe for the 2027 filing season, presenting the options as a way to provide more choice, convenience and security. That assurance conflicts with the senators’ account that taxpayers still need IDMe for most IRS accounts and services.

Wyden and Warren also urged the IRS in 2024 to stop using ID.me for its Direct File program. They cited concerns about the accuracy of its facial-recognition software and the possibility that required facial recognition could create barriers for some taxpayers. “Direct File was created in part to ensure taxpayers have an option to not give their money and personal information to private companies when filing their taxes,” they wrote. “But by contracting with IDME, taxpayers concerned about their privacy are required to hand over personal data to yet another private company.”

The record details congressional questioning and agency choices, not a community-led alternative or direct action. For now, lawmakers are seeking answers from federal officials. They requested responses or data on 12 questions and topics from the IRS and Treasury by Nov. 9.

Competing claims over the machinery

An IDMe spokesperson said the company has supported Treasury since 2021 and earned and maintained the trust of 24 other federal agencies. The spokesperson said IDMe outperformed competitors, including Login.gov, in customer service, ease of use and protection of taxpayer data. “We do not sell, rent or trade users’ personal information,” the spokesperson said, adding that biometric data collected for TreasuryDirect verification stays within IDMe’s walls and is never sold, shared or matched against outside databases.

The spokesperson also said IDMe’s privacy and data controls stand in contrast to “the business model, well-documented track record and poor performance of the data brokers used by Login.gov.” Jeremy Grant, director of the Better Identity Coalition, described another problem: government hasn’t kept pace as more transactions move online, creating a market opportunity for private providers. “The government hasn't taken steps to close what other countries have said is an obvious gap where the government should play a role,” Grant said.

In August, the Office of Management and Budget directed agencies, whenever possible, to use Login.gov as the single source for authentication and verification. The memo said agencies “must phase out identity solutions that do not meet this description” and should reassess other systems. It also said Login.gov must be promoted as the default for new accounts where it can serve users, while exempting some systems, including those run by the Defense Department and national security systems. Grant said Login.gov’s partnership with the National Institute of Standards and Technology to use mobile driver’s licenses showed its capabilities had advanced. The agencies must now explain why the private checkpoint remains in place.