Ad Tech & Identity · Identity verification (government benefits / IRS login) · Regulatory action
ID.me
Headline
ID.me became the gatekeeper for IRS online accounts and many state unemployment systems during the pandemic, meaning people could not reach benefits without submitting a selfie and ID to a private company.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
ID.me became the gatekeeper for IRS online accounts and many state unemployment systems during the pandemic, meaning people could not reach benefits without submitting a selfie and ID to a private company. In January 2022 its CEO acknowledged using one-to-many facial recognition after earlier suggesting it did not, and the IRS then added a non-biometric option (Feb. 2022). A November 2022 House Oversight Committee staff investigation (per CyberScoop) found ID.me overstated its capacity to the IRS — telling it wait times were 'about 2 hours' while its own data showed averages over four hours at 14 of 21 state unemployment agencies — and could not substantiate the CEO's $400 billion pandemic-fraud figure. This is a congressional finding, not a regulatory penalty. Its consumer terms require individual JAMS arbitration with a class waiver and no opt-out.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-10-16
Primary source. cyberscoop.com/idme-irs-identity-verification-congress/ — Unverified - heuristic first draft.
Terms
Arbitration
Yes — binding individual JAMS arbitration under the FAA plus class action waiver (Terms §19); small-claims carve-out in D.C.; Delaware law.
Data sharing
Collects selfies and biometric data for government-partner verification. Policy: no sale/rental/trade of PI or biometrics; may share PI with government entities where it 'reasonably believe[s]' an account is engaged in fraud; biometric retention up to 12 months after account closure absent legal process. Historic one-to-many face matching against a fraud database (CEO-confirmed Jan. 2022).
Fees and billing
None identified for consumers (paid by agencies/partners). Access to some government benefits effectively required ID.me enrollment (structural, not a fee).
Contacts
Privacy contact. Privacy Rights Center at account.id.me/privacy
Legal notice. ID.me, Inc., Attn: Dispute Resolution Department, 8280 Greensboro Drive, Suite 800, McLean, VA 22102 (Terms §§17, 19).
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| News (CyberScoop) · 2022-11-17 cyberscoop.com/idme-irs-identity-verification-congress/ | whole row | Unassigned | confirmed | “about 2 hours as of today” Quote basis: not recorded. |
| Wikipedia (lead) · 2026-10-16 en.wikipedia.org/wiki/ID.me | whole row | Unassigned | confirmed | “one-to-many facial recognition” Quote basis: not recorded. |
| Company terms · 2026-10-16 www.id.me/terms | whole row | Unassigned | confirmed | “you and we agree to arbitrate all Disputes between us” Quote basis: not recorded. |
| Company privacy policy · 2026-05-07 www.id.me/privacy | whole row | Unassigned | confirmed | “We will never sell, rent, or trade your Biometric Information” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy https://www.id.me/privacy | Not fetched yet | NOT CONFIRMED |
| Terms of service https://www.id.me/terms | Not fetched yet | NOT CONFIRMED |
| Website https://www.id.me | Not fetched yet | — |
| Primary source https://cyberscoop.com/idme-irs-identity-verification-congress/ Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: VA. Provisions of VCDPA on file:
| Provision | Type | Source |
|---|---|---|
| Applicability Threshold Va. Code § 59.1-576 | threshold | source |
| Right to Confirm and Access Va. Code § 59.1-577(A)(1) | hard | source |
| Right to Correction Va. Code § 59.1-577(A)(2) | hard | source |
| Right to Deletion Va. Code § 59.1-577(A)(3) | hard | source |
| Right to Data Portability Va. Code § 59.1-577(A)(4) | hard | source |
| Right to Opt Out of Sale, Targeted Advertising, and Profiling Va. Code § 59.1-577(A)(5) | hard | source |
| Right to Appeal Denied Request Va. Code § 59.1-577(C) | hard | source |
| Sensitive Data — Opt-In Consent Required Va. Code § 59.1-578(A)(5); § 59.1-575 (definitions) | hard | source |
| Privacy Notice Requirements Va. Code § 59.1-578(C) | hard | source |
| Processor Contract Requirements Va. Code § 59.1-579(B) | hard | source |
| Data Protection Assessment Va. Code § 59.1-580 | hard | source |
| Enforcement — AG Only; Civil Penalties Va. Code § 59.1-584 | hard | source |