ID.me says it will make automated facial recognition verification optional for its government partners and let users delete their face scans starting on March 1
Context & Ripple Effects
ID.me spent January under fire: it won the IRS login mandate covering tax filing and payments, then admitted to running 1:many facial recognition across large databases — the very technique it had publicly called more problematic than 1:1 matching. Bipartisan backlash followed, and the IRS said it would transition away from facial recognition entirely.
This announcement is the concession that keeps ID.me in the game: rather than lose the government authentication business outright, it makes automated facial recognition optional for agency partners and lets users delete their stored face scans starting March 1.
First-order effects
- Users verifying their identity for IRS.gov and other federal programs can now complete enrollment without submitting to automated facial recognition, and anyone already enrolled can purge their face scan from March 1.
- ID.me retains its position as the government's identity-verification vendor, but only by accepting that biometric capture is no longer a condition of access.
Second-order effects
- The GSA's plan to add facial recognition to Login.gov now has a template to follow — its stated intent to offer an alternative for users who skip the tech mirrors the opt-out structure ID.me just adopted, effectively setting the design other vendors must match to win federal work.
- Rival identity providers bidding on government contracts must now price in non-biometric fallback flows and deletion infrastructure, raising the baseline cost of competing for public-sector deals.
Third-order effects
- Government digital identity is converging on a consent-based model where biometric verification is an option, not a gate — echoing Meta's earlier decision to shut down Facebook's face-recognition system and delete over a billion users' scans, the pattern suggests large face-scan databases are becoming a liability vendors can no longer defend.
- If agencies standardize on opt-out-plus-deletion requirements, the durable power shifts to whoever controls the access layer itself — the login relationship — rather than whoever holds the biometric data.
The trend: Public-sector identity verification is shifting from mandatory biometric gates to consent-based systems where vendors survive backlash by offering opt-outs and deletion rights.