Washington, D.C. – Senate Finance Committee Ranking Member Ron Wyden, D-Ore., and Senate Banking, Housing, and Urban Affairs Committee Ranking Member Elizabeth Warren, D-Mass., today demanded the Department of the Treasury halt a rushed transition to the third-party identity-verification company ID.me for Americans trying to access their savings bonds online. They also demanded an explanation for why the Internal Revenue Service (IRS) had not transitioned away from ID.me.
“Americans should not have to provide sensitive personal information to ID.me as the price of accessing essential government services when a secure government-operated alternative is available,” the senators wrote. “The Treasury Department’s and IRS’s reliance on ID.me raises significant concerns about privacy, cybersecurity, and data breaches, accountability and oversight, and the collection, retention, and use of sensitive personal information.”
Yesterday, Treasury began requiring the use of ID.me to access TreasuryDirect, following six weeks’ notice about the change. TreasuryDirect is the only place to buy and redeem U.S. savings bonds electronically. These investments are largely held by older Americans, who may not have the digital skills to navigate new and complicated online systems.
The senators raised alarm about the use of ID.me, which asks users to submit biometric data like facial recognition scans. The use of facial recognition systems raises civil liberty concerns as well as documented biases against people of color, women, and seniors. Additionally, federal law and other directives from the current administration have rightly encouraged the use of Login.gov across agencies as a safe, single sign-on experience for the public.
Wyden and Warren asked the agencies to:
-
Delay the ID.me requirement until after the 2027 tax filing deadline to protect investors who need to download their tax documents.
-
Provide an explanation of why the Treasury Department and IRS continue to use ID.me instead of the government-run Login.gov platform.
-
Provide details on whether ID.me is allowed to retain users’ biometric data and use “one-to-many” facial matching, which is known to be inaccurate and invasive.
-
Provide information on how much the agencies have paid ID.me over the last four years.
-
Provide a timetable for making Login.gov available—and the default option for new users—where it can meet the applicable requirements.
The text of the letter is here.
###