Requiring facial recognition in the first place is uncomfortable, though the status quo of treating SSNs as adequate for auth is problematic. That said, requiring citizens to submit incredibly sensitive information to some arbitrary private company is abhorrent.

Especially concerning is that ID.me's site has a link at the bottom marked "Do Not Sell My Personal Information (CA Residents Only)". Sounds those of us outside of CA will have to consent to some private company profiting off our private data in order to interact with the IRS online in any meaningful way.