ID.me Authenticator

"ID.me stores your Personal Information for as long as needed, or permitted, based on the reason why we obtained it (consistent with applicable law and contractual obligations). This means we may retain your Personal Information even after you close your account with us, for up to three (3) years. We acknowledge all such requests, however we reserve the right to retain data tied to certain high-risk transactions, particularly in government and healthcare settings, exclusively for fraud prevention and government audit purposes."

ID.me retains personal information for up to 3 years after account closure, and reserves the right to keep data from "high-risk transactions" even longer for fraud prevention and audit purposes, giving users limited control over actual deletion.

"You may close your ID.me account at any time, by choosing to close your ID.me account you are directing ID.me to deactivate your identity credential and to purge the associated data from active use in our databases. Please note, however, that ID.me does retain account history (e.g., events, logins, and transactions) as well as verification history (e.g., community, vaccine, or identity details including documentation and data elements used for verification) for up to three (3) years."

Closing your account only deactivates the credential and purges data from 'active use' — ID.me still retains your full account and verification history, including identity documents and verification data, for up to 3 years.

"In order to verify your identity and eligibility to receive discounts and other benefits from our partners and other service providers, we may provide your Personal Information to third parties such as government agencies, telecommunications networks, financial institutions or other trusted and reliable sources of information. We may also share your information with unaffiliated companies or individuals we hire or work with that provide us with professional advice, business support, or perform services on our behalf, including customer support, web hosting, information technology, payment processing, direct mail and email distribution, and administration, and analytics services."

ID.me shares personal information with a broad range of third parties including government agencies, telecom networks, financial institutions, and various service providers for analytics, marketing distribution, and other business purposes.

"This Privacy Policy may be updated periodically to reflect new ID.me features or changes in our Personal Information practices. We will post a notice for consumers at the top of this Privacy Policy of any significant changes. We will indicate at the top of the Privacy Policy when the policy was most recently updated."

ID.me can change the privacy policy at any time, with the only notice being a posting on their website. There is no requirement for direct user notification or consent before changes take effect.

"The information we automatically collect may also include geolocation information, such as information that identifies the approximate location of your device and your IP address, which may be used to estimate your approximate location."

ID.me automatically collects geolocation data from your device and IP address without requiring explicit opt-in for each collection instance.

"We may also collect information about you from other sources, including service providers, data licensors and aggregators, marketing companies, programming distributors, and public databases. We may derive additional information or draw inferences about you based on the information we have collected from you directly, passively, or through third parties."

ID.me aggregates data from data brokers, marketing companies, and public databases, then draws inferences about users by combining directly collected, passively collected, and third-party data into a unified profile.

"When you verify yourself, either individually or as part of a community, with ID.me you provide us with Personal Information that may include your name, date of birth, social security number and/or other government issued identification numbers, copies of your government issued identification card (e.g., license or passport), email address, phone number, mailing address, and certain photographic images, and biometric data."

ID.me collects highly sensitive device and personal data including biometric information and photographic images, which are retained for up to 36 months depending on the partner, going beyond what a simple identity verification might require.