Taxpayers will still be able to file their returns the old-fashioned way. But by this summer, anyone wanting to access their records — including details about child tax credits, payment plans or tax transcripts — on the IRS website will be required to record a video of their face with their computer or smartphone and send it to the private contractor ID.me to confirm their identity.

About 70 million Americans who have filed for unemployment insurance, pandemic assistance grants, child tax credit payments or other services have already been scanned by the McLean, Va.-based company, which says its client list includes 540 companies; 30 states, including California, Florida, New York and Texas; and 10 federal agencies, including Social Security, Labor and Veterans Affairs.

But ID.me’s $86 million contract with the IRS has alarmed researchers and privacy advocates who say they worry about how Americans’ facial images and personal data will be safeguarded in the years to come. There is no federal law regulating how the data can be used or shared.