Skip to content
This is NOT an official site of the Government of Canada. Click here for the official AI registry.

Helpful Places

Government of Canada – DTPR AI Register

Back to your search

AI-Assisted Identity Verification for Tax Account Access

Entry · Safety & Security

What it collects that can identify you

Biometric
Identifiable data
  • A live facial image captured via the taxpayer's smartphone camera, used to perform a biometric comparison against the photo on the government-issued ID document.
Sensitive personal information
Identifiable data
  • A government-issued photo identification document (e.g. driver's licence or passport) scanned via the taxpayer's smartphone, containing the person's name, photo, and other identifying information.
Run by
Canada Revenue Agency (CRA)
Where
No fixed location
Kept
Not stated by the Helpful Places.
Shared with
Accountable organization, Vendor

What it is for

EntrySafety & Security

This system allows Canadian taxpayers to immediately access Canada Revenue Agency online services by using their smartphone, a government-issued ID, and facial recognition technology. Previously, access required waiting 5–10 days for a mailed security code. The system was developed by a vendor called Interact and launched in March 2024. Taxpayers are informed that AI is being used in this process.

What it collects and what happens to it

Data taken in

Biometric
Identifiable data
  • A live facial image captured via the taxpayer's smartphone camera, used to perform a biometric comparison against the photo on the government-issued ID document.
Sensitive personal information
Identifiable data
  • A government-issued photo identification document (e.g. driver's licence or passport) scanned via the taxpayer's smartphone, containing the person's name, photo, and other identifying information.

Processing

Biometric Recognition
  • Facial recognition technology compares the live selfie image captured by the taxpayer's smartphone against the photo on the scanned government-issued ID to verify that the person is who they claim to be.
Computer Vision
  • Image and object recognition is applied to interpret and extract data fields from the government-issued ID document image, including reading printed text, detecting document features, and recognising document type.
Classification & Prediction
  • Classification and prediction models assess whether the identity document is genuine and whether the biometric match is sufficient to grant access, producing a match confidence score.
Anomaly Detection
  • Anomaly detection flags unusual patterns in the submitted ID document or facial image that may indicate fraud, tampering, or presentation attacks (e.g. a printed photo held in front of the camera).

What it does

Sensing (Perceptive AI)
Human decides
  • The system reads the taxpayer's smartphone camera image and the scanned government-issued ID document, extracting structured identity fields and facial features from raw pixels and document images.
Deciding (Analytical AI)
Human decides
  • The system classifies and scores the identity match between the live facial image and the photo on the government-issued ID, and predicts whether the document is authentic using anomaly detection and classification.

Outputs

A decision about you
Identifiable data
  • A pass/fail identity verification decision that either grants or denies the taxpayer immediate access to CRA online services based on the biometric and document check.

Run by

Canada Revenue Agency (CRA)
  • The Canada Revenue Agency (CRA) is the federal government department responsible for administering tax laws and programs. It deploys this identity verification system to grant taxpayers immediate access to CRA online services.

Canada AI Register — 2526-CRA-ARC-005

Built by

Interact
  • Interact is the technology vendor that developed the Document Verification Service, supplying the facial recognition and document verification capabilities used in this system.

Canada AI Register — 2526-CRA-ARC-005

Kept for

Not stated by the Helpful Places.

Shared with

Available to the accountable organization
  • The Canada Revenue Agency has access to the identity verification results produced by the system for the purpose of granting or denying access to CRA online services.
Available to vendor
  • The register notes that data sources are 'Awaiting input from the vendor,' indicating that the scope of vendor data access has not been publicly confirmed. It is unknown whether Interact retains or processes biometric or document data beyond the immediate verification step.

Stored

Not stated by the Helpful Places.

How to read the colours

Can it identify you?

Anonymized data
Data about people with the link to who is broken. Stripped of identifiers, blurred, aggregated, or noised so this system can’t reasonably tie a record back to an individual.
Pseudonymous data
Each person’s data is tied to a token (hash, ID, template) that lets this system recognise the same person across events, but the token itself doesn’t reveal a name. Reidentification is possible with extra information.
Identifiable data
The data either contains a direct identifier (name, address, account name, recognisable face or voice, plate number) or carries a token this system uses to look up legal identity during processing.

Who completes the loop?

Human decides
This mode suggests; a person decides what to do next. The AI is always advisory — a human is in the loop on every decision. Example: a triage tool ranks cases for a clinician who chooses which to see first.
Human executes
This mode decides; a person carries out the result. Example: an optimizer plans the day’s trash-collection routes, and drivers run them.
Autonomous
This mode decides and acts on its own. No person reviews each decision or carries out the resulting action.

Definitions from the DTPR standard. Amber is about your data, violet about who decides. The fuller the shape and the deeper the colour, the more identifying the data or the less a person is involved.

What you can do

Ask about this system

Questions go to the Helpful Places, not the vendor.

Your rights

  • Right to Be Informed of AI UseTaxpayers are informed that AI is being used during the identity verification process before they proceed. The register confirms that AI use is disclosed to users. For more information, contact the Canada Revenue Agency.
  • Right to Algorithmic TransparencyThe CRA has published this entry in Canada's public AI register, disclosing that the Document Verification Service uses image recognition, text analysis, anomaly detection, and classification to verify identity. Citizens may consult the register at open.canada.ca for general information about how the system works.

Risks and safeguards

  • Civil liberties harmFacial recognition in a government access context raises civil liberties concerns including potential for surveillance creep, denial of access to public services, and disproportionate error rates for certain demographic groups. The CRA states that AI use is disclosed to taxpayers, and the original mail-based security code process remains an alternative. No further specific mitigation details (audit regime, accuracy thresholds, demographic testing) are documented in the register entry.
  • Reputational harmMisidentification by the facial recognition system could wrongly deny a taxpayer access to their own account or, conversely, allow an impostor access. This could damage trust in the CRA and stigmatise affected individuals. The register does not detail accuracy benchmarks, demographic fairness testing, or a formal right-of-correction process for denied individuals; these gaps represent unmitigated risk under the current disclosure.