Two domain names, ID.me and Login.gov, are at the center of a growing debate over how Americans verify their identities when accessing federal government services.

According to POLITICO, Senators Ron Wyden and Elizabeth Warren are questioning the Treasury Department and IRS over their expanding reliance on private identity verification provider ID.me, instead of the government-operated Login.gov platform.

The dispute follows TreasuryDirect’s mandatory transition to ID.me on October 28, affecting Americans who purchase and manage U.S. savings bonds online.

The senators want answers about ID.me’s government contracts, costs, biometric data handling, and why Login.gov was not selected. They are also requesting a delay until after the 2027 tax filing season, citing potential difficulties for older Americans and users with limited technological experience.

From a domain industry perspective, the contrast must be pointed out:

ID.me operates on .me, Montenegro’s country-code top level domain (ccTLD), commercially available worldwide. The company itself is American, headquartered in Virginia.

Login.gov uses .gov, the restricted domain extension reserved for verified U.S. government organizations. The service is operated by the General Services Administration (GSA).

Both platforms serve major federal agencies:

ID.me is used by the IRS, TreasuryDirect, Social Security Administration, Veterans Affairs, and other federal services.

Login.gov provides access to services including USAJOBS, Global Entry, Social Security, and Veterans Affairs. The U.S. Army has also announced plans to integrate Login.gov into its Project Gatekeeper platform.

Some agencies support both systems.

ID.me defended its performance to POLITICO, claiming advantages over Login.gov in customer service, accessibility, fraud prevention, and data protection.

The domain extensions themselves do not determine the security or reliability of either platform. A government operated .gov domain, however, carries an explicit institutional identity that a privately operated ccTLD does not.

What’s at stake goes beyond two short domain names.

Should millions of Americans depend on a private verification provider, potentially surrendering sensitive biometric information, to access essential government services when a federally operated alternative exists?