"Tax prep firms like H&R Block shared taxpayer data with Facebook and Google, lawmakers say", 12 July 2023

Taxpayers who used TaxAct, H&R Block or TaxSlayer to file their tax returns may have had personal data shared with tech giants like Meta and Google, according to a Congressional report...

A probe led by Democratic Sen. Elizabeth Warren found the tax prep companies had potentially violated privacy laws by “recklessly” sharing tens of millions of taxpayers’ sensitive personal and financial data with Facebook parent company Meta for years. The privacy breach was first reported last year by the nonprofit journalism outlet The Markup.

The companies said they used Meta Pixel, a piece of code used to track website visitors, “for at least a couple of years.” All three also shared data with Google through Google Analytics for even longer, but a Warren aide told CNN that the report focuses more heavily on Meta because Google “did not appear to have used the information for its own commercial purposes as overtly as Meta.” 

The probe reveals “a troubling pattern” of data sharing by tax prep companies, according to the report.

What sort of data was shared?

The Markup’s November report found the companies shared information like names, email addresses, income, filing status, refund amounts and dependents' college scholarship amounts through Meta Pixel. Taxpayers who used TaxAct’s Free File Service, a service made available through a partnership with the Internal Revenue Service, also had their information shared with the tech companies. 

...report revealed that TaxAct allowed Meta to collect even more data than initially reported, including approximate federal tax owed and tracked buttons clicked and names of text-entry forms that could indicate whether taxpayers were eligible for certain deductions.

All three companies said they have removed or disabled the Meta Pixel from their websites after The Markup’s report was published, according to the report. 

“H&R Block takes protecting our clients’ privacy very seriously, and we have taken steps to prevent the sharing of information via pixels,” spokesperson Heather Woodard said in an emailed statement. 

A statement from TaxAct said the company has "always complied with laws that protect our customers’ privacy" and is "committed to engaging with stakeholders to address any concerns and to help advance public policy."

TaxSlayer did not immediately respond to a request for comment.

How could the data be used?

While the companies said the shared data was anonymous, the report says it could “easily” be used to identify individuals or create a dossier used for targeted advertising or other purposes. 

Meta said that it used the taxpayer data to target ads and train its AI algorithms.

Google spokesperson Angela Krieger said the company has policies and technical features that prohibit Google Analytics customers from collecting data that could be used to identify an individual.

What happens next? 

Warren and the other lawmakers who spearheaded the probe called on enforcement agencies like the IRS, the Treasury Inspector General for Tax Administration, the Federal Trade Commission and the Department of Justice to investigate the data sharing and “prosecute any company or individuals who violated the law.”

The report notes that violating taxpayer privacy laws can lead to fines of up to $1,000 per violation and up to one year in prison.

The lawmakers say the investigation highlights the need for the IRS to develop its own online tax filing system “to protect taxpayer privacy and provide a better alternative for taxpayers to file their returns.”