Attention FAE Customers:
Please be aware that NASBA credits are awarded based on whether the events are webcast or in-person, as well as on the number of CPE credits.
Please check the event registration page to see if NASBA credits are being awarded for the programs you select.

Congressional Report: Tax Prep Companies Shared Personal Data with Tech Sites

S.J. Steinhardt
Published Date:
Jul 12, 2023

GettyImages-1020375664 Cyber Attack Security Data Breach Hack

Three large tax preparation companies shared confidential user data with Facebook and Google in violation of federal law, an investigation by a group of six U.S. senators and one U.S. representative found.

The investigation, sparked by a November 2022 story by The Markup, revealed that the three companies—H&R Block, Tax Slayer, and TaxAct—tracked the information that users typed into their tax preparation websites using pixels, a common technology utilized on almost all websites for customer ad targeting on social media. The technology then sent that data, which included sensitive personal information such as marital status and income, to Google and Facebook.

The lawmakers, led by Sens. Elizabeth Warren (D-Mass.) and Ron Wyden (D-Ore.), wrote to the U.S. Department of Justice (DOJ) on July 11 to urge criminal charges against the companies, The Washington Post and other news organizations reported.

“The tax prep firms were shockingly careless with their treatment of taxpayer data,” the lawmakers wrote in a letter to the IRS, the Federal Trade Commission (FTC), and Attorney General Merrick Garland, the Post reported. “They indicated that they installed the Meta and Google tools on their websites without fully understanding the extent to which they would send taxpayer data to these tech firms, without consulting with independent compliance or privacy experts, and without full knowledge of Meta’s use of and disposition of the data.”

The introduction to the report also supported the IRS’s plan to develop its own free tax preparation software, which is projected to roll out in January 2024.

Currently, the IRS offers a Free File program for taxpayers whose adjusted gross income (AGI) is $73,000 or less, Accounting Today reported. The program is a public-private partnership between the IRS and the tax preparer and filing software industry companies; these companies provide free online tax preparation and filing for taxpayers who qualify. Seventy percent of taxpayers qualify for this program, but fewer than three percent use it, the U.S. Government Accountability Office reported in 2022.

The report found that some of the customers affected by the data sharing were using a free version of TaxAct that is a part of that program.

H&R Block said its do-it-yourself tax filing website filed 8.4 million returns in the most recent tax filing season, the Post reported. An analysis of IRS data by tax prep company Column Tax found that TaxSlayer filed 1.5 million returns and TaxAct filed three million returns for customers in 2022, according to the Post.

“H&R Block takes protecting our clients’ privacy very seriously, and we have taken steps to prevent the sharing of information via pixels,” the company said in a statement to the Post. TaxAct and TaxSlayer did not respond to inquiries from the newspaper.

Meta, the parent company of Facebook, blamed the tax prep companies in an emailed statement to the Post. “We’ve been clear in our policies that advertisers should not send sensitive information about people through our Business Tools,” the statement read. “Doing so is against our policies and we educate advertisers on properly setting up Business tools to prevent this from occurring. Our system is designed to filter out potentially sensitive data it is able to detect.”

Google also seemed to blame the companies in its emailed statement.

“We have strict policies and technical features that prohibit Google Analytics customers from collecting data that could be used to identify an individual,” the company wrote. “Site owners—not Google—are in control of what information they collect and must inform their users of how it will be used. Additionally, Google has strict policies against advertising to people based on sensitive information.”

Click here to see more of the latest news from the NYSSCPA.