(CNN) — Some of America’s largest tax preparation firms have for years shared sensitive American financial data with tech titans like Meta and Google, in a potential violation of federal law, data that in some cases was misused to targeted advertising, according to a seven-month congressional investigation.
The report highlights what legal experts described to CNN as a “five-alarm blaze” for taxpayer privacy that could lead to government and private lawsuits, criminal penalties or even a “death blow” for some industry giants. industry involved in the investigation, such as TaxSlayer, H&R Block and TaxAct.
According to the congressional report reviewed by CNN, the three tax preparation companies allegedly sent tens of millions of Americans’ personal data to the tech industry without their consent or proper information.
Beyond ordinary personal data, such as names, phone numbers, and email addresses, the list of shared information also included taxpayer data: details about people’s marital status, adjusted gross income, the size of their tax refunds and even information about the text fields and buttons they clicked when filling out their tax forms, which could reveal what tax breaks they may have claimed or what government programs they use, according to the report.
The report, which was based on congressional interviews and written testimony from Meta, Google and tax preparation firms, also found that all taxpayers who used TaxAct’s IRS Free File service while tracking was on reportedly shared their information. with technology companies. Some of the tax preparation companies still do not know if the data they shared is still in the hands of the technology platforms, according to the report.
“On a scale of 1 to 10, this is a 15,” said David Vladeck, a Georgetown University law professor and former head of consumer protection at the Federal Trade Commission (FTC). the country’s leading privacy watchdog. “This is the biggest violation of privacy I’ve ever seen, other than the exploitation of minors. This is a five-alarm fire, if what we know so far is true.”
It’s also an example, Vladeck said, of why the United States needs federal legislation that guarantees all Americans the basic right to data privacy, an issue that has been deadlocked in Congress for years despite electronic data becoming They are becoming an increasingly important part of the global economy.
The congressional findings represent the latest allegations of wrongdoing affecting the embattled tax preparation industry, after a report by investigative journalism outlet The Markup last year highlighted the practice of tracing.
Wednesday’s devastating report builds on those earlier revelations by identifying a hitherto unreported category of data that was allegedly collected and shared: the web page titles of online tax programs that can reveal to whom tax forms have been accessed by users, said an aide to Democratic Sen. Elizabeth Warren, who helped lead the congressional investigation. For example, taxpayers who entered information about their college savings contributions or rental income may have done so on web pages with titles that reflect that information, which would then have been shared with technology companies, the aide said.
During the investigation, Meta told investigators that it used the taxpayer data it received to target third-party ads to users of its platform and to train its artificial intelligence algorithms, according to the report. Warren’s adviser told CNN it was unclear if Meta knew he was misusing taxpayer data at the time. A Meta spokesperson said the company instructs its partners not to use its tools to share sensitive information and that Meta’s systems are “designed to filter potentially sensitive data that it is capable of detecting.”
The technology behind the data collection, known as a tracking pixel, is commonly used throughout the internet. Tracking pixels, a small piece of code that website owners can insert into their websites, collect information that can help companies, including Meta and Google, among others, understand the behavior or interests of site visitors. Web.
Thanks to the tracking technology used by TaxAct, TaxSlayer and H&R Block, “each and every taxpayer who used their websites to file their tax returns could have shared at least some of their data,” the report states.
According to the document, the tax preparation companies at the center of the investigation told lawmakers that the data collected had been encrypted to help protect privacy. But the report also says that some of the tax preparation firms themselves were not fully aware of the amount of information that was being exposed to the technology platforms, and the report cites previous FTC investigations that found that even “anonymous” data ” can be easily manipulated to identify a person.
The use of pixels in the context of taxpayers led to a “reckless” sharing of legally protected data that could put taxpayers at risk, according to the report by Warren and his fellow Democrats, Sens. Ron Wyden, Richard Blumenthal , Tammy Duckworth and Sheldon Whitehouse; Senator Bernie Sanders, an independent who agrees with the Democrats; and Democratic Rep. Katie Porter.
The FTC, the Internal Revenue Service (IRS), the Department of Justice (DOJ), and the Treasury Inspector General for Tax Administration (TIGTA) “should fully investigate this matter and prosecute any business or individual found to have violated the law,” the lawmakers wrote in a letter dated Tuesday to the agencies and obtained by CNN. The FTC and DOJ declined to comment; the IRS and TIGTA did not immediately respond to a request for comment.
In a statement, H&R Block said it takes customer privacy “very seriously, and we have taken steps to prevent the sharing of information via pixels.” Wednesday’s report said H&R Block had testified to the use of tracking technology for “at least a couple of years.”
TaxAct and TaxSlayer did not immediately respond to a request for comment. The report said that TaxAct had been using Meta’s tools since 2018 and Google’s since about 2014, while TaxSlayer began using Meta’s tools in 2018 and Google’s in 2011. The investigation found that all three preparation companies Tax authorities had discontinued their use of the Meta pixel after The Markup’s report last November.
Intuit, the maker of TurboTax, received an initial investigative letter from lawmakers in December, but it wasn’t a focus of Wednesday’s report because the company didn’t use tracking pixels to the same extent, according to the investigation.
Tax preparation companies have faced increased scrutiny in recent years amid reports that many have turned to the data collection as a business model and that the largest of them have spent millions on press against legislation that could make it easier for Americans to file their tax returns. According to a IRS report As of this year, 72% of Americans would be interested in using a free electronic tax filing service if it were offered by the agency as an alternative to private online filing services. The IRS plans to launch a pilot version of that service to a limited number of taxpayers in the 2024 tax filing season.
Google told CNN that it prohibits business customers from uploading sensitive data to its platform that can be traced back to a person. “We have strict policies and technical features that prohibit Google Analytics customers from collecting data that could be used to identify an individual,” a Google spokesperson said. “Site owners – not Google – are in control of the information they collect and must inform their users how it will be used. In addition, Google has strict policies against targeting advertising based on sensitive information.”
Wednesday’s report focuses more on Meta’s use of taxpayer data, Warren’s adviser explained to CNN, because Google did not appear to have used the information for its own business purposes as overtly as Meta and the investigation could not fully determine whether Google could have used the data for other applications.
Still, the allegations could create huge legal risk for both tech companies and tax preparation firms, according to privacy and tax legal experts.
According to Steven Rosenthal, a researcher at the Urban-Brookings Tax Policy Center, tax preparation firms could face multi-million dollar fines under US tax law if the federal government decides to sue them. In addition, the US government could seek criminal sanctions.
“The scope of ‘taxpayer information’ is broad by design,” Rosenthal said, adding that tax preparation companies can be sued for “knowingly” or “recklessly” leaking that information. “Companies shouldn’t share it in a way that a third party could get it.”
In theory, he said, the tax code also allows individual taxpayers the right to bring private lawsuits against tax preparation companies. But most, if not all, of those companies require clients to submit to mandatory arbitration, which could actually make it more difficult to file a private lawsuit, Warren’s counsel said.
Aside from the tax code, both tech giants and tax preparation companies could also face liability from the FTC – which can police data breaches and hold companies to account for their commitments to user privacy. and potentially from state governments that have their own privacy laws on the books, Vladeck said.
Depending on the strength of the allegations, tax preparation firms could quickly be forced to reach a binding agreement, said a former FTC official who requested anonymity to speak more freely.
“If the facts are really solid, these companies would probably rather settle than go to court. This is very embarrassing. It could be a death blow for tax preparation companies,” the former official said.
