Congress released a highly anticipated report on Wednesday detailing how major tax prep companies and big tech firms like Google and Meta, parent of Facebook and Instagram, “recklessly” shared the sensitive tax data of tens of millions of Americans without proper safeguards. The senators cited evidence from their report in a fiery letter to the IRS, FTC, DOJ, and Treasury Inspector General, whom they urged to fully investigate the matter and to prosecute companies found to have violated tax laws.
“The findings of this report reveal a shocking breach of taxpayer privacy by tax prep companies and by Big Tech firms that appeared to violate taxpayers’ rights and may have violated taxpayer privacy law,” Sens. Bernie Sanders, Elizabeth Warren, Richard Richard Blumenthal, Ron Wyden, Tammy Duckworth, Sheldon Whitehouse, and Rep. Katie Porter said in the letter.
The new 54-page report builds off of a November investigation by The Verge and The Markup which detailed the ways H&R Block, TaxAct, and TaxSlayer used a service called Meta Pixel to share taxpayer data with Facebook and Instagram. That data was then used to serve targeted ads and feed Meta’s algorithms. TaxAct also reportedly sent similar data to Google through its analytics tool, though names were not included.
The new report says the companies used pixels, a form of tracking technology, to scan tax documents and reveal a wide range of identifying information including taxpayers’ full names, filing status, federal taxes owed, names of dependents, addresses, and date of birth, among other data points. The lawmakers claim the company’s data sharing occurred for years without proper disclosure of appropriate taxpayer consent. All of that amounted to the companies vacuuming up data on potentially tens of millions of filers. The collection of dependents’ names means tax filers’ children were likely included in the vast data collection.
Once shared with Meta and Google, taxpayer data was then used to grease Big Tech’s online business behemoth, the report notes. The lawmakers said Meta confirmed it used the data collected for targeted advertising and to train its own AI algorithms.
TaxAct, and TaxSlayer did not immediately respond to requests for comment. H&R Block told Gizmodo it takes protecting its client’s privacy “very seriously” and has “taken steps to prevent the sharing of information via pixels.”
Tax prep companies shared pixels for years
Many websites you probably interact with on a daily basis likely use pixels, but the lawmakers said tax prep companies should have taken far greater care to ensure they didn’t use the trackers to access highly sensitive tax information. All three of the tax prep companies named in the report admitted to using Meta Pixel for “at least a couple of years.” They reportedly used Google Analytics even longer. The prep companies and tech companies all said the data shared was anonymous, but lawmakers say experts at the FTC and elsewhere claim that data could be easily used to identify people when in the wrong hands.
In a statement, a Meta spokesperson told Gizmodo it has policies prohibiting advertisers from sending sensitive information about people through its business tools.
“Doing so is against our policies and we educate advertisers on properly setting up Business tools to prevent this from occurring,” the spokesperson said. “Our system is designed to filter out potentially sensitive data it is able to detect.”
Google did not immediately respond to our requests for comment but a company spokesperson previously told Gizmodo its analytics tools aren’t tied back to specific individuals and that its policies prohibit customers from sending it data that could personally identify an individual.
“Big Tax Prep has recklessly shared tens of millions of taxpayers’ sensitive personal and financial data with Meta for years, without appropriately disclosing this data usage or protecting the data, and without appropriate taxpayer consent,” the lawmakers wrote in their report.
The lawmakers claimed filters Meta and Google reportedly used to identify data unintentionally collected were “ineffective.”
The lawmakers believe the tax prep companies may have violated multiple US taxpayer privacy laws by sharing sensitive information without first obtaining written consent. The FTC and IRS did not immediately respond to Gizmodo’s requests for comment.