Congress released a highly anticipated report on Wednesday detailing how major tax prep companies and big tech firms like Google and Meta, parent of Facebook and Instagram, “recklessly” shared the sensitive tax data of tens of millions of Americans without proper safeguards. The senators cited evidence from their report in a fiery letter to the IRS, FTC, DOJ, and Treasury Inspector General, whom they urged to fully investigate the matter and to prosecute companies found to have violated tax laws.
“The findings of this report reveal a shocking breach of taxpayer privacy by tax prep companies and by Big Tech firms that appeared to violate taxpayers’ rights and may have violated taxpayer privacy law,” Sens. Bernie Sanders, Elizabeth Warren, Richard Richard Blumenthal, Ron Wyden, Tammy Duckworth, Sheldon Whitehouse, and Rep. Katie Porter said in the letter.
The new 54-page report builds off of a November investigation by The Verge and The Markup which detailed the ways H&R Block, TaxAct, and TaxSlayer used a service called Meta Pixel to share taxpayer data with Facebook and Instagram. That data was then used to serve targeted ads and feed Meta’s algorithms. TaxAct also reportedly sent similar data to Google through its analytics tool, though names were not included.
The new report says the companies used pixels, a form of tracking technology, to scan tax documents and reveal a wide range of identifying information including taxpayers’ full names, filing status, federal taxes owed, names of dependents, addresses, and date of birth, among other data points. The lawmakers claim the company’s data sharing occurred for years without proper disclosure of appropriate taxpayer consent. All of that amounted to the companies vacuuming up data on potentially tens of millions of filers. The collection of dependents’ names means tax filers’ children were likely included in the vast data collection.
Once shared with Meta and Google, taxpayer data was then used to grease Big Tech’s online business behemoth, the report notes. The lawmakers said Meta confirmed it used the data collected for targeted advertising and to train its own AI algorithms.
TaxSlayer did not immediately respond to requests for comment. H&R Block told Gizmodo it takes protecting its client’s privacy “very seriously” and has “taken steps to prevent the sharing of information via pixels.” A spokesperson for TaxAct said the company has been in contact with Sen. Warren and has “always complied with laws that protect our customers’ privacy.”
“As noted in the report, we disabled the tools in question while we evaluated potential concerns,” the TaxAct spokesperson added .
Tax prep companies shared pixels for years
Many websites you probably interact with on a daily basis likely use pixels, but the lawmakers said tax prep companies should have taken far greater care to ensure they didn’t use the trackers to access highly sensitive tax information. All three of the tax prep companies named in the report admitted to using Meta Pixel for “at least a couple of years.” They reportedly used Google Analytics even longer. The prep companies and tech companies all said the data shared was anonymous, but lawmakers say experts at the FTC and elsewhere claim that data could be easily used to identify people when in the wrong hands.
In a statement, a Meta spokesperson told Gizmodo it has policies prohibiting advertisers from sending sensitive information about people through its business tools.
“Doing so is against our policies and we educate advertisers on properly setting up Business tools to prevent this from occurring,” the spokesperson said. “Our system is designed to filter out potentially sensitive data it is able to detect.”
Google, meanwhile, told us it has “strict policies and technical features” that prohibit Google Analytics users from collecting data that could be used to personally identify someone.
“Site owners—not Google—are in control of what information they collect and must inform their users of how it will be used,” a Google spokesperson said. “Additionally, Google has strict policies against advertising to people based on sensitive information.”
“Big Tax Prep has recklessly shared tens of millions of taxpayers’ sensitive personal and financial data with Meta for years, without appropriately disclosing this data usage or protecting the data, and without appropriate taxpayer consent,” the lawmakers wrote in their report.
The lawmakers claimed filters Meta and Google reportedly used to identify data unintentionally collected were “ineffective.”
The lawmakers believe the tax prep companies may have violated multiple US taxpayer privacy laws by sharing sensitive information without first obtaining written consent. The FTC and IRS did not immediately respond to Gizmodo’s requests for comment.
Update, 12:58 p.m. EST: Added statement from Google.
Update 5:15 p.m. EST: Added statement from TaxAct.