Facebook may have collected some of your IRS filing data if you used an online tax services

Cal Jeffrey

Posts: 3,656   +1,122
Staff member
In context: It's more or less common knowledge that Facebook is equivalent to a personal data vacuum. It has proven quite capable of collecting enough information on an individual user to create a tempting advertising profile. It doesn't really need help in this regard, but it has some — and from a most surprising place.

On Tuesday, investigative news outlet The Markup revealed that several "major" tax filing services had shared private taxpayer information with Facebook. Some companies listed include TaxAct, TaxSlayer, and multibillion-dollar tax giants H&R Block and Intuit.

Information shared with Meta includes relatively benign data like names and email addresses. More concerning is the personal financial details involved, including annual income, filing status, and refund amounts. The Markup even saw instances of college scholarship amounts for dependent children and health savings account activity revealed.

The data was conveyed to Facebook via Meta Pixel — a javascript snippet inserted into a webpage. The script tracks and collects usage on a webpage for targeted Facebook advertising. It works regardless of whether the user in question has any Meta accounts. Most of the 150 million tax returns electronically filed each year are turned in by sites that utilize the Meta Pixel code. TaxSlayer alone claims to have processed over 10 million returns last year.

Data sent by Pixel is somewhat generalized or obfuscated. For example, an examination of a sample sent through TaxAct's site showed that the adjusted gross income field and refund amount were rounded up to the nearest $1,000 and $100, respectively. Additionally, the code obfuscated the names of dependents to comply with the Children's Online Privacy Protection Act. However, analysts noted that the obfuscation was easy to reverse.

Information between tax services seems to vary. The Markup looked at H&R Block's Pixel data and found that in addition to the general personal information, it sent off "health savings account usage and dependents' college tuition grants and expenses." TaxSlayer shared phone numbers, filer names, and names of dependents.

The most data-hungry preparer was Ramsey Solutions. It uses a version of TaxSlayer's platform that shares what is essentially the taxpayer's summary sheet.

Unsurprisingly, when The Markup contacted services regarding this data sharing, they mostly responded with a typical "not-our-fault" boilerplate.

"We take the privacy of our customers' data very seriously. TaxAct, at all times, endeavors to comply with all IRS regulations," replied a spokesperson for TaxAct, despite IRS regulations not being involved in the inquiry.

A spokesperson for H&R Block similarly responded, saying, "[We] regularly evaluate our practices as part of our ongoing commitment to privacy, and will review the information." At least, it acknowledged it would look into the matter.

Ramsey Solutions simply claimed ignorance while nobly gesturing that it took action.

"[We] implemented the Meta Pixel to deliver a more personalized customer experience," spokesperson Megan McConnell said. "We did NOT know and were never notified that personal tax information was being collected by Facebook from the Pixel. As soon as we found out, we immediately informed TaxSlayer to deactivate the Pixel from Ramsey SmartTax."

Additional providers, including Intuit, TaxSlayer, and others, responded with similar "we-won't-do-it-again" statements. They promised to look into the matter while insisting they had no idea such data harvesting was occurring on their websites and in their online tax preparation software.

It comes as no surprise that Meta collects as much information as possible on you when using its Facebook or Instagram websites — in fact, it should be expected. However, when filing taxes online, customers should not have to fear the preparations service is handing over any of your information to the mega-corporation.

Image credit: Ken Teegardin

Permalink to story.

 

Vanderlinde

Posts: 179   +113
Its just a stupid integration of that pixel on pages where it should not be.

Front-end of your website? Sure. Backend of where sensitive data is processed? Hell no.

You can blame the cheap people who where supposed to maintain such webpages for that.

 

brucek

Posts: 1,284   +1,906
From H&R Block's privacy policy:

We may disclose your information as permitted by law or with your consent to other H&R Block companies or to third parties with whom we have a written contract limiting the use and disclosure of your information.

The fact they bothered to obfuscate the kid's names suggests they cared enough to find out exactly what the legal line was, and obeyed it and only it.

The contract between H&R Block and Meta probably stipulates the limit that Meta agrees not to share your detailed financial information with the uncontacted peoples of New Guinea, or something else about as useful. The consent was probably obtained nearly passively in a vague manner.

So my guess is they feel they've got themselves covered. I'm kind of hoping they missed something though and some jurisdiction somewhere finds a way to at least run up their legal tab.
 

Uncle Al

Posts: 9,279   +8,442
To obscure with tax information is a 1st Class Federal offense. How is it that the IRS and DOJ are not jumping on this with full prosecution? The corruption within the Federal Government continues to get greater and greater. At this point you have to ask yourself if a Democracy is really worth it? I'm sure it is, but this kind of garbage needs to be the focus of BOTH parties rather than just snipping at each other .....
 

Cal Jeffrey

Posts: 3,656   +1,122
Staff member
"Information shared with Meta includes relatively benign data like names and email addresses. "

BENIGN???
Calm down @psycros. 🤣 Benign in the fact that just about anybody can look up your name and email address if they put an ounce of effort into it. Plus, I said "relatively." Which would you rather--advertisers knowing your name and email or advertisers knowing that and how much you make per year, your kids' names, how much you got back or paid in taxes, and the activity of your health savings account?
 

Cal Jeffrey

Posts: 3,656   +1,122
Staff member
Oh no, that was genuine challenge. Lets see what you find, and we can discuss it in a PM. You've got my email and my name.
No. Let me dox you in public. Just kidding.

I think we are sliding off-topic here, though. The point I'm trying to make is that our names and email addresses are not something most people necessarily keep guarded under lock and key. Generally, folks freely give at least their first name (and often full) when meeting a complete stranger. Likewise, email addresses are a dime a dozen. People hand those out freely every time they register with a website or sign up for discounts and club cards at grocery stores, and the list can go on.

Again, as I stated before this is "relatively speaking." In the terms of the article and what information is being given to Meta by tax services, ranking the information The Markup found would have Name and Email on the bottom of the list.

@psycros -- See what you started? Hope you're happy. 😆
 

ZedRM

Posts: 1,326   +930
No. Let me dox you in public. Just kidding.
:laughing:
I think we are sliding off-topic here, though. The point I'm trying to make is that our names and email addresses are not something most people necessarily keep guarded under lock and key.
I think my point was an extension of the topic. I guard my privacy vigorously. Privacy is a right, not a privilege. If we don't protect our rights we loose them. Our governments are supposed to protect us from the vultures of the world by making and ENFORCING laws which are supposed to prevent things like this. The developments stated here are evidence they're not doing their job properly.
 

psycros

Posts: 4,448   +6,631
Calm down @psycros. 🤣 Benign in the fact that just about anybody can look up your name and email address if they put an ounce of effort into it. Plus, I said "relatively." Which would you rather--advertisers knowing your name and email or advertisers knowing that and how much you make per year, your kids' names, how much you got back or paid in taxes, and the activity of your health savings account?
ORLY? What's my email address? Go ahead...try.