'Shocking breach': Investigation shows H&R Block shared personal data with tech giants

After a seven-month investigation, a group of congressional Democrats and Independent Sen. Bernie Sanders released a bombshell report Wednesday showing that private tax prep firms have been secretly sharing U.S. taxpayers' sensitive personal information with tech giants for years, a practice that the lawmakers condemned as outrageous and possibly illegal.

The report, spearheaded by Sen. Elizabeth Warren (D-Mass.) in the Senate and Rep. Katie Porter (D-Calif.) in the House, notes that TaxAct, H&R Block, and TaxSlayer "used computer code—known as pixels—to send data to Meta and Google." The lawmakers' investigation was sparked by recent reporting in The Markup.

"While most websites use pixels, it is particularly reckless for online tax preparation websites to use them on webpages where tax return information is entered unless further steps are taken to ensure that the pixels do not access sensitive information," the lawmakers' 54-page report states. "Yet, the tax prep companies described this as a 'ubiquitous' and 'common industry practice.'"

The three tax prep giants, which have lobbied fervently against efforts to establish a free IRS tax filing program, each admitted to sharing taxpayer data through the use of the Meta Pixel and Google tools.

"The Meta Pixel and other Meta tools used by TaxAct collected far more information than was previously reported," the report reads. "In addition to taxpayers' filing status, approximate [adjusted gross income], approximate refund amount, and names of dependents, the Pixel collected approximate federal tax owed and buttons that were clicked and names of text-entry forms that the taxpayer navigated to."

"H&R Block and TaxSlayer also revealed an extensive list of data shared via the Meta Pixel, including transmitting information on whether taxpayers had visited pages for many revealing tax situations," the report adds. "Although the tax prep companies and Big Tech firms claimed that all shared data was anonymous, the FTC and experts have indicated that the data could easily be used to identify individuals, or to create a dossier on them that could be used for targeted advertising or other purposes."

Facebook's privacy policy states that it "may retain" data gathered with the Meta Pixel for up to two years.

"The findings of this report reveal a shocking breach of taxpayer privacy by tax prep companies and by Big Tech firms that appeared to violate taxpayers' rights and may have violated taxpayer privacy law."

David Vladeck, a law professor at Georgetown University and a former consumer protection chief at the Federal Trade Commission (FTC), toldCNN on Wednesday that the revelations in the Senate report are "a five-alarm fire" for taxpayer privacy.

"On a scale from one to 10, this is a 15," said Vladeck. "This is as great as any privacy breach that I've seen other than exploiting kids."

The lawmakers alerted key federal agencies to their findings in a letter on Wednesday and demanded prosecution for "any company or individuals who violated the law."

"The findings of this report reveal a shocking breach of taxpayer privacy by tax prep companies and by Big Tech firms that appeared to violate taxpayers' rights and may have violated taxpayer privacy law," the lawmakers wrote. "The Internal Revenue Service, the Treasury Inspector General for Tax Administration, the Federal Trade Commission, and the Department of Justice should fully investigate this matter."

"We also welcome the recent IRS announcement of a free, direct file pilot next year, which will give taxpayers the option to file taxes without sharing their data with untrustworthy and incompetent tax preparation firms," they added.