Several prominent online tax filing websites have reportedly been sending Amercians’ private financial information to Facebook, even in cases where users did not have an account on the platform, according to a jointly published report by The Verge and nonprofit the Markup.
The companies, which included H&R Block, TaxAct and TaxSlayer, utilized a code snippet called the “Meta Pixel,” a tool used by Facebook and parent-company Meta to gather data on users and improve their advertising algorithms, according to the Markup. Information included income, filing status, value of dependents’ college scholarships, health savings account information and a variety of personally identifiable information.
“At H&R Block, we take protecting our clients’ privacy very seriously, and we are taking steps to mitigate the sharing of client information via pixels,” the company told the Daily Caller News Foundation in a statement. The company’s website was still sending health savings account information and information on dependents’ college tuition grants via pixels as of Nov. 21, according to the Markup.
H&R Block did not immediately respond to a question asking it to confirm the Markup’s reporting, or a question about the extent to which users are notified of this data being gathered.
TaxSlayer and TaxAct gave data to Meta in what’s known as a “hash,” a data mapping technique that Meta claims protects users’ privacy, but Meta can still link this data to users’ Facebook and Instagram profiles, according to the Markup. TaxAct sent the names of filers’ dependents in this form while TaxSlayer sent phone numbers and the names of both filers and their dependents.
In both cases, the collection of this type of data is not turned on by default, and requires a user to manually enable it, according to Markup. In a similar manner, TaxAct sent financial information, such as adjusted gross income, using a “custom event,” a parameter that can only gather such information if it is configured by the website operator, or an application added to the website by its operator, in a way that would alter its default behavior.
Meta says it doesn’t want sensitive financial information, like income, sent to it. But that’s exactly what two tax sites sent.
When we took our findings to Facebook, the company said that its system “is designed to filter out potentially sensitive data it is able to detect.” pic.twitter.com/CT5X28CpIn
— The Markup (@themarkup) November 22, 2022
“Advertisers should not send sensitive information about people through our Business Tools,” Meta said in a statement to the Daily Caller News Foundation. “Doing so is against our policies and we educate advertisers on properly setting up Business tools to prevent this from occurring. Our system is designed to filter out potentially sensitive data it is able to detect.”
The DCNF asked Meta about how the filter works and how the company might account for mistakes made by the filter, but did not receive an immediate reply.
The U.S. tax system is heavily privatized, in contrast with many European countries where the government typically calculates taxes and sends them to citizens to be verified, according to Business Insider. In 2019, more than half of individual taxpayers filed their taxes electronically through a paid tax preparer, according to the Government Accountability Office.
“Private industry, with established expertise and experience in electronic tax preparation, has a proven track record in providing the best technology and services available,” the IRS said on their website describing the Free File Alliance, a network of private sector tax preparation companies that offer their services for free through the IRS website.
The tax preparation industry now makes more than $11 billion per year in the U.S., according to the Markup.
“It’s frustrating because taxpayers have been pushed into the arms of these private, for-profit companies simply to comply with their tax filing obligations,” Mandi Matlock, a Harvard Law School tax lecturer told the Markup. “We have no choice, really, in the matter.”
TaxAct, the IRS and TaxSlayer did not immediately respond to a Daily Caller News Foundation request for comment.