CNN— A seven-month congressional investigation found that some of the biggest tax preparation firms in the country may have shared Americans’ private financial information with Google and Meta for years in a possible violation of federal law. The information, in some cases, was used for targeted advertising.

The research exposes a “five-alarm fire” for taxpayer privacy, according to legal experts who spoke to CNN, that could result in public and private lawsuits, criminal penalties, or even a “mortal blow” for several major industry players engaged in the investigation, including TaxSlayer, H&R Block, and TaxAct.

According to the congressional study CNN saw, the three tax-preparation organizations reportedly transmitted tens of millions of Americans’ personal information to the tech industry without their knowledge or required disclosures using visitor tracking equipment integrated on their websites.

The report states that in addition to standard personal information like names, phone numbers, and email addresses, the list of data shared also included taxpayer data. This included information about people’s filing status, adjusted gross income, the size of their tax refunds, and even information about the buttons and text fields they clicked on while completing their tax forms, which could reveal what tax breaks they may have claimed or which government programs they use.

The research also discovered that every taxpayer who used TaxAct’s IRS Free File service when the tracking was enabled would have had their information shared with the tech companies. The analysis was based on congressional interviews and written testimony from Meta, Google, and the tax preparation firms. According to the research, several tax preparation businesses are still unsure of the status of the data they supplied with tech platforms.

“On a scale from one to 10, this is a 15,” declared David Vladeck, a law professor at Georgetown University and a former consumer protection chief at the Federal Trade Commission, the nation’s top privacy watchdog. Other than using children as slave labor, this is the greatest privacy infringement I’ve ever witnessed. If what we’ve learned so far about this incident is accurate, it’s a five-alarm fire.

It also serves as an illustration, according to Vladeck, of the necessity for federal law giving each and every American a fundamental right to data privacy. Despite the fact that electronic data is becoming an increasingly significant component of the global economy, this subject has been stalled in Congress for years.

What was monitored

The legislative findings are the most recent allegations of malfeasance to affect the troubled tax preparation sector since a story by the investigative journalism outlet The Markup last year brought attention to the tracking technique.

An aide to Democratic Sen. Elizabeth Warren, who helped lead the congressional investigation, said Wednesday’s bombshell report adds to those earlier revelations by identifying a previously unreported category of data that was allegedly being collected and shared: the webpage titles in online tax software that can reveal what tax forms users have accessed. The aide explained that, for instance, taxpayers who input data about their rental income or college savings contributions may have done so on webpages with titles reflecting that information, which would subsequently have been shared with the internet companies.

According to the article, during the investigation, Meta admitted to using taxpayer data to target third-party adverts at platform users and develop artificial intelligence algorithms. company was unclear, the Warren official told CNN, whether Meta was aware that the company was using taxpayer data improperly at the time. The company advises its partners not to share sensitive information using its tools, according to a spokesman for Meta, and its systems are “designed to filter out potentially sensitive data it is able to detect.”

The data collection method, referred to as a tracking pixel, is widely utilized on the internet. Tracking pixels, a little piece of code that website owners can add to their sites, collect data that can assist businesses, such as but not limited to Meta and Google, in understanding the behavior or interests of website users.

Because of the tracking technologies employed by TaxAct, TaxSlayer, and H&R Block, “every single taxpayer who used their websites to file their taxes could have had at least some of their data shared,” the research claimed.

Sharing protected data carelessly

According to the article, the tax preparation firms at the focus of the probe informed lawmakers that the acquired data had been scrambled to assist in preserving privacy. The study highlighted prior FTC studies that found that even “anonymized” data may be easily reverse-engineered to identify a person, but it also claimed that some tax-prep services themselves were not entirely aware of how much information was being given to the digital platforms.

According to the report by Warren and her Democratic colleagues Sens. Ron Wyden, Richard Blumenthal, Tammy Duckworth, and Sheldon Whitehouse; independent Sen. Bernie Sanders; and Democratic Rep. Katie Porter, the use of the pixels in a taxpayer context led to the “reckless” sharing of legally protected data that could endanger taxpayers.

The lawmakers urged the FTC, Internal Revenue Service, Justice Department, and Treasury Inspector General for Tax Administration “should fully investigate this matter and prosecute any company or individuals who violated the law,” in a letter to the organizations dated Tuesday and obtained by CNN. The IRS and TIGTA did not immediately respond to a request for comment; the FTC and DOJ declined to comment.

H&R Block said in a statement that it takes customer privacy “very seriously” and that it has taken precautions to stop information exchange through pixels. According to the report published on Wednesday, H&R Block said that they have been employing the tracking technology for “at least a couple of years.”

A request for comment was not immediately answered by TaxAct or TaxSlayer. According to the research, TaxSlayer started using Meta’s tools in 2018 and Google’s in 2011, although TaxAct has been using both since around 2014. The inquiry discovered that following The Markup’s publication in November of last year, all three tax preparation businesses stopped using Meta’s pixel.

The study discovered that Intuit, the business behind TurboTax, did not utilize tracking pixels to the same extent as other companies and was not the subject of the MPs’ initial inquiry letter from December.

increased vigilance

Reports that many tax preparation companies have adopted data collecting as a business model and that the largest of them have spent millions lobbying against legislation that could make it simpler for Americans to pay their taxes have led to increased scrutiny of the industry in recent years. According to an IRS report released this year, 72% of Americans would be interested in using a free, online tax filing service if it were offered by the government body instead of a for-profit company. In the 2024 tax filing season, the IRS intends to introduce a prototype version of that service to a select group of taxpayers.

According to Google, it forbids corporate clients from uploading private information that might be linked to an individual to its platform.

An official Google spokesperson stated, “We have strict policies and technical features that prohibit Google Analytics customers from collecting data that could be used to identify an individual.” “Site owners, not Google, are in charge of what data they gather and are required to disclose to their customers how it will be used. Furthermore, Google strictly forbids targeting people with ads based on sensitive information.

Legal danger

The Warren aide told CNN that because Google did not appear to have used the information for its own commercial purposes as overtly as Meta did and the investigation was unable to fully determine whether Google may have used the data for other applications, Wednesday’s report focuses more heavily on Meta’s use of taxpayer data.

However, according to tax and privacy legal experts, the charges might expose both the tech companies and the tax preparation organizations to significant legal risk.

If the federal government chose to suit, the tax preparation corporations might be subject to billions in fines under US tax law, according to Steven Rosenthal, a senior fellow at the Urban-Brookings Tax Policy Center. The US government may also pursue criminal sanctions.

According to Rosenthal, “the scope of ‘taxpayer information’ is broad by design,” and tax preparation businesses can be held liable for “knowingly” or “recklessly” disclosing that information. “The businesses shouldn’t share it in a way that a third party could get their hands on it.”

The tax code theoretically also gives individual taxpayers the option to bring private lawsuits against the tax preparation firms, he claimed. However, the majority of those companies, if not all of them, compel clients to participate in mandatory arbitration, which could theoretically make filing a private claim more difficult, according to the Warren aide.

Beyond the tax code, the FTC, which can investigate data breaches and hold businesses accountable for their commitments to user privacy, as well as potential state governments with their own privacy laws could all bring civil lawsuits against the tech giants and the tax-preparation companies, according to Vladeck.

According to a former FTC official who asked to remain anonymous in order to talk more freely, the tax-preparation companies may be quickly forced into a legally enforceable settlement depending on the gravity of the claims.

“These firms would undoubtedly prefer to settle than go to court if the facts were extremely compelling. The former official stated, “This is quite embarrassing. It might be a fatal blow to tax preparation firms.