Tax preparing companies shared personal data from customers with Facebook parent company Meta and Google, lawmakers said in a report released Wednesday.
TaxAct, H&R Block and Tax Slayer used computer code, known as pixels, that sent the data to Meta and Google, according to the 54-page report released by Sens. Elizabeth Warren (D-Mass.), Ron Wyden (D-Ore.), Richard Blumenthal (D-Conn.), Tammy Duckworth (D-Ill.), Bernie Sanders (I-Vt.) and Sheldon Whitehouse (D-R.I.).
The lawmakers’ investigation followed a report The Verge published in November that alleged the tax filing websites had been sending users’ financial information to Facebook.
The lawmakers’ investigation found that TaxAct collected “far more information than was previously reported.” In addition to taxpayers’ filing status, their approximate refund amount, names of dependents and approximate federal tax owed were collected through the Meta Pixel tool. The Pixel also shared full names, email, phone numbers and addresses, according to the report.
H&R Block and TaxSlayer also revealed an “extensive list of data shared” through the Meta Pixel, including information about having dependents, certain types of income, and certain tax credits or deductions, according to the report.
The lawmakers sent a letter to the Internal Revenue Service (IRS), Treasury Inspector General for Tax Administration, Federal Trade Commission (FTC) and attorney general asking for a full investigation into the matter and urging them to “prosecute any company or individuals who violated the law.”
The lawmakers called the tax prep companies and tech firms “reckless” about their data sharing practices. The tax prep companies “indicated that they installed the Meta and Google tools on their websites without fully understanding the extent to which they would send taxpayer data to these tech firms,” the report stated.
Meanwhile, the lawmakers’ report slammed the tech firms for appearing to “act with stunning disregard for taxpayer privacy” by “failing to provide full and complete information about how they would collect taxpayer data, and what they did — or are doing — with it once it was collected.”
A Meta spokesperson said the company has been “clear in our policies that advertisers should not send sensitive information about people through our Business Tools.”
“Doing so is against our policies and we educate advertisers on properly setting up Business tools to prevent this from occurring. Our system is designed to filter out potentially sensitive data it is able to detect,” they added.
TaxSlayer spokesperson Molly Richardson pushed back on the reports’ findings and said it contains “numerous false or misleading statements.” Richardson said the company is requesting a retraction or correction from Warren’s office.
Richardson said TaxSlayer told lawmakers “to the best of our knowledge, neither the Meta Pixel nor Google Analytics Pixel transmitted social security numbers, addresses, filing status, income, adjusted gross income, deductions, refunds owed, taxes owed, health savings information, Form 1040 or other tax forms, or other sensitive information from tax returns.”
Richardson also said that “contrary to the report,” the company “never stated that the Meta Pixel transmitted information about which tax forms on which customers entered information, or that page information provided sensitive data such as taxpayer rental income or alimony.”
In a statement Tax Act said the company has “always complied with laws that protect our customers’ privacy and, as noted in the report, we disabled the tools in question while we evaluated potential concerns.”
In a statement shared with CBS MoneyWatch, H&R Block said it “takes protecting our clients’ privacy very seriously, and we have taken steps to prevent the sharing of information via pixels.”