In context: It's more or less common knowledge that Facebook is equivalent to a personal data vacuum. It has proven quite capable of collecting enough information on an individual user to create a tempting advertising profile. It doesn't really need help in this regard, but it has some --- and from a most surprising place.
On Tuesday, investigative news outlet The Markup revealed that several "major" tax filing services had shared private taxpayer information with Facebook. Some companies listed include TaxAct, TaxSlayer, and multibillion-dollar tax giants H&R Block and Intuit.
Information shared with Meta includes relatively benign data like names and email addresses. More concerning is the personal financial details involved, including annual income, filing status, and refund amounts. The Markup even saw instances of college scholarship amounts for dependent children and health savings account activity revealed.
The data was conveyed to Facebook via Meta Pixel --- a javascript snippet inserted into a webpage. The script tracks and collects usage on a webpage for targeted Facebook advertising. It works regardless of whether the user in question has any Meta accounts. Most of the 150 million tax returns electronically filed each year are turned in by sites that utilize the Meta Pixel code. TaxSlayer alone claims to have processed over 10 million returns last year.
Data sent by Pixel is somewhat generalized or obfuscated. For example, an examination of a sample sent through TaxAct's site showed that the adjusted gross income field and refund amount were rounded up to the nearest $1,000 and $100, respectively. Additionally, the code obfuscated the names of dependents to comply with the Children's Online Privacy Protection Act. However, analysts noted that the obfuscation was easy to reverse.
Information between tax services seems to vary. The Markup looked at H&R Block's Pixel data and found that in addition to the general personal information, it sent off "health savings account usage and dependents' college tuition grants and expenses." TaxSlayer shared phone numbers, filer names, and names of dependents.
The most data-hungry preparer was Ramsey Solutions. It uses a version of TaxSlayer's platform that shares what is essentially the taxpayer's summary sheet.
Unsurprisingly, when The Markup contacted services regarding this data sharing, they mostly responded with a typical "not-our-fault" boilerplate.
"We take the privacy of our customers' data very seriously. TaxAct, at all times, endeavors to comply with all IRS regulations," replied a spokesperson for TaxAct, despite IRS regulations not being involved in the inquiry.
A spokesperson for H&R Block similarly responded, saying, "[We] regularly evaluate our practices as part of our ongoing commitment to privacy, and will review the information." At least, it acknowledged it would look into the matter.
Ramsey Solutions simply claimed ignorance while nobly gesturing that it took action.
"[We] implemented the Meta Pixel to deliver a more personalized customer experience," spokesperson Megan McConnell said. "We did NOT know and were never notified that personal tax information was being collected by Facebook from the Pixel. As soon as we found out, we immediately informed TaxSlayer to deactivate the Pixel from Ramsey SmartTax."
Additional providers, including Intuit, TaxSlayer, and others, responded with similar "we-won't-do-it-again" statements. They promised to look into the matter while insisting they had no idea such data harvesting was occurring on their websites and in their online tax preparation software.
It comes as no surprise that Meta collects as much information as possible on you when using its Facebook or Instagram websites --- in fact, it should be expected. However, when filing taxes online, customers should not have to fear the preparations service is handing over any of your information to the mega-corporation.
Image credit: Ken Teegardin