Tax filing websites caught sending users’ financial data to Facebook

(Photo: Olga Delrance/Unsplash)Filing your taxes is already stressful enough without worrying that your data will end up in the wrong hands. Thanks to the new-found data sharing practices of several tax websites, this concern may become prevalent in the 2023 tax filing season. H&R Block, TaxAct, and TaxSlayer have been found to be sending users’ financial information to someone other than Facebook.

According to the nonprofit technology investigation newsletter The Markup, the three websites—which together help more than 25 million Americans file their taxes annually—use meta JavaScript code (called “meta pixels”) to capture user data and send it Facebook’s way. H&R Block, one of the nation’s most recognized tax filing firms, was found to be using MetaPixel to obtain users’ health savings account usage data as well as dependents’ college expense information. TaxAct users were captured using codes to track filing status, dependents, adjusted gross income, and refund totals. TaxAct seems to have lazily attempted to anonymize this data by returning dependent names and rounding income and to the nearest thousand and hundred respectively; However, the markup ex-ambiguity is easily reversed.

TaxSlayer appears to use meta pixels to capture the most detailed user information. Using a “meta pixel inspector” it developed earlier this year, Markup found that TaxSlayer habitually collects users’ names, phone numbers and dependent names. A specific form of TaxSlayer included on the websites of personal finance celebrity Dave Ramsey obtained users’ income and return totals. When Markup asked Ramsey Solutions about its use of the meta pixel, the company said it was unaware of the data-harvesting element of the code and allegedly removed it from its sites. The TaxAct similarly stopped capturing users’ financial information but continued to record the names of dependents.

But why? What incentive does Facebook have to seize Americans’ tax information? As it almost always does, the answer comes down to money. Meta, Facebook’s parent company, regularly uses its nearly 2 million meta pixels to capture web users’ browsing activity, demographic data and more. This information is then used to ensure that Facebook and Instagram users see ads that they can actually click on, thus supporting Meta’s profitable marketing operations.

After the IRS became aware of tax websites’ use of meta pixels, Facebook’s collection of tax data could become financially useless. Websites that share users’ tax information without consent can face stiff penalties, and as of Tuesday, H&R Block, TaxAct, and TaxSlayer lacked the disclosures required to claim compliance.

Read now: