Congressional scrutiny of taxpayers’ data privacy has spawned the latest debate over the use of online trackers created by tech companies like
Hundreds of thousands of websites are embedded with what’s known as “pixel” technology, according to a recent privacy industry report. Those bits of computer code allow companies to track users’ interactions with their websites, which in turn inform targeted advertising efforts.
But over the last year, these online trackers have sparked hundreds of lawsuits accusing businesses—particularly in health care and retail—of violating consumers’ privacy by collecting sensitive data via the pixels. They’ve also spurred enforcement action from the Federal Trade Commission.
Now, Sen.
“It’s a clarion call, in a sense, to really look at the protection of taxpayer information in the digital universe that we live in today,” said former National Taxpayer Advocate Nina Olson. “It’s also a clear indication that we don’t have strong enough overall privacy laws and regulations.”
The US lacks a nationwide, comprehensive data privacy law, and consumer protections are generally governed by a small, but growing, patchwork of state measures.
Olson served as the voice of the taxpayer at the Internal Revenue Service for 18 years, and she has been vocal about the agency’s need for better oversight of pixels collecting taxpayer data as the founder and executive director of the Center for Taxpayer Rights.
She said a report published by Democratic lawmakers this week should push the Treasury Department’s inspector general for tax administration to look into the issue, if it isn’t already under investigation.
In addition to the IRS, the report called on the Justice Department, the FTC, and others to probe the “potentially illegal misuse of taxpayer data.”
Criminal penalties for disclosing taxpayer information without consent can reach “up to $1,000 per instance and up to a year in prison,” it said, spelling huge potential financial consequences for the companies mentioned in the congressional report.
The agencies declined or didn’t respond to multiple requests for comment.
Privacy Litigation
In emailed statements to Bloomberg Law, H&R Block said it has “taken steps to prevent the sharing to information via pixels,” and TaxAct said it disabled the “standard analytics tools” while evaluating the potential privacy concerns. TaxSlayer didn’t respond to inquiries.
Of the three, TaxAct is the only one that has been sued over alleged pixel data privacy violations, according to a Bloomberg Law analysis of federal and state dockets.
The report’s release is likely to increase the volume of tax-privacy litigation filed against the companies it named, said Andrew Leahey, a tax and technology attorney at Hunter Creek Consulting.
“The legal industry is going to smell blood in the water here,” ” said Leahey, who is also a columnist for Bloomberg Tax, “and for any large fine or payout, there are going to be groups coming out of the woodwork saying that they should be compensated because it was their information that was leaked.”
In the TaxAct case, evidence shows that information the pixels captured included names, addresses, adjusted gross income figures, refund amounts, and filing statuses, according to Julian Hammond of Hammond Law P.C., one of the attorneys representing the plaintiffs.
“It’s pretty detailed,” he said.
Similar consumer privacy lawsuits have accused health-care providers of improperly disclosing medical information and retail businesses of violating their user’s right to private video viewing.
Online Tracking
The concept of a tracking pixel and its data-capturing abilities are too complex for the everyday consumer to understand, said Christina Tusan, another Hammond Law partner on the TaxAct case.
The firm is also suing four health-care entities, including BetterHelp and Cerebral, over pixel health-information privacy claims.
In comments shared with Bloomberg Law, Google and Meta stated that their policies prohibit the collection of identifying and sensitive data, respectively. Meta said it educates its business partners on configuring its tracking tools to avoid such collection, and Google said websites using its tech are in control of what information is collected.
Ian Cohen, the CEO of data privacy and compliance software provider LOKKER, said controlling the flow of information can be more nuanced, because some trackers are embedded in a browser instead of a website.
“Lots of what happens between the website and the end user is invisible to the company, and that’s exactly what’s going on in this report,” Cohen said, referring to the lawmakers’ findings.
Google and Meta are the two biggest players responsible for online trackers, according to a 2022 LOKKER report finding that nearly 88% of online trackers could be traced back to them.
The tech companies have also been sued directly. Meta, for example, is defending a consolidated class action filed by taxpayers seeking to hold the company responsible for receiving their financial data rather than H&R Block, TaxAct, or Tax Slayer.
Google is defending claims that it violated a user’s health privacy rights, but it hasn’t been sued over its use of trackers in the tax world yet, according to Bloomberg Law’s docket analysis.
Tusan and Hammond said the congressional report was consistent with allegations in their clients’ complaint, but declined to comment further on whether the report would affect their case.
Agency Enforcement
The FTC settled lawsuits earlier this year with mental healthcare provider BetterHelp and prescription drug provider GoodRx over their use of tracking pixels.
Prior to that, the US Health and Human Services Department’s Office for Civil Rights released a warning that use of the technology might violate health privacy protections under the federal Health Insurance Portability and Accountability Act.
The bulletin sent health-care providers with an online presence scrambling to ensure they were meeting their HIPAA compliance obligations, health privacy professionals have said.
The July 12 congressional report should serve as a similar warning for the tax industry to check or tighten up their compliance obligations, Leahey said. The actions it detailed were clear violations of the IRS’ regulation prohibiting the sale of tax return information, known as Treasury Regulation 301-7216, he said, but noted that taxpayer privacy in the digital age could be better protected if the regulation were amended.
“Not only should there be an explicit list of what types of information you need to have consent to disclose, there should be no collection of additional information beyond what was provided by the taxpayer to the return preparer,” Leahey said.
Existing laws don’t prohibit connecting data about an individual taxpayer to other points of identifying data like IP addresses that, used in aggregate, “defeats this anonymizing idea,” he said.
Olson, the former taxpayer advocate, helped develop the tax-return sale rule during her tenure at the IRS and said she hopes to see increased efforts to enforce violations of it.
The disclosures alleged by the congressional report were a result of “paying attention to that regulation” in an online setting, Olson said.
“If your information that you’re giving to a third-party preparer is not being protected, and it’s being shared in a way that you don’t understand how it’s being shared, then that will definitely erode trust in our tax system, and even impede people from filing,” she said.
To contact the reporter on this story:
To contact the editors responsible for this story:
Learn more about Bloomberg Tax or Log In to keep reading:
See Breaking News in Context
From research to software to news, find what you need to stay ahead.
Already a subscriber?
Log in to keep reading or access research tools and resources.