CNN reports:

Some of America’s largest tax-prep companies have spent years sharing Americans’ sensitive financial data with tech titans including Meta and Google in a potential violation of federal law — data that in some cases was misused for targeted advertising, according to a seven-month congressional investigation.

The report highlights what legal experts described to CNN as a “five-alarm fire” for taxpayer privacy that could lead to government and private lawsuits, criminal penalties or perhaps even a “mortal blow” for some industry giants involved in the probe including TaxSlayer, H&R Block and TaxAct.

Using visitor tracking technology embedded on their websites, the three tax-prep companies allegedly sent tens of millions of Americans’ personal information to the tech industry without consent or appropriate disclosures, according to the congressional report reviewed by CNN.

Beyond ordinary personal data such as people’s names, phone numbers and email addresses, the list of information shared also included taxpayer data — details about people’s filing status, adjusted gross income, the size of their tax refunds and even information about the buttons and text fields they clicked on while filling out their tax forms, which could reveal what tax breaks they may have claimed or which government programs they use, according to the report.

The report, which drew on congressional interviews and written testimony from Meta, Google and the tax-prep companies, also found that every taxpayer who used TaxAct’s IRS Free File service while the tracking was enabled would have had their information shared with the tech companies. Some of the tax-prep companies still do not know whether the data they shared continues to be held by the tech platforms, the report said.

“On a scale from one to 10, this is a 15,” said David Vladeck, a law professor at Georgetown University and a former consumer protection chief at the Federal Trade Commission, the country’s top privacy watchdog. “This is as great as any privacy breach that I’ve seen other than exploiting kids. This is a five-alarm fire, if what we know about this so far is true.”

It is also an example, Vladeck said, of why the United States needs federal legislation guaranteeing every American a basic right to data privacy — an issue that has languished in Congress for years despite electronic data becoming an ever-larger part of the global economy. [Continue reading…]