The ravenous data machine never stops looking for ways to feed, but it seems for some time now the beast has been snacking on users’ financial data taken directly from their tax filings. After the machine’s had its fill on users income data, filing status, dependents’ names, refund amount, and more, it’s been depositing its data droppings over at Meta’s side of the dank cave that makes up the shadowy world of data-driven analytics.
A report by The Verge and The Markup details how Meta Pixel has been slyly funneling financial information over to Facebook and its parent company Meta. The companies using Pixel run the gamut, from the utter giant tax filing services at H&R Block to smaller tools like TaxAct and TaxSlayer. Ramsey Solutions, a digital financial advice and software company also uses TaxSlayer and was found to employ Pixel in its services.
At the same time, The Markup noted TaxAct also used Google analytics, which was sending financial data—though reportedly lacking names—over to Google and by extension, its parent company Alphabet.
Intuit, the makers of TurboTax, had been employing Pixel but only on its sign in pages, meaning it was only sending usernames and sign-in times over to Facebook. So they’re not as bad as these other companies, but it’s not like TurboTax has a clean slate considering it worked hard to mask its free filing options from users.
Reporters have the receipts as well, with screenshots showing how user-inputted data on these tax filing services is being recorded and then sent to Meta and Google in real time. Pixel has been used to track all sorts of data on users who are not even using Facebook or other Meta products. Other Markup reports have noted its tracked student aid applications, another source of hard financial data that could be very useful to advertisers and Meta itself. As noted in the report, Meta—then still just Facebook—told Congress they employed more than two million pixels over a massive portion of the web.
The Pixel used on TaxSlayer and TaxAct used features that automatically scans forms looking for personal information, including everything from phone numbers and emails and attributes them to user profiles. TaxAct also collected the names of users’ dependents, so inadvertently users’ children are very much being gobbled up by the monster lurking in the computer.
Some companies claimed they were none the wiser that they were handing over financial data to Meta. Ramsey told The Markup that they “did NOT know” (emphasis theirs) Facebook was collecting their data, and told TaxSlayer they wanted to deactivate Pixel in their own services. TaxSlayer similarly told the reporters they removed Pixel on their services, at least momentarily while they “review” the matter.
Here’s what a Google spokesperson told Gizmodo:
“Google Analytics is a measurement product that helps businesses better understand their web and app performance. Any data in Google Analytics is obfuscated, meaning it is not tied back to an individual and our policies prohibit customers from sending us data that could be used to identify a user. Additionally, Google has strict policies against advertising to people based on sensitive information.”
The company has claimed that companies use Google Analytics voluntarily to give sites and stores an idea about their users. That said, the company has been very lax in giving users the full picture of how their data is being used.
In an email, a Meta spokesperson told Gizmodo that businesses sending that sort of info through business tools is against their policy, adding that the company filters out “potentially sensitive data.” Meta has been a regular player in this space, perhaps the scion and initial arbiter of data harvesting. Even though the tech giant claims user data is being obscured when it’s put into its systems, that really doesn’t mean much at all. There are many existing tools that can build up user profiles based on “anonymized” data, and Meta even has its own means of linking pixel information to Facebook and Instagram users.
Google is similarly situated as a mass data collection agency. The company recently agreed to settle a lawsuit with 40 different state’s attorney generals over sapping users’ location data while not making it clear it was doing so. At the same time, tax filing companies like those described here are the main way millions upon millions of U.S. citizens file their taxes each year, and users’ rely on these (mostly) free services to accurately gauge their tax write offs and refunds.
With all these different companies throwing up their hands while screaming “non mea culpa,” the real question is who knew this was happening, and who was actually profiting from it at that time? Well, according to the report, by Monday TaxAct stopped sending income and refund amounts over to Meta, but has kept on sending out the names of users’ dependents marked on their filings. They have also continued sending out info using Google Analytics.
Meanwhile, TaxSlayer has removed Pixel from their service, and has also removed it from Ramsey’s site, according to the report. TurboTax has stopped sending usernames to Pixel. Big daddy H&R Block had been sending health savings account data and info on users’ college tuition grants over to Meta through Pixel, at least until Monday. On Wednesday, H&R Block told Gizmodo that it had removed pixels from its DIY online product “to stop any client tax information from being collected.”
In an email, H&R Block told Gizmodo: “At H&R Block, we take protecting our clients’ privacy very seriously, and we are taking steps to mitigate the sharing of client information via pixels.”
Update 11/23/22 at 11:55 a.m. ET: This article was updated to include a statement from H&R Block claiming they have removed Meta Pixel from its DIY online product.