Tax preparers that shared private data with Meta, Google could be fined billions

1. Facebook asks advertisers to place some javascript on their website to help with general measurements (i.e.: whether viewing an ad on a Facebook property ultimately led to a purchase)

2. This javascript may also gather user interactions on the website so an advertiser can see what users engage with, what might be relevant to ad performance measurement, etc

3. These stupid tax prep companies placed the script on pages where users might view, interact with, or submit very private information

4. When users clicked around, tracking data was sent to FB

5. A security/privacy journalist spotted this and said, "gotcha."

Ad Tech companies don't want your SSN, and they really don't know to know if you purchased Plan B. But when tax prep sites and online pharmacies place a tracking script on all their webpages, everyone ends up with egg on their face.

There were no profits here. The journalist's privacy investigation should be appreciated and celebrated, but Elizabeth Warren is just raising a boogeyman so she can keep sticking a knife into the hearts of these large, corporate entities. Election season is coming up, after all.

throw9away610• 3 years ago

Ha well a nice strong fine then to discourage this stupid behavior of adding tracking scripts from 3rd party fines. I’d still like to see the executive that approved this spend 1 night in jail to prove a point that stupid has personal consequences

psychlops• 3 years ago

Don't spend money securing customer data...voila! Profit!

donmcronald• 3 years ago

Elizabeth Warren is just raising a boogeyman so she can keep sticking a knife into the hearts of these large, corporate entities

I’d say what you described at least comes close to being negligent. I’d hardly call that a “boogeyman”. It’s a serious issue that shouldn’t have occurred and there should be some repercussions for that.

dylan6042• 3 years ago

Ad Tech companies don't want your SSN

Where do you get that idea? All they doin the background is to deanonymize as much data as they can get. Why do you think they would not actually want this ultimate deanonymizer of US citizens?

JKCalhoun• 3 years ago

1. Facebook asks advertisers to place some javascript on their website

3. These stupid tax prep companies placed the script on pages where users might view, interact with, or submit very private information

I think you're being far too easy on Facebook.

noduerme2• 3 years ago

I had to spend most of my day doing a technical audit on this as well.

I can certainly see how they could have profited from data contained in certain forms that customers submitted on non-facebook websites, potentially confidential data which would be used to flesh out hidden user profiles and thus increase the prices for highly targeted ads.

kerkeslager5• 3 years ago

Seriously? This post strains credulity.

1. This isn't just a gotcha. If you're storing private data, be a fucking responsible human being and do the work to store it securely. Stop downplaying this.

2. Ad tech companies don't want your SSN or to know if you purchased Plan B? Ad tech companies want to know everything about you, especially things that are private because other people don't know that stuff and that's where the competitive advantage lies.

There were no profits here.

There were cut costs, which amount to the same thing.

lastofthemojito• 3 years ago

I suspect you're right. But there's still that little part of me hoping that maybe some big fines mixed with lessened revenues if the IRS releases it's own tax-prep software[0] could actually put some of these clowns out of business.

0: https://news.ycombinator.com/item?id=35950836

solardev• 3 years ago

Donate some money to some Congress member's reelection fund, promise them a cushy job afterward, it all gets swept under the rug. Bonus if the intelligence agencies can then double dip and reuse that same data for national security. To protect the children from terrorists, of course.

adeelk93• 3 years ago

In this conspiracy theory - why wouldn’t the intelligence agencies get tax returns from the IRS directly?

whatwhaaaaat• 3 years ago

I’m no constitutional lawyer but wouldn’t that be a violation of the 4th amendment whereas (and I don’t exactly know why either) it’s been deemed constitutional for the government to buy data collected by third parties?

technick4• 3 years ago

I believe those agencies would probably need a warrant.

shove• 3 years ago

“Could be” lol if anyone wants to bet it’ll be over $100M hit me up.

orzig• 3 years ago

Go wild: https://manifold.markets/

zadethrowaway1• 3 years ago

https://manifold.markets/ZadeTesting/will-the-tax-companies-...

exabrial• 3 years ago

How about we fine Google/Facebook trillions for accepting said data?

freeAgent• 3 years ago

I assume this idea would never be considered as a possibility by most people here (yeah, trillions is hyperbole), but it’s ready the case that firms in the Financial Services industry screen all incoming data over all channels for anything that looks like PII. The only stuff that makes it through with the recipient being unmolested must be approved by compliance and infosec folks. Anyway, this is just to say that refusing to accept unsolicited personal financial information is very much already a thing in industries outside Big Tech.

danielfoster• 3 years ago

I never see satisfaction in the government collecting big fines. The money really ought to go to the affected consumers.

technick4• 3 years ago

That would cost too much money

FounderBurr• 3 years ago

So there will be millions of man years of jail time directed at the executives ‘responsible’ for giving the go ahead to these deals?

Or will they never miss a chef prepared meal in their glass castles, with no chance of ever being held responsible for the great ‘responsibility’ of being in charge?

helsinkiandrew• 3 years ago

Lawmakers said that the evidence appears to show that "Meta and Google failed to implement adequate safeguards to prevent the transfer of taxpayers' sensitive personal and financial information, despite their contentions that they did so."

The description of the data that was shared is quite vague in the article. But If this is the result of tax prepping companies putting Meta pixels in pages containing personal data so they can show ads (shouldn’t these be only accessible by the user anyway so they can’t be scraped by Meta?), or manually adding personal data to analytics parameters (so they could check time on app by income etc), then I think the fault lies with those companies rather than Meta and Google

ec109685• 3 years ago

The headline is confusing. Tax preparers shared with both Google and Meta and the Tax Preparers could be fined billions.

technick4• 3 years ago

While one could only hope the people behind this data leak see's some form of criminal justice, it will likely only be a fine and a sternly worded letter telling these companies to get approval next time. They'll write it into their TOS and the business practice will be continued.

asynchronous• 3 years ago

We really, really need to punish this kind of behavior. Lying about the actions and the actions themselves are despicable. This should ruin the careers of the people who made these decisions.

dmurray• 3 years ago

It reflects poorly on the justice system that this is true, but it reflects extremely poorly on H&R Block's lawyers that they didn't slip something into the terms and conditions about how "we may from time to time share certain of this information with our commercial partners". Surely they would have lost less than one customer in a thousand.

goldpizza44• 3 years ago

This is why the IRS should be providing tax prep software directly. They should already have w2s, 1099s etc and should be able to process them directly into the forms. The only reason we have to pay third parties is they bought the politicians.

crooked-v• 3 years ago

Actually, most people in the US shouldn't have to do any tax prep at all. The IRS already has all that information, after all. The only reason the average US worker has to do anything more than a check a "this is correct" box is because a significant number of politicians intentionally want taxes to be annoying and time-consuming in order to bias people against the idea of being taxed at all.

SoftTalker• 3 years ago

Cynically, I think they don't because even they don't understand all their rules. They couldn't write the software even if they wanted to.

But yeah, I'd love it if this was the kick in the pants that is needed to get people to see how ridiculous it is that taxpayers need to pay a third party just to submit their information to the IRS.

moneywoes• 3 years ago

And billion dollar tax prep companies want to have business

PaulDavisThe1st• 3 years ago

And just to quantify that. Slightly more than 10% of the workforce are self-employed. For that 10%, the IRS has almost none of the relevant information. So "most people" in this context means 90%. I think most of us (even those in the 10%, like I am) would agree that 90% does indeed mean "most".

m463• 3 years ago

that way they can use google analytics directly.

for example, accessing the the California DMV website not only uses google analytics, it will log you into google.

bagacrap• 3 years ago

Tax prep is absolutely the scariest thing I do online (rivaled only by proving that I am qualified for a mortgage, but luckily that only happens infrequently). The amount of sensitive data you share with a company with minimal tech expertise...

bqmjjx0kac• 3 years ago

I have used encrypted PDFs in the past, sending the password out of band. I'm sure it annoyed them at the bank, but their tech didn't inspire confidence.

fsckboy• 3 years ago

while we're rounding up the suspects here, and deciding what laws to reform, let's remember that meta and google are the madams of this whorehouse, and advertisers are the johns, how about we make sure they are also disincented?

thegrizzlyking• 3 years ago

Attempting to research if tax prep companies had gained consent to disclose and use data from its users, Congress was blocked by the companies, who refused to "provide current and historical versions of disclosure agreements and privacy policies." Undeterred, Congress consulted Internet archives to access historical versions of company policies and pieced together that none of the companies appeared to have gained consent from their customers to share the sensitive data with Meta and Google.

Internet archives to the rescue

scarab92• 3 years ago

I hate the term “data”.

What data did they share, and why did Google or Meta want this data?

Are we only talking Google Analytics or are we talking about for profit data brokering.

GoblinSlayer• 3 years ago

For profit ad platforms, for example knowing taxes, you can sort people by their income.

adampk• 3 years ago

"That data came to Meta through its Pixel code, which the tax firms installed on their websites to gather information on how to improve their own marketing campaigns. In exchange, Meta was able to access the data to write targeted algorithms for its own users."

Seems that they provided the data to get Meta to target customers for them.

whyenot• 3 years ago

This sort of thing should be the civil equivalent of a capital crime. If the companies are found guilty, their entire assets should be seized and they should cease to function. It should also be easier to pierce the corporate veil.

jimnotgym• 3 years ago

Is it illegal to receive this information, or just to give it?

Eddy_Viscosity2• 3 years ago

'could' be fined billions.

What will they actually be fined? History would suggest very f'ing little if anything.

joker_minmax• 3 years ago

I know it doesn't amount to anything, but attempting to spank a company this way is the only time I really get happy about what the government did today, so I hope this time it actually changes something. But I don't think the tax prep firms should be the only ones punished here. What about the tech companies who took the data?

penguin_booze• 3 years ago

Fines on corporations should be large enough to burn and have their eyes water, not to tickle and leave them giggling. Additionally, executive pay and bonus should be cut/confiscated proportianately--this ought to be subtantial enough to make a dent in their net take-home pay. A compentent authority should verify this from their tax return of the following year.

Ultimately, it's the decision makers that must pay, not the janitors and cleaners.

Tax preparers that shared private data with Meta, Google could be fined billions

Related Stories