Democrats say ‘potentially illegal’ taxpayer data breach warrants DOJ investigation

Senate Democrats are calling on the Department of Justice to investigate after a months-long probe reportedly revealed "outrageous, extensive and potentially illegal sharing of taxpayers’ sensitive personal and financial information with Meta by online tax preparation companies."

The lawmakers, including Sens. Elizabeth Warren, Ron Wyden, Richard Blumenthal, Tammy Duckworth, Bernie Sanders and Sheldon Whitehouse, released a 54-page report on the issue, also requesting prosecution if a company or individual violated the law. 

The group, as well as Rep. Katie Porter, sent a letter to the Internal Revenue Service, the Treasury Inspector General for Tax Administration, the Federal Trade Commission and the Department of Justice that highlighted the findings. 

Warren's office said that companies shared millions of taxpayers’ tax return data, meaning they could face billions of dollars in potential criminal liability.

REPUBLICANS, TRADE ASSOCIATION IN FIGHT WITH SEC OVER ‘UNCONSTITUTIONAL’ LIST OF INVESTOR INFO

"The findings of this report reveal a shocking breach of taxpayer privacy by tax prep companies and by Big Tech firms that appeared to violate taxpayers’ rights and may have violated taxpayer privacy law," the lawmakers wrote. "Relevant enforcement entities – including the IRS, the Treasury Inspector General for Tax Administration (TIGTA), the Federal Trade Commission (FTC) and the Department of Justice (DOJ) should fully investigate this matter and prosecute any company or individuals who violated the law."

The report said tax prep companies used computer code – known as pixels – to send data to the tech giants, including Meta Pixel and Google Analytics.

In response to the congressional inquiry, Warren's office said the companies each revealed they had shared taxpayer data via their use of the Meta Pixel and Google tools. 

The FTC and experts reportedly said that although the tax prep companies and tech firms claimed that all shared data was anonymous, the data could easily be used to identify individuals or to create a dossier on them that could be used for targeted advertising or other purposes.

The tax prep companies are said to have indicated they installed the Meta and Google tools on their sites without fully understanding the extent to which they would send taxpayer data to these tech firms, without consulting with independent compliance or privacy experts, and without full knowledge of Meta’s use of and disposition of the data.

GET FOX BUSINESS ON THE GO BY CLICKING HERE 

The lawmakers said that by law a tax return preparer may not disclose or use a taxpayer’s tax return information prior to obtaining written consent from the taxpayer, and that they had failed to do so when it came to the information that was turned over to Meta and Google. 

While these companies can also turn over data to "auxiliary service providers in connection with the preparation of a tax return," Meta and Google likely do not meet that definition, and data sharing with Meta was not for purposes in connection with the preparation of a return, but advertising.

"H&R Block takes protecting our clients’ privacy very seriously, and we have taken steps to prevent the sharing of information via pixels," a spokeswoman told FOX Business in an email on Thursday.

"We have strict policies and technical features that prohibit Google Analytics customers from collecting data that could be used to identify an individual," a Google spokesperson also told FOX Business. "Site owners – not Google – are in control of what information they collect and must inform their users of how it will be used. Additionally, Google has strict policies against advertising to people based on sensitive information." 

The spokesperson pointed out that organizations control what data is collected, using Google Analytics, and how it is used, and that Google only stores and processes this data per their instructions. 

Organizations are required to give visitors proper notice about the implementations and features of Google Analytics that they use, and whether this data can be connected to other data they have about them.

Furthermore, Google Analytics customers are prohibited from uploading information that could be used by Google to identify a person, and Google Analytics cannot be used to show advertisements to people based on sensitive information such as health, ethnicity, sexual orientation or negative financial situations.

CLICK HERE TO READ MORE ON FOX BUSINESS

"We’ve been clear in our policies that advertisers should not send sensitive information about people through our business tools," Meta told FOX Business. "Doing so is against our policies and we educate advertisers on properly setting up business tools to prevent this from occurring. Our system is designed to filter out potentially sensitive data it is able to detect."

TaxAct told FOX Business that it has engaged with Warren and her staff to provide "transparent, detailed explanations on [its] use of these standard analytics tools."

"TaxAct has always complied with laws that protect our customers’ privacy and, as noted in the report, we disabled the tools in question while we evaluated potential concerns. Protecting the rights and privacy of our customers is our top priority, and we are committed to engaging with stakeholders to address any concerns and to help advance public policy," it said.

TaxSlayer did not immediately respond to FOX Business' requests for comment.