9 ms·

Tax prep firms shared ‘extraordinarily sensitive’ data about taxpayers with Meta

296 points by superhumanuser 3y ago

macintux 3y ago
Effectively a dup. Discussion here: https://news.ycombinator.com/item?id=36701706 https://news.ycombinator.com/item?id=36701706
- deleted 3y ago
  [deleted]
- PhazonJim 3y ago
  And that appears to be a dupe of: https://news.ycombinator.com/item?id=36693994 https://news.ycombinator.com/item?id=36693994
- dang 3y ago
  Yes. Macroexpanded: Tax preparers that shared private data with Meta, Google could be fined billions - https://news.ycombinator.com/item?id=36701706 https://news.ycombinator.com/item?id=36701706 - July 2023 (118 comments) Calls to investigate tax sites for sharing financial information with Meta - https://news.ycombinator.com/item?id=36693994 https://news.ycombinator.com/item?id=36693994 - July 2023 (155 comments) Tax-filing websites have been sending users financial info to Meta - https://news.ycombinator.com/item?id=33753058 https://news.ycombinator.com/item?id=33753058 - Nov 2022 (20 comments) Tax filing websites have been sending users’ financial information to Facebook - https://news.ycombinator.com/item?id=33705532 https://news.ycombinator.com/item?id=33705532 - Nov 2022 (74 comments)
srameshc 3y ago
This is another reason why it should be the government's obligation to provide websites to prepare and file taxes. Tax softwares should work to solve complex scenarios or whatever the need be for the specialized requirement only via API. And tax softwares should be approved after an audit by the government.
- WentFullRetard 3y ago
  [dead]
- paxys 3y ago
  Or how about - send me a tax bill at the end of the year and let me contest/adjust it if I want. The IRS knows the exact number the vast majority of people owe, but just chooses to keep it a secret.
  - dfxm12 3y ago
    It's incorrect to frame it like it's the IRS' fault, when it's really the fault of companies like intuit or H&R Block and their congressional lobbying efforts, and of course the congress that keeps taking the money in exchange for continuing this system.
  - cathalc 3y ago
    Not a US citizen so forgive me - but does the IRS not auto file tax returns for "regular" incomes - those managed fully by your employer? In my country, it's automatically done for those with "regular" incomes, even end of year tax back is as simple as logging on to Revenue and clicking a button. You're only on your own if you're self employed, generate non-standard income etc (like shares, which I imagine most people on HN are). In those cases, the government does _not_ know how much you earn until your audited. And audits are neither automated nor simple, a dedicated auditor is tasked with identifying all your sources of income and verifying everything. Point being it's manual.
    - jeffbee 3y ago
      The IRS has a thing called "free file" for simple tax situations below an income threshold, but Americans in several populous states would still need to separately prepare their state income tax filings.
      - kube-system 3y ago
        Americans in most states would need to prepare their state income tax. Americans in several states would also need to prepare their local income tax forms. Personally, I am filing income tax returns to four jurisdictions this year. One federal, two states, and one municipality.
jeffbee 3y ago
The politician's use of "shared" to describe this is misleading in a way that HN headline-only readers are going to jump all over. What these sites were doing was abusing Google Analytics to store private user data in custom parameters. That is, in one example, if a user of a tax prep site said that they had 1 dependent, the site would set a parameter like "cd17:1" in their Analytics request. I don't really see how that amounts to Google's problem. If a company uses or abuses software platforms to improperly store private user data, that is their error and not the fault of the platform. I assume you would not blame Google if Intuit put everyone's AGI in a Google Sheet.
- JKCalhoun 3y ago
  Why doesn't Google encrypt/decrypt the data on the client so that Google can't be accused of having access to that data?
  - barrkel 3y ago
    I expect it's because the firms wanted to use these values in Google Analytics to do analysis of their own customers. https://support.google.com/analytics/answer/10075209?hl=en https://support.google.com/analytics/answer/10075209?hl=en
    - taftster 3y ago
      Right. Someone at H&R Block wanted to know "what pages or functions do people with 1 dependent use the most". This query seems innocent enough. It's maybe logical and an easy thing to ask for without realizing the implications. I would bet this type of thing happens with LOTS of sites that collect any sort of personal data. Obviously for us here, blocking analytic platforms through an adblock tool is a smart thing to do, exactly for this reason. But obviously that doesn't scale to the masses.
  - suslik 3y ago
    Isn't having access to the data the whole point of this?
  - 3y ago
emodendroket 3y ago
> In a letter to the heads of the IRS, the Department of Justice, the Federal Trade Commission and the IRS watchdog, seven lawmakers say their findings “reveal a shocking breach of taxpayer privacy by tax prep companies and by Big Tech firms.” > Their report said highly personal and financial information about sources of taxpayers’ income, tax deductions and exemptions was made accessible to Meta as taxpayers used the tax software to prepare their taxes. > That data came to Meta through its Pixel code, which the tax firms installed on their websites to gather information on how to improve their own marketing campaigns. In exchange, Meta was able to access the data to write targeted algorithms for its own users. It is hard to see what Meta has done wrong here.
- smsm42 3y ago
  Not very hard. Let me try: > In exchange, Meta was able to access the data to write targeted algorithms for its own users. Here, I saw it, and it wasn't hard. I didn't give Meta - the company I have no relationship with - to use my private data, entrusted to completely different company, to enhance their business. It's like you'd hire a cleaning company, and the cleaners would ruffle through your private papers while inside your home, get some confidential financial info, and use it for personal profit. I'd say this is something that one may classify as "wrong".
mensetmanusman 3y ago
AI powered analytics is going to know so much about us that we don't have a chance unless we make the cost of analysis 100-1000x more expensive through obfuscation (which costs latency unfortunately). The internet is all connected; if some companies in certain countries are prevented from analyzing, others will pick up the slack.
NickC25 3y ago
As much as I hate Meta, Google, etc... they shouldn't be in the crosshairs here. It's the tax-prep companies like Intuit that are effectively rent-seeking leeches that serve little purpose outside of "lobbying" politicians to keep the tax code intentionally obfuscated and full of loopholes.
- spywaregorilla 3y ago
  They should both be in the crosshairs
  - gunapologist99 3y ago
    Actually, it sounds like Intuit was the best of all of the named firms (see the original research here: https://themarkup.org/pixel-hunt/2022/11/22/tax-filing-websites-have-been-sending-users-financial-information-to-facebook https://themarkup.org/pixel-hunt/2022/11/22/tax-filing-websi... ) but still not perfect, since they at least shared the username of the active user.
- godelski 3y ago
  If you're going to move the target like that then why not to congress itself who even enable the ability to lobby in the first place? Several congressmen discuss regulatory capture but they themselves participate in it. Overturn Citizens United.
  - NickC25 3y ago
    Absolutely. I'm all for companies being able to participate in political discourse, but there has to be a limit. Regulatory capture, while a natural outcome in a capitalist economy, should be actively fought against with the strongest of forces. My proposal: ~If you've received a federal contract in the last 2 years of over $500,000 , or are currently in the midst of a contract with a federal (or state) agency or military branch, you cannot lobby. ~If you have a EV of over 1 billion dollars, you cannot lobby. ~If over half your workforce are not US citizens, you cannot lobby. ~If any full-time worker in your organization makes within x% of minimum wage, you cannot lobby. I'm all for small and medium sized businesses getting their voices heard. I'm not in favor of massive corporations bullying their way to writing laws that hurt the American people.
NoZebra120vClip 3y ago
Correct me if I am wrong, but there is a significant lacuna in this article, namely: which years? I may be affected by this, so I read the article to confirm whether I am affected based on the years, but they didn't even put in that information.
goodenforce 3y ago
If confidential information like income was shared, both the tax firms and Meta ought to be closed, on the spot.
juanani 3y ago
[dead]
29athrowaway 3y ago
They should be forced to hard delete the data and all its copies. Not anonymize it or soft delete it. Hard delete it as in zeroing all of it and all data derived from it. Then report on how the data was shared and force each entity receiving the data to delete it as well.
Teever 3y ago
Who did this? Specifically, who are the individuals involved in doing this? It isn't enough to name the corporations, I want the names and personal information of everyone who did this. Start doing that, and you start solving this problem.
kernal 3y ago
If you're not paying for your online tax service your personal data will cover the charge.
romusha 3y ago
Eh they will be fine like any other before them
FredPret 3y ago
I used tax prep software once or twice. Each time it cost about CAD 20 - 30. Then I found an accountant that'll do it for CAD 50-100 (for a simple filing). My time spent filing tax went from 30-60 minutes to about 1 minute. The amount of psychological pain from reading endless legalese, figuring out if I had moved more than x km for work, and many other inane questions, dropped from a lot to almost zero. And the money I got back skyrocketed because this person actually knows all the legalese. Best investment ever!
- esoterica 3y ago
  You know you still have to tell your accountant whether or not you moved x km for work if it’s relevant for your taxes right? They aren’t omniscient, any questions that your tax software makes you answer your accountant needs to ask you too if they are doing their job right. If your taxes are simple enough that it costs less than $100 for an accountant to handle it then that means you shouldn’t have to do anything more than enter your income and biographical info into your tax software. There is no reason why hiring an accountant would be any faster or more convenient. And I’m sorry, but the fact that your taxes were so simple that your accountant charged you less than $100 and somehow still magically found extra money for you smells very fishy to me. At that price point there are no secret deductions your accountant will discover for you that turbo tax won’t automatically claim for you and that you need deep knowledge of legalese to exploit. Are you sure your accountant didn’t claim fraudulent deductions or forget to list certain sources of income? You should never judge an accountant by how much money they get back for you, when you have simple taxes your tax burden is both trivial to determine and immutable, and the only way to decrease it is fraud.
  - FredPret 3y ago
    Yes but the accountant knows my general situation, knows the current state of the legalese, and can translate this into the minimum number of simple, < dozen word English sentences. As regards to your last two paragraphs, I think you're missing the point. I could find these deductions in Turbotax if I wanted to. But for $100, I don't have to think about it or wade through endless questionnaires. It's unfortunate that your mind jumps to tax fraud on my or my accountant's part before you consider this, much simpler, point.
mixmastamyk 3y ago
The IRS is probably doing this as well: https://news.ycombinator.com/item?id=36361915 https://news.ycombinator.com/item?id=36361915 It's possible noscript saved me, but I'm not 100% sure. Sometimes the page has a bug where it won't work without the external JS loaded, and you are forced to load it. My bank recently added a login requirement for some external JS from a site called "launch darkly", which I know very little about. Can we sue these entities to make them stop this shit? Should be illegal to load external JS on sensitive sites.

Effectively a dup. Discussion here: https://news.ycombinator.com/item?id=36701706 https://news.ycombinator.com/item?id=36701706

deleted 3y ago
[deleted]
PhazonJim 3y ago
And that appears to be a dupe of: https://news.ycombinator.com/item?id=36693994 https://news.ycombinator.com/item?id=36693994
dang 3y ago
Yes. Macroexpanded: Tax preparers that shared private data with Meta, Google could be fined billions - https://news.ycombinator.com/item?id=36701706 https://news.ycombinator.com/item?id=36701706 - July 2023 (118 comments) Calls to investigate tax sites for sharing financial information with Meta - https://news.ycombinator.com/item?id=36693994 https://news.ycombinator.com/item?id=36693994 - July 2023 (155 comments) Tax-filing websites have been sending users financial info to Meta - https://news.ycombinator.com/item?id=33753058 https://news.ycombinator.com/item?id=33753058 - Nov 2022 (20 comments) Tax filing websites have been sending users’ financial information to Facebook - https://news.ycombinator.com/item?id=33705532 https://news.ycombinator.com/item?id=33705532 - Nov 2022 (74 comments)

srameshc 3y ago

This is another reason why it should be the government's obligation to provide websites to prepare and file taxes. Tax softwares should work to solve complex scenarios or whatever the need be for the specialized requirement only via API. And tax softwares should be approved after an audit by the government.

WentFullRetard 3y ago
[dead]
paxys 3y ago
Or how about - send me a tax bill at the end of the year and let me contest/adjust it if I want. The IRS knows the exact number the vast majority of people owe, but just chooses to keep it a secret.
- dfxm12 3y ago
  It's incorrect to frame it like it's the IRS' fault, when it's really the fault of companies like intuit or H&R Block and their congressional lobbying efforts, and of course the congress that keeps taking the money in exchange for continuing this system.
- cathalc 3y ago
  Not a US citizen so forgive me - but does the IRS not auto file tax returns for "regular" incomes - those managed fully by your employer? In my country, it's automatically done for those with "regular" incomes, even end of year tax back is as simple as logging on to Revenue and clicking a button. You're only on your own if you're self employed, generate non-standard income etc (like shares, which I imagine most people on HN are). In those cases, the government does _not_ know how much you earn until your audited. And audits are neither automated nor simple, a dedicated auditor is tasked with identifying all your sources of income and verifying everything. Point being it's manual.
  - jeffbee 3y ago
    The IRS has a thing called "free file" for simple tax situations below an income threshold, but Americans in several populous states would still need to separately prepare their state income tax filings.
    - kube-system 3y ago
      Americans in most states would need to prepare their state income tax. Americans in several states would also need to prepare their local income tax forms. Personally, I am filing income tax returns to four jurisdictions this year. One federal, two states, and one municipality.

jeffbee 3y ago

The politician's use of "shared" to describe this is misleading in a way that HN headline-only readers are going to jump all over. What these sites were doing was abusing Google Analytics to store private user data in custom parameters. That is, in one example, if a user of a tax prep site said that they had 1 dependent, the site would set a parameter like "cd17:1" in their Analytics request. I don't really see how that amounts to Google's problem. If a company uses or abuses software platforms to improperly store private user data, that is their error and not the fault of the platform. I assume you would not blame Google if Intuit put everyone's AGI in a Google Sheet.

JKCalhoun 3y ago
Why doesn't Google encrypt/decrypt the data on the client so that Google can't be accused of having access to that data?
- barrkel 3y ago
  I expect it's because the firms wanted to use these values in Google Analytics to do analysis of their own customers. https://support.google.com/analytics/answer/10075209?hl=en https://support.google.com/analytics/answer/10075209?hl=en
  - taftster 3y ago
    Right. Someone at H&R Block wanted to know "what pages or functions do people with 1 dependent use the most". This query seems innocent enough. It's maybe logical and an easy thing to ask for without realizing the implications. I would bet this type of thing happens with LOTS of sites that collect any sort of personal data. Obviously for us here, blocking analytic platforms through an adblock tool is a smart thing to do, exactly for this reason. But obviously that doesn't scale to the masses.
- suslik 3y ago
  Isn't having access to the data the whole point of this?
- 3y ago

emodendroket 3y ago

> In a letter to the heads of the IRS, the Department of Justice, the Federal Trade Commission and the IRS watchdog, seven lawmakers say their findings “reveal a shocking breach of taxpayer privacy by tax prep companies and by Big Tech firms.” > Their report said highly personal and financial information about sources of taxpayers’ income, tax deductions and exemptions was made accessible to Meta as taxpayers used the tax software to prepare their taxes. > That data came to Meta through its Pixel code, which the tax firms installed on their websites to gather information on how to improve their own marketing campaigns. In exchange, Meta was able to access the data to write targeted algorithms for its own users. It is hard to see what Meta has done wrong here.

smsm42 3y ago
Not very hard. Let me try: > In exchange, Meta was able to access the data to write targeted algorithms for its own users. Here, I saw it, and it wasn't hard. I didn't give Meta - the company I have no relationship with - to use my private data, entrusted to completely different company, to enhance their business. It's like you'd hire a cleaning company, and the cleaners would ruffle through your private papers while inside your home, get some confidential financial info, and use it for personal profit. I'd say this is something that one may classify as "wrong".

mensetmanusman 3y ago

AI powered analytics is going to know so much about us that we don't have a chance unless we make the cost of analysis 100-1000x more expensive through obfuscation (which costs latency unfortunately). The internet is all connected; if some companies in certain countries are prevented from analyzing, others will pick up the slack.

NickC25 3y ago

As much as I hate Meta, Google, etc... they shouldn't be in the crosshairs here. It's the tax-prep companies like Intuit that are effectively rent-seeking leeches that serve little purpose outside of "lobbying" politicians to keep the tax code intentionally obfuscated and full of loopholes.

spywaregorilla 3y ago
They should both be in the crosshairs
- gunapologist99 3y ago
  Actually, it sounds like Intuit was the best of all of the named firms (see the original research here: https://themarkup.org/pixel-hunt/2022/11/22/tax-filing-websites-have-been-sending-users-financial-information-to-facebook https://themarkup.org/pixel-hunt/2022/11/22/tax-filing-websi... ) but still not perfect, since they at least shared the username of the active user.
godelski 3y ago
If you're going to move the target like that then why not to congress itself who even enable the ability to lobby in the first place? Several congressmen discuss regulatory capture but they themselves participate in it. Overturn Citizens United.
- NickC25 3y ago
  Absolutely. I'm all for companies being able to participate in political discourse, but there has to be a limit. Regulatory capture, while a natural outcome in a capitalist economy, should be actively fought against with the strongest of forces. My proposal: ~If you've received a federal contract in the last 2 years of over $500,000 , or are currently in the midst of a contract with a federal (or state) agency or military branch, you cannot lobby. ~If you have a EV of over 1 billion dollars, you cannot lobby. ~If over half your workforce are not US citizens, you cannot lobby. ~If any full-time worker in your organization makes within x% of minimum wage, you cannot lobby. I'm all for small and medium sized businesses getting their voices heard. I'm not in favor of massive corporations bullying their way to writing laws that hurt the American people.

NoZebra120vClip 3y ago

Correct me if I am wrong, but there is a significant lacuna in this article, namely: which years? I may be affected by this, so I read the article to confirm whether I am affected based on the years, but they didn't even put in that information.

goodenforce 3y ago

If confidential information like income was shared, both the tax firms and Meta ought to be closed, on the spot.

juanani 3y ago

[dead]

29athrowaway 3y ago

They should be forced to hard delete the data and all its copies. Not anonymize it or soft delete it. Hard delete it as in zeroing all of it and all data derived from it. Then report on how the data was shared and force each entity receiving the data to delete it as well.

Teever 3y ago

Who did this? Specifically, who are the individuals involved in doing this? It isn't enough to name the corporations, I want the names and personal information of everyone who did this. Start doing that, and you start solving this problem.

kernal 3y ago

If you're not paying for your online tax service your personal data will cover the charge.

romusha 3y ago

Eh they will be fine like any other before them

FredPret 3y ago

I used tax prep software once or twice. Each time it cost about CAD 20 - 30. Then I found an accountant that'll do it for CAD 50-100 (for a simple filing). My time spent filing tax went from 30-60 minutes to about 1 minute. The amount of psychological pain from reading endless legalese, figuring out if I had moved more than x km for work, and many other inane questions, dropped from a lot to almost zero. And the money I got back skyrocketed because this person actually knows all the legalese. Best investment ever!

esoterica 3y ago
You know you still have to tell your accountant whether or not you moved x km for work if it’s relevant for your taxes right? They aren’t omniscient, any questions that your tax software makes you answer your accountant needs to ask you too if they are doing their job right. If your taxes are simple enough that it costs less than $100 for an accountant to handle it then that means you shouldn’t have to do anything more than enter your income and biographical info into your tax software. There is no reason why hiring an accountant would be any faster or more convenient. And I’m sorry, but the fact that your taxes were so simple that your accountant charged you less than $100 and somehow still magically found extra money for you smells very fishy to me. At that price point there are no secret deductions your accountant will discover for you that turbo tax won’t automatically claim for you and that you need deep knowledge of legalese to exploit. Are you sure your accountant didn’t claim fraudulent deductions or forget to list certain sources of income? You should never judge an accountant by how much money they get back for you, when you have simple taxes your tax burden is both trivial to determine and immutable, and the only way to decrease it is fraud.
- FredPret 3y ago
  Yes but the accountant knows my general situation, knows the current state of the legalese, and can translate this into the minimum number of simple, < dozen word English sentences. As regards to your last two paragraphs, I think you're missing the point. I could find these deductions in Turbotax if I wanted to. But for $100, I don't have to think about it or wade through endless questionnaires. It's unfortunate that your mind jumps to tax fraud on my or my accountant's part before you consider this, much simpler, point.

mixmastamyk 3y ago

The IRS is probably doing this as well: https://news.ycombinator.com/item?id=36361915 https://news.ycombinator.com/item?id=36361915 It's possible noscript saved me, but I'm not 100% sure. Sometimes the page has a bug where it won't work without the external JS loaded, and you are forced to load it. My bank recently added a login requirement for some external JS from a site called "launch darkly", which I know very little about. Can we sue these entities to make them stop this shit? Should be illegal to load external JS on sensitive sites.