The headquarters of Meta (formerly Facebook) are seen in Menlo Park, California on November 9, 2022.
Josh Adelson | AFP | Getty Images
Popular tax preparation software incl TaxActand TaxSlayer H&R block Send sensitive financial information to Facebook’s parent company meta Through its ubiquitous code, known as a pixel, it helps developers track user activity on their sites, according to an investigation by The Markup.
In a report published with The Verge on Tuesday, the outlet found that Meta pixel trackers in the software send information such as names, email addresses, income information and refunds to Meta, violating its policies. Markup also found that TaxAct passed similar financial information to The Google via its analysis tool, though that data did not include names.
As CNBC explained in 2018, Meta uses small pixels that publishers and companies embed on their websites. Points send a message back to Facebook when you visit. It allows companies to target ads to people based on the sites they have visited previously.
The report said Facebook can use information from tax websites to run its own advertising algorithms, even if someone using the tax service does not have a Facebook account. It’s another example of how Facebook tools can be used to track people around the web, even if users don’t know it.
Some of the data provided to The Markup suggests that it may have been an error.
A spokesperson for Ramsey Solutions, a financial advisory and software firm that uses a version of TaxSlayer, told The Markup that it “does not know and has never been notified that personal tax information is being collected by Facebook from the Pixel,” and that the company told TaxSlayer to deactivate tracking pixels from SmartTax. .
A spokesperson for H&R Block said the company takes “protecting our customers’ privacy very seriously, and we’re taking steps to mitigate the sharing of customer information across pixels.”
On Wednesday, H&R Block said in a statement that it had “removed pixels from its online DIY product to prevent any customer tax information from being collected.”
Markup discovered the trail of data through a project earlier this year with Mozilla Rally called “Pixel Hunt,” in which participants installed a browser extension that sent the group a copy of the data shared with the Meta through its pixel.
“Advertisers should not submit sensitive information about people through our business tools,” a spokesperson for Meta told CNBC in a statement. “Doing so is against our policies and we teach advertisers how to properly set up business tools to prevent this from happening. Our system is designed to filter out potentially sensitive data that it can detect.”
Meta considers potentially sensitive information to include information about income, loan amounts, and debt status.
“No data is anonymized in Google Analytics, meaning it is not associated with an individual, and our policies prohibit customers from sending us data that could be used to identify a user,” a Google spokesperson told CNBC. Additionally, Google has strict policies against advertising to people based on sensitive information.
“The privacy of our customers is very important to all of us at TaxAct, and we continue to comply with all laws and IRS regulations,” a TaxAct spokesperson said in a statement. “Data provided to Facebook on an aggregate level, rather than on an individual level, is used by TaxAct to analyze the effectiveness of our ads. TaxAct does not use information provided by its customers and referenced in the report by The Markup to target ads with Facebook.”
A TaxSlayer representative did not immediately respond to CNBC’s request for comment.
Read the full report on The Verge.
Subscribe to CNBC on YouTube.
WATCH: Facebook competes with Apple on user privacy features in an iOS update