Google Gathers 'Massive Amounts' of Consumer Data Via Tax Preparation Websites: Suit

U.S. consumers unknowingly have been transmitting sensitive financial information to Google when they file their taxes online on H&R Block, TaxAct and TaxSlayer, said a privacy class action (docket 5:23-cv-03527) Friday in U.S. District Court for Northern California in San Jose.

Google Analytics’ tracking pixel, embedded in the JavaScript of online tax preparation websites, sent “massive amounts” of private tax return information such as income, refund amounts, filing status and scholarship information to Google, without taxpayers’ consent, “to improve its ad business and other business tools,” said the complaint. Disclosing tax return information without consent “is a crime,” as are aiding and abetting the unlawful disclosure of tax return information and inspecting unlawfully obtained tax return information, it said.

Plaintiff Mary Smith of DuPage County, Illinois, has used H&R Block’s website to file her taxes online since 2018, and since that time, the tax preparation company has used Google’s tracking pixel, the complaint said.

Google has made a “lucrative industry” out of ““extracting meaning from the mass of data accumulating on the Internet,” said the complaint, citing Britannica.com. The company has managed that by expanding its search engine business into advertising by “combining various marketing and advertisement firms’ databases of information to tailor ads to consumers’ individual preferences," it said.

Google has “transformed its search engine capabilities into its top revenue generating feature” by including ads as results for Google searches, the complaint said, and targeted ads have enabled advertisers to monitor statistics such as click-through rates and visitor interest. By 2016, Google earned nearly all its revenue from ads based on its users’ search requests, and in 2020, the company generated $104 billion, 71% of its annual revenue for the year, through advertising, it said.

To optimize advertising, Google offers data tracking features for how users interact with ads and advertisers’ websites to enable targeted advertising. It also tracks user actions and “conversions” to purchase. It generates reports for customers showing who clicked on ads, came through an advertiser’s website or installed and started using an advertiser’s mobile app, it said. The Google Analytics’ embedded pixel also measures actions taken by users, such as online purchases, it said.

Tax filing services such as H&R Block, TaxAct and TaxSlayer “have been quietly transmitting sensitive financial information to Google when Americans file their taxes online” via the Google tracking pixel and business tools, said the complaint. H&R Block “has admitted that its technology would permit such transmissions,” the complaint said, and TaxAct revealed that consumers’ dollar amount of adjusted gross income and refund amounts were disclosed to Google.

Google claims such information is not associated with the user’s name or other identifiable information, so that the information is not able to be linked to a specific user. But a recent Stanford and Princeton University study found Google’s tracking software can carry out “deanonymization,” the complaint said. Company officials “have admitted that if a Google Analytics customer so desired, they would be able to configure their settings to track sensitive taxpayer information such as adjusted gross income, and Google’s systems would not filter this information or even alert anyone,” it said.

The complaint asserts violation of California’s Invasion of Privacy Act, the Federal Wiretap Act, invasion of privacy and intrusion upon seclusion. Smith seeks statutory damages, prejudgment interest, injunctive relief and reasonable attorneys’ fees and legal costs. Google didn’t comment.

TaxAct violated congressional and IRS safeguards against the sharing of private tax return information (TRI) with third parties when it transmitted sensitive personally identifiable information (PII) to Facebook and Google for years, alleged plaintiff Matthew Hartz’s separate separate class action Saturday (docket 1:23-cv-04591) in U.S. District Court for Northern Illinois in Chicago.

“By affixing invisible tracking codes from Facebook and Google on its website, millions of Americans who used TaxAct to file their required annual tax returns” had their TRI and PII “unlawfully shared with these Big Tech giants,” said the complaint. It alleged violations of the Illinois Consumer Fraud and Deceptive Business Practices Act. Google didn't comment.