Tax prep firms shared ‘extraordinarily sensitive’ data about taxpayers with Meta
apnews.com
apnews.com
Tax preparers that shared private data with Meta, Google could be fined billions - https://news.ycombinator.com/item?id=36701706 - July 2023 (118 comments)
Calls to investigate tax sites for sharing financial information with Meta - https://news.ycombinator.com/item?id=36693994 - July 2023 (155 comments)
Tax-filing websites have been sending users financial info to Meta - https://news.ycombinator.com/item?id=33753058 - Nov 2022 (20 comments)
Tax filing websites have been sending users’ financial information to Facebook - https://news.ycombinator.com/item?id=33705532 - Nov 2022 (74 comments)
If a company uses or abuses software platforms to improperly store private user data, that is their error and not the fault of the platform. I assume you would not blame Google if Intuit put everyone's AGI in a Google Sheet.
This query seems innocent enough. It's maybe logical and an easy thing to ask for without realizing the implications. I would bet this type of thing happens with LOTS of sites that collect any sort of personal data.
Obviously for us here, blocking analytic platforms through an adblock tool is a smart thing to do, exactly for this reason. But obviously that doesn't scale to the masses.
Sadly I think there is a trend in our industry to gather everything, decide what you actually want/need later.
I think Google (and related) are to blame for enabling this kind of "data hoovering". Giving the customer what they want at the expense of us the users is getting kinda evil.
And that level of insight only works for small companies - at a certain point you want to combine analytics from your UI with things like “is this a high value customer” or “did this customer stop using the app after experiencing this frustrating UX”
Do I care? No.
We're watching the world burn right now with more pressing issues, and this whole thing seems so ridiculously academic and contrived.
The stampede of technology on our privacy, on our daily lives is, I think, one of those fires burning right now.
I don't see where you get that people are blaming the platform. It sounds to me that they're blaming the tax prep companies that shared the sensitive data.
Other than when Senators referred to it as a shocking breach of privacy by "Big Tech" and the article includes a digression on Facebook's supposed long history of privacy issues, clearly implying this is another such incident?
The letter from Sen. Warren that caused this press article blames Meta and Google for these events. It says "The Big Tech firms also appeared to act with stunning disregard for taxpayer privacy" even though Google and Meta had no agency in these matters.
I take issue with this statement.
agency is defined as -- via google - as action or intervention, especially such as to produce a particular effect
If google/meta creates a product like google analytics that is then used by third parties ( even if it is misused -- for various values of misused ), in itself, it is an action. You can say they were not actively involved ( and I do wonder about that, but I have no definitive proof one way or another ), but it is hard to argue they have no agency.
It is an equivalent of 'look, we are only selling the thing that we also happen to completely control online and we have no control over how it is used'. It is not a great defense ( and it is very easy to portray negatively ).
> Taxpayer data was also shared with Google, through its own tracking tools — though the firm told lawmakers that it never used the information to track users on the internet, according to the report.
So, they only store a unique id in their user tracking system, but they put the sensitive information in their ad targeting system, then join the data at impression time.
I guess it is good that they don’t stick PII in tracking cookies that they use to interoperate with third parties, but that is an extremely low bar.
I would not be surprised if google, meta and co don't have big ML codes that try to find signals to increase ad revenue, and they dump all data they have into it.
Meaning, of course, people are in charge of the machine learning / algorithm, people manage the weights, they measure the outcomes, they exercise editorial control. It's not a mystical black box given to us by god or a super advanced alien race; it's people doing people things; if they get the profit they also get the liability / responsibility. Even if they're not sure how it works, they sure as hell still responsible for it.
However I'd say sending sensitive (or at least private) data to google analytics is more or less its intended purpose. I don't think the use and continued existence of google analytics is compatible with any reasonable privacy protection.
In every other engineering discipline you are required to understand the impacts and uses of what you build.
This is what an “environmental impact study” is - and despite what people might think of how they are used - the core purpose and reason they are key to engineering is because second and third order effects are real, impactful and frankly mitigation costs a lot.
Unfortunately, we never actually developed such a practice in software development outside of cases where hard engineering was leading such as in defense, nuclear or other very highly regulated, lethal, or martial industries.
In the past, machinery didn’t have covers over what are now internal moving parts. The law changed that.
- You make Microsoft Excel. Someone uses Excel to leak a million people’s PII.
- You build shovels. Someone murdered someone with your shovel.
- You build an analytics product, explicitly ban collecting PII in your EULA, someone does it anyway.
It’s fun to be outraged and hating on GA is very in vogue at the moment, but this specific incident is just someone (yes, someone, not a nefarious company) using a popular tool incorrectly.
In the US, we do do this with firearms, though generally the winning cases tend to be focused around advertising strategies
This is my least favorite part of product development, which is the part where people who like developing stuff just arbitrarily decide when to stop caring about what the product is used for, and then fighting the rest of the world on that design decision because it’s obstinately “simply their product and their choice.”
I don’t know anything more antisocial or lacking in responsibility than taking on the responsibility of being a leader, promoting your services or product to other people via advertising and marketing and then shirking all responsibility when people say your product is being used to harmi other people.
As long as you get paid and do only the things that ONLY you think are important, that’s that’s the kind of society we want to build, right?
Excel has many primary benefitial purposes, it wasn't built for leaking PII.
Shovels likewise are useful for a benefitial purpose, they are not made for beating people up.
Third party spyware ("analytics") has only one purpose, collect data from unsuspecting customers. They have no valid benefitial purpose, if one accepts that spying is not kosher.
The original cited source is https://themarkup.org/pixel-hunt/2022/11/22/tax-filing-websi... and contains more details than the AP article (and was discussed here: https://news.ycombinator.com/item?id=33753058 )
Can you quote the specific section for this claim? I skimmed the themarkup.org article and the closest thing I could find was this
>Meta wins financially too. The company says it can use the data it gleans from tools like the pixel to power its algorithms, providing it insight into the habits of users across the internet.
Which has a link to facebook's tos. That's not really indication of what they actually do, just legal ass covering.
AGI here refers to Annual Gross Income, not Artificial General Intelligence.
My brain skipped a beat because I assume Intuit had AGI but backtracked because you can't really put AGI in a Google Sheet. :shrugs:
If you only got as far as the press release[2] then I can understand your view:
> * Tax prep companies shared extraordinarily sensitive personal and financial information with Meta, which used the data for diverse advertising purposes
> TaxAct, H&R Block, and TaxSlayer each revealed, in response to this Congressional inquiry, that they shared taxpayer data via their use of the Meta Pixel and Google’s tools. Although the tax prep companies and Big Tech firms claimed that all shared data was anonymous, the FTC and experts have indicated that the data could easily be used to identify individuals, or to create a dossier on them that could be used for targeted advertising or other purposes.
This paragraph is woolly and does not appear to support the claim in the bullet point. But the full report has much strong wording on page 2: "Meta also confirmed that it used the data to target ads to taxpayers, including for companies other than the tax prep companies themselves, and to train Meta's own AI algorithms".
The logic of this claim, via page 19, appears to be: Meta says if their sensitive information filtering algorithm detected personal information, the information would not have been used for advertising, and they'd have sent a notification to the tax prep firms. They also confirmed the negative case: if no notification was received by the tax prep firm, then no filtering of their data took place. Meta was asked to provide copies of notifications they had sent to the tax prep firms and they did not do so. So the assumption is that none were sent, therefore no filtering took place, and the data were used as a signal in the advertising algorithm.
I don't find it to be an unequivocal confirmation, but the sources don't support your claim that this article is misleading or your claim that there's no reason to consider it a problem of the tech companies involved.
[1] https://www.warren.senate.gov/imo/media/doc/Attacks%20on%20T...
[2] https://www.warren.senate.gov/oversight/reports/in-new-repor...
In my country, it's automatically done for those with "regular" incomes, even end of year tax back is as simple as logging on to Revenue and clicking a button.
You're only on your own if you're self employed, generate non-standard income etc (like shares, which I imagine most people on HN are).
In those cases, the government does _not_ know how much you earn until your audited. And audits are neither automated nor simple, a dedicated auditor is tasked with identifying all your sources of income and verifying everything. Point being it's manual.
Personally, I am filing income tax returns to four jurisdictions this year. One federal, two states, and one municipality.
I wonder if we have the same roadblocks here (Ireland/EU), or if there's just zero innovation in the area. Probably both.
Companies DO submit your income to the IRS. However, citizens are required to separately submit their incomes on tax returns. Taxes on (nearly all) stock income is also reported to the IRS. The IRS cross-checks these values between the company-reported and the earner-reported submissions.
The argument is that if the system auto-filled tax returns, people wouldn't report income that the system hadn't auto-filled, so the government would lose money.
All federal electronic filing is done through private companies. Even the IRS's website for "free fillable forms" (which appears as if it were run by the IRS) is actually run by a private company. The only way to not submit taxes through a private company is to submit them on paper.
We could get rid of all this by replacing federal income tax with a federal sales tax.
A federal sales tax is such an example. It simplifies the calculation of tax burden (solves the problem) by implementing a regressive tax code and placing an undue burden on lower income residents.
I'd like to see some evidence.
It's the tax-prep companies like Intuit that are effectively rent-seeking leeches that serve little purpose outside of "lobbying" politicians to keep the tax code intentionally obfuscated and full of loopholes.
My proposal:
~If you've received a federal contract in the last 2 years of over $500,000 , or are currently in the midst of a contract with a federal (or state) agency or military branch, you cannot lobby. ~If you have a EV of over 1 billion dollars, you cannot lobby. ~If over half your workforce are not US citizens, you cannot lobby. ~If any full-time worker in your organization makes within x% of minimum wage, you cannot lobby.
I'm all for small and medium sized businesses getting their voices heard. I'm not in favor of massive corporations bullying their way to writing laws that hurt the American people.
If you see a tax credit for air conditioners purchases by Florida panhandle-based polar bear breeders in the tax code, you should blame the Tallahassee Association of Polar Bear Breeders, not Intuit.
> Their report said highly personal and financial information about sources of taxpayers’ income, tax deductions and exemptions was made accessible to Meta as taxpayers used the tax software to prepare their taxes.
> That data came to Meta through its Pixel code, which the tax firms installed on their websites to gather information on how to improve their own marketing campaigns. In exchange, Meta was able to access the data to write targeted algorithms for its own users.
It is hard to see what Meta has done wrong here.
> In exchange, Meta was able to access the data to write targeted algorithms for its own users.
Here, I saw it, and it wasn't hard. I didn't give Meta - the company I have no relationship with - to use my private data, entrusted to completely different company, to enhance their business. It's like you'd hire a cleaning company, and the cleaners would ruffle through your private papers while inside your home, get some confidential financial info, and use it for personal profit. I'd say this is something that one may classify as "wrong".
Then I found an accountant that'll do it for CAD 50-100 (for a simple filing).
My time spent filing tax went from 30-60 minutes to about 1 minute. The amount of psychological pain from reading endless legalese, figuring out if I had moved more than x km for work, and many other inane questions, dropped from a lot to almost zero.
And the money I got back skyrocketed because this person actually knows all the legalese. Best investment ever!
If your taxes are simple enough that it costs less than $100 for an accountant to handle it then that means you shouldn’t have to do anything more than enter your income and biographical info into your tax software. There is no reason why hiring an accountant would be any faster or more convenient.
And I’m sorry, but the fact that your taxes were so simple that your accountant charged you less than $100 and somehow still magically found extra money for you smells very fishy to me. At that price point there are no secret deductions your accountant will discover for you that turbo tax won’t automatically claim for you and that you need deep knowledge of legalese to exploit. Are you sure your accountant didn’t claim fraudulent deductions or forget to list certain sources of income?
You should never judge an accountant by how much money they get back for you, when you have simple taxes your tax burden is both trivial to determine and immutable, and the only way to decrease it is fraud.
As regards to your last two paragraphs, I think you're missing the point. I could find these deductions in Turbotax if I wanted to. But for $100, I don't have to think about it or wade through endless questionnaires. It's unfortunate that your mind jumps to tax fraud on my or my accountant's part before you consider this, much simpler, point.
The internet is all connected; if some companies in certain countries are prevented from analyzing, others will pick up the slack.
https://news.ycombinator.com/item?id=36361915
It's possible noscript saved me, but I'm not 100% sure. Sometimes the page has a bug where it won't work without the external JS loaded, and you are forced to load it. My bank recently added a login requirement for some external JS from a site called "launch darkly", which I know very little about.
Can we sue these entities to make them stop this shit? Should be illegal to load external JS on sensitive sites.
Then report on how the data was shared and force each entity receiving the data to delete it as well.
Start doing that, and you start solving this problem.