FTC Warns Five Tax Prep Giants About Possible Fines for Misusing Client Data

Companies could face thousands of dollars in fines for using clients’ confidential data for purposes other than tax preparation.

The Federal Trade Commission (FTC) said on Sept. 18 it warned five tax preparation companies that they could face thousands of dollars in fines for using clients’ confidential data for purposes other than tax preparation, such as advertising.

According to an FTC document, the five tax prep companies that were warned are:

• H&R Block

• Intuit

• TaxAct

• Tax Slayer

• The Lampo Group LLC d/b/a Ramsey Solutions

“Consumers trust tax preparers with sensitive information about their finances, marital status, children, and health,” Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a press release. “Companies that violate American’s privacy by seeking to monetize personal data without consent can face significant financial consequences.”

The FTC said it is using its penalty offense authority to seek civil penalties against a company that engages in conduct that it knows is unlawful, and that has been found unlawful in a previous FTC administrative order, other than a consent order.

Each of the five tax preparation companies received a notice of penalty offenses, according to the FTC, which warns the firms that they could incur civil penalties of up to $50,120 per violation if they misuse personal data in ways that run counter to the original purpose for which this information was collected.

“In order to use information collected in a confidential context for purposes other than those explicitly requested by the individual (including to obtain a separate financial benefit or for advertising purposes), you and your company must obtain affirmative express consent from the individual,” the notice states. “Affirmative express consent means a freely given, specific, informed, and unambiguous indication of an individual’s wishes via a separate agreement.”

The notices further warn that it is unlawful to make false, misleading, or deceptive representations concerning the use or confidentiality of such information. The FTC specifically warned the companies that it considers it an unfair or deceptive practice to use tracking technologies, such as pixels, cookies, APIs, or SDKs, to amass, analyze, infer, or transfer personal information without first obtaining consumers’ express consent.

“We are aware of information suggesting that you have engaged in or are engaging in deceptive or unfair conduct,” the notice states. “You should take prompt action, including by reviewing all your practices, to ensure any deceptive or unlawful claims cease and are removed or corrected, as appropriate, and any other required disclosures are made.”