CRIMINAL CAPITALI$M
Lawsuit claims H&R Block, Meta, Google used spyware to illegally share consumers' financial data

Alexis Keenan
·Reporter
Wed, September 27, 2023

Google (GOOG, GOOGL), Meta (META), and H&R Block (HRB) are facing a proposed class-action lawsuit alleging they illegally coordinated to use spyware to collect and share taxpayers’ sensitive financial information.

A similar lawsuit was brought against Google and H&R Block in July, on the heels of a congressional investigation into a data collection technology known as "tracking pixels" used to generate lucrative targeted ads. The case alleges the companies conspired to collect and exploit data on hundreds of H&R Block customers without their consent.

Tracking pixels operate quietly in the background of millions of websites, some tracking visitors’ entries in real time. Companies like H&R Block that handle entries containing sensitive financial information are required by law to refrain from sharing that data with third parties unless they’ve obtained their customers' consent.

Accounting offices of H&R Block in New York. (Newscast/Universal Images Group via Getty Images)

According to the suit, H&R Block tried to circumvent federal racketeering and other laws by misleading consumers using vague language in their customer consent agreements and programming agreements with Meta and Google. Meta and Google for their part, the plaintiffs claim, conspired with H&R Block and misled consumers about the types of information that website developers like H&R Block could access.

“Defendants knew that by concealing their involvement with one another … [they] could acquire and share [personal tax data] in contravention of the law for defendants’ own financial gains,” the complaint states.

Google spokesperson José Castañeda said in a statement that the company has "strict policies and technical features that prohibit Google Analytics customers from collecting data that could be used to identify an individual."

"Site owners - not Google - are in control of what information they collect and must inform their users of how it will be used. Additionally, Google has strict policies against advertising to people based on sensitive information,” the statement said.

H&R Block and Meta did not immediately respond to Yahoo Finance's request for comment.

Data scooped up in the alleged operation included taxpayers' names, Social Security numbers, addresses, adjusted gross incomes, filing statuses, refund amounts, deductions, dependents, income properties, birthdates, health savings account contributions, education expenses, and other information in their prepared returns.

The complaint filed in US District Court for the Northern District of California alleges the companies also violated federal privacy and wiretapping laws, and the Internal Revenue Code.

"The suit seeks to hold the three firms accountable for using pixels that tracked virtually all information submitted by customers through HRBlock.com,” lawyers for the plaintiffs said. The group is seeking an injunction to stop the companies from collecting the sensitive information using pixels, as well as punitive damages, and to disgorge the defendants of value gained from their use.

Meta’s pixels

In their complaint the plaintiffs said H&R Block illegally deployed Meta’s Pixel software, which tracks in real time the information that tax preparers enter into their online tax preparation portal. Every H&R block online tax software user, they said, is assigned a unique digital identifier that allows the spyware to track their activity both on the H&R Block website, and on every other website they visit containing Meta Pixel.

For example, when an H&R Block customer logs into Meta's Facebook or Instagram, their unique identifier is delivered to the user’s device with a “dossier” containing the user’s online activities. The technology, the suit says, allows Meta to provide its marketing partners with "deep insights" into the user’s online activities.

Google's pixels

Google’s separate pixel system, Google Analytics, which is installed on H&R Block and more than 70% of online websites, the plaintiffs say, allows companies that are less tech savvy to collect and send back to Google default user information, such as a user’s closest city, gender, and general interests. For more sophisticated companies like H&R Block, they allege, Google offers another pixel product, Google Tag, that collects more intimate details about a web page visitor.

According to the complaint, H&R Block illegally collected and sent to Google taxpayers’ names and certain health savings account contribution information, as well as their inquiries on H&R Block into scholarships, and education expenses, and visits to web pages related to dependents, certain types of income, and certain tax credits or reductions.

The plaintiffs say e-commerce industry players like H&R Block, Meta, and Google understand that the type of highly sensitive personal financial data such as the data entered into H&R Block’s site is a form of currency.

In 2022, Meta’s annual advertising revenue of $113.6 billion made up almost all of the company’s total revenue of more than $116 billion.

Google's search advertising generated more than $160 billion in revenue for Google in 2022. That's more than half of the company's $280 billion in total revenue for the year.

Alexis Keenan is a legal reporter for Yahoo Finance. Follow Alexis on Twitter @alexiskweed.