Review finds problems with disclosure statements for tax software

The consent and disclosure statements for the use of taxpayer information used by tax software providers do not fully comply with regulations governing the disclosure of taxpayer information, according to a recent report by the Treasury Inspector General for Tax Administration (TIGTA). The agency reviewed the disclosure statements used by four tax software providers and found they did not explain the reasons taxpayer information would be provided to third parties or the identity of the parties receiving the information collected.

TIGTA did not name the software providers using the disclosure statements it reviewed, stating only that it “judgmentally selected four tax software companies.” Therefore, it is not known whether any of the providers were among those alleged in a November 2022 report to have shared sensitive taxpayer data.

The TIGTA review also found the IRS did not know the scope of the information disclosed to third parties through the websites of online tax software providers, including instances where the disclosures were made with the taxpayer’s consent.

Treasury Regulation §301.7216 states that tax return information can’t be used or disclosed except as specifically permitted or when the taxpayer consents. Revenue Procedure 2013-14 requires online tax software providers to comply with the regulations. However, §301.7216’s requirement that the disclosure list its purpose, and the specific recipients of the information, was not included in the revenue procedure. TIGTA found that the revenue procedure’s lack of information regarding the purpose of the disclosure and specific recipients could have resulted in the software providers’ disclosure statements missing that information.

IRS has not addressed the use of ‘pixels’

The 2022 investigative report found the websites of TaxSlayer, H&R Block and TaxAct were sharing sensitive taxpayer data with Meta (Facebook’s parent company) and Google. It was determined that the websites of the three companies used computer code that is known as “pixels,” which sends data to Meta and Google. While the TIGTA report discussed the use of pixels in the web pages of four tax software providers, it did not mention whether the disclosure statements it reviewed were used by any of the providers accused of sharing sensitive taxpayer information.

TIGTA found the IRS does not require tax software providers to disclose their use of pixel technology. It explained that neither treasury regulations nor revenue procedures specifically address how providers use pixels when taxpayers consent to the disclosure of their information. TIGTA called upon the IRS to increase the awareness of the use of pixel technology, which could help taxpayer to understand how their tax information may be used and disclosed and deter companies from using the technology without appropriate taxpayer consent.

TIGTA found that software providers can disclose their use of specific tools used to collect data, such as pixels, through their privacy or user agreements. However, the documents are “scattered throughout” the consent process, making it difficult to understand and for the taxpayer to provide full and accurate consent.

No IRS process for consent violations

When a tax return preparer is accepted into the IRS’s authorized e-file provider program, they are informed of their obligations to safeguard taxpayer data. It is the responsibility of the authorized e-file provider to comply with program requirements by doing things like complying with the requirements for taxpayer consent statements.

When a taxpayer completes a return using an online provider’s website, all the information collected during the process is through the website. This includes all the information necessary to complete the tax returns. The collected information is protected under §7216 because it was furnished in the preparation of a tax return. When the taxpayer completes their return and authorizes its filing, the online provider transmits it to the IRS. The online provider is not required to provide any details regarding the collected information beyond what was included in the tax return, the extent to which any data was shared with third parties and whether taxpayers provided consent to share their data with third parties.

TIGTA found that the IRS does not have a process in place to ensure that the consent statements of online providers are compliant with the requirement of either Revenue Procedure 2013-14 or Treasury Regulation §301.7216-3. It also determined that the IRS is not aware of the full scope of information routinely collected by online providers beyond what is filed with the IRS or what is shared with third parties.

When questioned as to why the IRS did not know the full scope of the taxpayer information collected, agency officials said TIGTA’s Office of Investigations has investigative responsibility over potential violations of §7216 under an agreement between TIGTA and the IRS’s office of criminal investigations. TIGTA noted that the agreement only addresses situations where the potential violation rises to a level that warrants criminal investigations and not those in which a provider has not complied with IRS regulations on consent statements. It explained that Congress has delegated responsibility for administering the tax laws to the IRS, therefore that agency is responsible for establishing processes and controls to ensure compliance with the tax code.