Cybersecurity Policy Report, Tax Preparer Settles With Connecticut AG in Data-Sharing Case, (Aug 24, 2026)
Organizations Mentioned:Wintherix, LLC
By Tony Foley
Connecticut Attorney General William Tong (D.) has announced a settlement with tax preparation firm TaxAct over the company’s improper release of sensitive taxpayer data to Meta Platforms, Inc., and Google LLC.
In a press release Aug. 19 announcing the settlement, AG Tong said an investigation by his office revealed that, between January 2018 and December 2022, TaxAct used third-party tracking technologies through Meta and Google for internal data analytics and marketing. The AG found that TaxAct improperly disclosed detailed financial information about its customers, including rounded adjusted gross income, rounded tax refunds or taxes owed, and certain types of income and deductions, including numbers of dependents and whether the customers made charitable contributions, had investment income, or had mortgage or student debt.
The AG maintained that TaxAct’s contract with Meta provided no limit on Meta’s use of the data for its own purposes or to share the data with other third parties. TaxAct further did not inform taxpayers before sharing the information, instead promising in its privacy notices to safeguard consumer privacy and to prohibit third parties from sharing TaxAct data.
“Taxpayers trusted TaxAct with their most sensitive financial records for one specific purpose—to prepare their tax returns,” AG Tong said. “Behind the scenes, our investigation showed that TaxAct abused that trust and allowed Meta and Google access to sensitive taxpayer data. This was a breach of trust that could have exposed taxpayers to potential scams and financial harm.”
The settlement requires TaxAct to pay $275,000 to the state and comply with new third-party tracking terms, including the creation of a review committee and written policies and procedures to govern and approve the use of any third-party tracking technologies or changes to existing tracking. TaxAct also must develop documentation recording data points tracked by third-party technologies and a tag monitoring system that will regularly scan the company’s website to ensure that they are functioning as approved. Finally, TaxAct must obtain two independent audits of its third-party tracking compliance program.
News: StateLegislation LitigationEnforcement DataPrivacy