On August 19, 2026, the Connecticut Attorney General took $275,000 from TaxAct to resolve claims that tracking code on the company’s website sent customer data to Meta and Google from January 2018 through December 2022. The data covered adjusted gross income and refund or balance-due figures (both rounded), number of dependents, and flags for charitable gifts, investment income, mortgage interest, and student loan interest. Advertising code sent them automatically while people filled in their returns.
That is a Connecticut case, but the law that matters most is federal, and California layers its own privacy statutes and an aggressive wiretap law on top.
What did Connecticut find TaxAct was doing with taxpayer data?
According to the state, TaxAct’s contract with Meta placed no limit on what Meta could do with the data, despite a privacy notice promising to bar third parties from sharing it. TaxAct must create a review committee for tracking technology, inventory every data point each tag collects, scan the live site for unapproved tags, and submit to two independent audits.
TaxAct had already paid once. A nationwide class action, Smith-Washington v. TaxAct, Inc., No. 3:23-cv-00830 (N.D. Cal.), received final settlement approval on December 30, 2024, with a larger share for a California subclass. And in September 2023 the Federal Trade Commission warned five tax preparation companies that pixel-based sharing of tax data for advertising without express consent could draw civil penalties of up to $50,120 per violation.
Does federal law already forbid a preparer from sharing your return data?
Yes. 26 U.S.C. § 7216 makes it a misdemeanor for anyone who prepares returns, or provides services connected to preparing them, to knowingly or recklessly disclose return information or use it for any purpose other than preparing the return. The penalty is a fine of up to $1,000 ($100,000 where identity theft is involved) and up to one year in prison. The civil companion, 26 U.S.C. § 6713, imposes $250 per improper disclosure, capped at $10,000 per calendar year, and requires no intent.
The regulations reach software companies. Treas. Reg. § 301.7216-1 defines a tax return preparer to include “a person who develops software that is used to prepare or file a tax return,” and tax return information as anything furnished in connection with a return. Treas. Reg. § 301.7216-2 lists the disclosures that need no consent: to the IRS, under a court order, within the same U.S. firm, to a processing vendor, and for software maintenance. Advertising partners are not on the list.
What does a valid § 7216 consent look like, and how is it different from Form 8879?
Form 8879 is the e-file signature authorization and says nothing about marketing. A § 7216 consent is a separate document, and Treas. Reg. § 301.7216-3 requires it to be knowing and voluntary, signed before any disclosure, and never a condition of getting your return prepared. If silent on duration, it lasts one year. For Form 1040 filers, Rev. Proc. 2013-14 adds mandatory formatting: 12-point type, a statement that federal law requires the form, a statement that you need not sign it to receive services, and contact information for the Treasury Inspector General for Tax Administration. An electronic consent requires a typed name or PIN, not a clicked box.
How does California’s own law reach tax preparers and their websites?
Under Bus. & Prof. Code § 22250 et seq., a paid preparer who is not a California CPA, an active State Bar member, or an enrolled agent (the § 22258 exemptions) must register with the California Tax Education Council and post a bond, and § 22253 requires preparers to return client records on demand.
The California Consumer Privacy Act, Civ. Code § 1798.100 et seq., applies only to a business with annual gross revenue above $26,625,000 (the 2025 adjusted figure), personal information of 100,000 or more consumers, or half its revenue from selling or sharing data. TaxAct clears that bar; a Rancho Cucamonga CPA firm does not. For covered businesses, § 1798.140 treats Social Security numbers and financial account credentials as “sensitive personal information,” and § 1798.121 lets consumers limit its use to what the service requires. Watch § 1798.145(e), which exempts information handled subject to the Gramm-Leach-Bliley Act. It covers the data, not the company, so website analytics stay in play.
Enforcement is active: on July 1, 2025, the Attorney General collected $1.55 million from Healthline for sharing data with advertising partners after users opted out.
Why should an Inland Empire business with a Meta Pixel care about CIPA?
Because the California Invasion of Privacy Act is privately enforced. Penal Code § 631 penalizes reading a communication in transit without all-party consent, and § 637.2 allows $5,000 per violation without proof of actual damages. The Ninth Circuit held in Javier v. Assurance IQ, LLC, No. 21-16351 (9th Cir. May 31, 2022) (unpublished), that § 631 requires consent before recording starts, so a banner that appears after the pixel fires does not cure the problem.
A second theory used § 638.51, the pen register statute. SB 690, passed by the Legislature on August 28, 2026 and awaiting the Governor’s action by September 30, would end private § 638.51 suits over website tracking, retroactive to actions filed on or after January 1, 2025. Section 631 claims are untouched.
What happened to the Sacramento dental practice whose bookkeeper’s portal used a pixel?
Consider a two-dentist practice in Sacramento’s Pocket neighborhood with $1.9 million in annual collections. Its outside bookkeeper hosts a portal, live since February 2024, where the practice uploads its Form 1120-S workpapers and the bookkeeper posts a projected balance due each March. In August 2026 the office manager noticed that every portal page fired a Meta Pixel whose transmitted URLs included the form type and a rounded balance-due figure.
The bookkeeper serves 320 business clients on the same portal. Under § 6713 the penalty is $250 per disclosure but capped at $10,000 per year, so three filing seasons produce a $30,000 ceiling. Criminal exposure under § 7216 turns on whether installing the pixel blind was reckless. The bigger number is CIPA: 320 clients at $5,000 each is $1.6 million, and the practice is a potential plaintiff, not a defendant. The CCPA is irrelevant at the bookkeeper’s revenue. The practice should demand its records, stop uploading until the tag is gone, and check its own website.
| Authority | Who enforces it | Who it reaches | Exposure |
|---|---|---|---|
| 26 U.S.C. § 7216 | Department of Justice | Preparers and software providers | Misdemeanor, up to 1 year |
| 26 U.S.C. § 6713 | IRS | Preparers and software providers | $250 per disclosure, $10,000 yearly cap |
| CCPA, Civ. Code § 1798.100 et seq. | California AG and CPPA | Businesses over $26.6 million revenue or 100,000 consumers | Up to $7,988 per intentional violation |
| CIPA, Penal Code § 631 | Private plaintiffs | Any website operator | $5,000 per violation, no actual damages needed |
| Bus. & Prof. Code § 22250 et seq. | CTEC and the Attorney General | Non-exempt paid preparers | Registration, bond, records duties |
What can a California taxpayer do if a preparer or software company leaked their data?
Preserve the evidence first: the privacy notice as it read, any consent you signed, and the browser report showing the tag. Then file Form 14157, the IRS return preparer complaint, now routed through the IRS online tip portal, and report the disclosure to TIGTA. If the company is a CCPA business, complain to the Attorney General or the Privacy Protection Agency and exercise your deletion and limit rights in writing. Then ask counsel whether a CIPA claim fits your facts. On prevention, read the consent screens in tax software, decline sharing with partners, and ask your preparer in writing whether any pixel runs on the portal where your documents live.
Frequently Asked Questions
Is it illegal for a tax preparer to share my tax return information with advertisers?
Not without a valid written consent. 26 U.S.C. § 7216 makes knowing or reckless disclosure of return information a federal misdemeanor, and § 6713 adds a $250 civil penalty per disclosure. Both rules reach companies that develop tax software.
Does signing Form 8879 give my preparer permission to use my data for marketing?
No. Form 8879 only authorizes electronic filing. Any other use or disclosure of your information requires a separate consent under Treas. Reg. § 301.7216-3, signed before the disclosure happens, and a preparer cannot make it a condition of doing your return.
Does the CCPA protect my tax data in California?
Only partly. The CCPA applies to businesses with more than about $26.6 million in annual revenue or data on 100,000 or more consumers, so large software companies are covered but most local preparers are not. It also exempts information handled under the Gramm-Leach-Bliley Act, though website analytics usually fall outside that exemption.
Can my business be sued for having a Meta Pixel on its website in California?
It can. Plaintiffs have filed thousands of suits under Penal Code § 631 alleging that a pixel intercepts visitor communications without prior consent, and § 637.2 allows $5,000 per violation without proof of harm. SB 690, passed in August 2026, would end private pen register suits but leaves § 631 claims in place.
How do I report a tax preparer who disclosed my information without consent?
File Form 14157, the return preparer complaint, through the IRS online tip portal, and report the disclosure to the Treasury Inspector General for Tax Administration. A registered preparer can also be reported to CTEC, and a large software company to the California Attorney General or the Privacy Protection Agency.
Do CPAs and attorneys in California have to register with CTEC?
No. Bus. & Prof. Code § 22258 exempts CPAs licensed by the California Board of Accountancy, active State Bar members, IRS enrolled agents, and certain regulated financial institutions. Everyone else who prepares returns for a fee must register with CTEC, post a bond, and complete annual education.
How North Star Law Firm Can Help
North Star Law Firm advises California taxpayers and business owners on who may see their tax information, including § 7216 consent reviews, disputes with preparers and software vendors over unauthorized disclosures, and the exposure a company website or client portal creates under the CCPA and the California Invasion of Privacy Act. Phillip Zagotti is a California attorney and a CPA, and he sees these questions from both sides: what a preparer must do and what a client may demand. The firm’s tax law and tax defense practices cover IRS and FTB matters, and its contract drafting and review work handles vendor agreements with bookkeepers and marketing agencies that touch client data.
If you have found tracking code on a preparer’s portal, received a consent form you do not understand, or want your own website checked before a demand letter arrives, contact North Star Law Firm or schedule a consultation.