You agreed to what? Tax sites want your data for more than filing.

“We investigate why Turbo Tax and H&R Block ask you to give up your return’s basic federal privacy protections — and explain how to demand your data back

Geoffrey A. Fowler

What do the privacy policies on tax-prep sites actually grant them permission to do with your data? (The Washington Post)

You may use Turbo Tax or H&R Block online to save money filing your taxes. But did you know that by clicking “agree” to some of their privacy prompts, you may be letting them use you?

An eagle-eyed Washington Post reader pointed me to a curious question he received while starting his taxes with H&R Block online. When you’re setting up your account — after you’ve already agreed to H&R Block’s regular privacy policy — the website asks for permission to also access your data to “optimize your H&R Block experience.”

It goes on: “If you agree to share your tax return details, after you file, we can provide many benefits.” Then it asks you to click agree to two bunches of legalese, one labeled as “personalized services” and the other as “quicker product support.”

What he discovered is a little-discussed evolution of the tax-prep software industry from mere processors of returns to profiteers of personal data. It’s the Facebook-ization of personal finance.

H&R Block asks for extra permission to use your tax returns to “optimize” your experience. What does that mean? (H&R Block)

America’s most-popular online tax-prep service, Intuit’s TurboTax, also asks you to grant it additional access to the data in your return to “enrich your financial profile, communicate with you about Intuit’s services, and provide insights to you and others.”

Say what? You already probably have a headache from thinking about taxes, now you have to parse this, too.

Here at Help Desk, we read privacy policies so you don’t have to. And then we call the lawyers who wrote them and ask them to explain themselves.

Turns out, among the reasons some tax-prep companies want to use the contents of your return is to target you with “offers” — or, as they’re more commonly known, advertisements.

Last-minute tips as the April 18 tax deadline looms

The good news is because of Internal Revenue Service rules, this is one data request you can actually say “no” to while continuing to do your taxes online. And if you already clicked “agree” and now have changed your mind, there are some steps you can take, too.

Here’s what you need to know:

America is sorely lacking privacy laws, but it does have one that prevents tax-prep companies from disclosing the contents of your tax return. For H&R Block and Intuit, that means they can’t automatically use the contents of anyone’s returns for purposes other than preparing taxes.

Both companies are asking you to grant them special permission to go beyond these default federal protections and use your return — including your income, investments and mortgage details — to help them upsell you on other things.

In addition, H&R Block also wants your permission to share some of the content of your return with two independent companies in the Philippines that help them do customer service.

What happens if you click ‘agree’?

Clicking yes for the “personalized service” or “offers” request means you’re probably going to receive marketing from H&R Block or Intuit that’s eerily specific to your financial situation.

This might come in the form of offers for financial products when you’re done with your taxes, ads on sites that belong to sister companies (like Intuit’s Mint or Credit Karma), or ads that come from these companies via email.

Both companies claim you might actually want these offers because they could save you money. For example, H&R Block says if a tax law changes that might impact your particular situation, it can reach out with advice — and probably another service to sell you. Or if your data indicates you have a very high mortgage rate, Intuit might show you an ad for where you could get a lower one.

Intuit’s prompt also claims that if you agree to share your data you’ll actually “see fewer offers overall.”

For H&R Block’s overseas data-sharing request, clicking yes means that if you call its support line you’re probably going to be connected to someone in the Philippines. It also means that should one of H&R Block’s overseas partners get breached or lose your data, you might have less recourse to take action or sue them since they’re not a U.S. company.

H&R Block told me it vets these partners, and to its knowledge they haven’t suffered from a data breach. (But it happens. We recently learned data from clients of security company Okta got breached when a customer support worker for a contractor had his computer accessed by hackers.)

Do I have choice? And can I change my mind?

You do have a choice. If you click “no” to either of these sorts of prompts, the companies will still complete your taxes.

The language in H&R Block’s policy makes it sound like they’ll charge you more for service if you decline sharing it overseas, but the company tells me that’s not the case. (You might have a longer hold time to get service, though.)

If you agreed to these requests while preparing your taxes and have now changed your mind, you can try to revoke access. But they’re going to make you jump through some hoops.

For TurboTax, you have to email privacy@intuit.com. Be sure to mention that you’d like to revoke your “consent for use of tax return information.”

H&R Block said customers would have to contact the company, but didn’t specify how.

I grade these privacy policies as a C+. And I recommend saying no to both kinds of requests.

It’s a good thing that they ask you to opt-in — that’s what America’s privacy laws ought to be requiring for lots of things. But the language these companies use is vague and doesn’t make clear what they won’t do with the content of your tax return. (H&R Block said some of the language it used was required by law.)

When I pressed, both companies told me that if you click agree they won’t sell your tax return to another company. They also told me they’re not going to crunch your financial information to sell to banks, economists or investment firms.

Another basic question these privacy policies fail to answer: If you consent, how long will they hold onto your tax return for these extra purposes? Neither company would give me a specific answer.

These companies say they’re just trying to help people solve financial challenges, but they may get more out of the data exchange than you do. Intuit, in particular, has been going deeper into a kind of business that uses our personal information as its fuel. It recently acquired Credit Karma, whose entire business model, as I’ve cautioned before, asks you to pay with your privacy for free services like credit scores.

“Your data stays inside our systems,” says Intuit spokesman Rick Heineman. (For the record, that’s also how Facebook works. It doesn’t need to sell your data to other companies, because it makes gobs of money by using your data to target ads to you itself.)

Bottom line: With data as important as your tax return, you should minimize risk. And the golden rule of privacy is, the fewer hands that can access your data, the safer you are.“