The Attorney General said that from January 2018 to December 2022, tracking technologies on TaxAct’s site sent Meta and Google financial details such as rounded adjusted gross income and refund amounts, and customers were not told. TaxAct agreed to pay $275,000. It must also set up a committee to approve third-party trackers, write tracking policies, run a tag-monitoring system that scans the site regularly, and obtain two independent audits.
On 19 August 2026, Connecticut Attorney General William Tong announced a settlement with TaxAct, the online tax preparation service. TaxAct agreed to pay $275,000 to the state and to change how it governs the tracking tools on its website.
According to the Attorney General, between January 2018 and December 2022 TaxAct used third-party tracking technologies from Meta and Google for analytics and marketing. The state said these tools passed details from customers' tax returns to both companies: rounded adjusted gross income, rounded refunds or taxes owed, and some income and deduction details, such as the number of dependents, charitable contributions, investment income, and mortgage or student loan interest. It said TaxAct did not tell taxpayers before sharing their information, that its privacy notices promised to protect their privacy, and that its contract with Meta put no limit on Meta using the data for its own purposes or passing it on.
Beyond the payment, TaxAct agreed to a set of safeguards. A review committee and written policies must approve any new tracking technology, or any change to an existing one. The company must document the data points each tracker collects, run a tag monitoring system that regularly scans its website to confirm each tool works as approved, and obtain two independent audits of the program. The Attorney General said TaxAct, now under new ownership, cooperated with the investigation. The release also notes that in December 2024 TaxAct agreed to a $14.5 million class settlement for affected taxpayers.
There was no hack in this case. The data left through ordinary analytics and advertising tags, placed on pages where people enter some of the most sensitive figures they have.
It follows an earlier case on the same theme. In 2023, GoodRx agreed to pay $1.5 million after the Federal Trade Commission alleged that it shared prescription and health details with Facebook, Google and other advertisers, despite promising not to.
The questions are the same for any site that handles financial or other sensitive details: which tags load on the sign-in, form and payment pages, what those tags send and to whom, who approved each one, and whether anyone checks that they still behave the way they did when they were approved.
Why it matters for your siteEvery tag on a page that handles sensitive data needs an owner, an approval step and continuous scanning.
The transcript
Two hundred seventy-five thousand dollars. That's what TaxAct, the online tax filing service, agreed to pay the state of Connecticut. It settled with Attorney General William Tong in August 2026, over the tracking code on its website.
So what was it accused of? The Attorney General said that from January 2018 to December 2022, tracking tools from Meta and Google on TaxAct's site sent those companies details from people's tax returns. Rounded income. Rounded refunds, or taxes owed.
It didn't stop there. The state said the details also covered the number of dependents, gifts to charity, investment income and loan interest. It said customers were not told before their information was shared, and that TaxAct's contract with Meta put no limit on what Meta could do with it.
And what did it pay? Two hundred seventy-five thousand dollars to the state. And more than the money: a committee that must approve every new tracker, written tracking policies, a record of what each tracker collects, a tag monitoring system that scans the site regularly, and two independent audits. The state said TaxAct, now under new ownership, cooperated.
Notice what this was not. No hacker. No stolen records. Just analytics and ad tags, on the pages where people file their taxes.
And it's not alone. TaxAct had already agreed to a fourteen and a half million dollar class settlement in 2024. And in 2023, GoodRx agreed to pay one and a half million dollars, after the Federal Trade Commission alleged it shared prescription and health details with Facebook, Google and other advertisers, despite promising not to.
This order spells out what the state now expects: every tag approved, recorded and scanned. Most sites can't say which tags fire on their sign-in and payment pages, or what those tags send.
That's what Tolbrook checks. We go through your site the way a shopper would, and show you what we find, with the evidence.
Read our sector reviews at tolbrook dot com slash reports. Find it. Fix it. Watch it.
Each summary is ours, drawn from the public announcement it links to. Allegations are the regulator’s own, and a settlement usually comes without any admission. This page reports what was announced. It is not legal advice, and it says nothing about any site we audit.
Find these problems before anyone else does
The digital compliance problems behind actions like these are the ones we look for. We find them on your site and show you exactly where each one sits.