Understanding the TaxAct Settlement
Since Connecticut Attorney General William Tong announced the $275,000 TaxAct settlement in August 2026, marketing technology teams, privacy officers, and in-house counsel have been asking similar questions. The settlement is notable because it doesn't specify a violated statute, yet it requires a detailed governance program for third-party tracking. This ambiguity has left many wondering what actions led to enforcement and what controls they need to implement.
These questions arise from real discussions in compliance team meetings. The answers are based on the settlement's requirements and what they indicate about regulatory expectations.
Q1: What Law Did TaxAct Violate?
The Attorney General's announcement doesn't specify a violated statute. This is common in state AG settlements, which often use general consumer protection or unfair trade practices laws instead of specific privacy statutes.
The key issue was TaxAct's privacy notice, which promised to protect consumer privacy and not share data with third parties. However, the company allegedly shared rounded adjusted gross income, tax refunds, and details about dependents and deductions through tracking technologies. The discrepancy between their privacy promise and actual practices led to enforcement.
Your takeaway: If your privacy notice states you don't share financial data with advertising partners, ensure your Tag Manager configuration aligns with that promise.
Q2: What Constitutes "Improper Disclosure"?
The settlement claims TaxAct disclosed taxpayer information to advertising partners from January 2018 to December 2022. This included rounded financial data like adjusted gross income and tax refunds, transmitted through tracking technologies for analytics and marketing. The issue was that TaxAct's agreement with its advertising partner didn't restrict how the partner could use the data or prevent further sharing.
The lesson: Even aggregated or rounded financial data can be improper disclosure if your privacy notice says you won't share it and your vendor contracts don't limit downstream use.
Q3: Are We at Risk with Google Analytics and Meta Pixel?
Possibly. Consider these three factors:
First, the data you're transmitting. If you're sending transaction amounts, product categories, or user attributes through tracking parameters, check if these data points are listed in your privacy notice as "we do not share."
Second, your vendor agreements. The TaxAct settlement highlights the lack of contractual limits on the advertising partner's data use. Review your Data Processing Agreements with analytics and advertising vendors. Do they prohibit using your data to build their own models or selling it to data brokers?
Third, your privacy notice promises. If your notice says "we don't sell your financial information" but your Floodlight Tags are active on loan application pages, you've created the same gap that triggered this settlement.
Q4: What Does the Required "Review Committee" and "Written Policies" Entail?
The settlement mandates five governance components:
- A review committee overseeing third-party tracking technologies
- Written policies for approving new tracking technologies and modifying existing ones
- Documentation of data points collected through each tracking technology
- A tag-monitoring system to verify tracking technologies function as approved
- Two independent third-party audits of the tracking governance program
In practice, this means your marketing team can't add Container Tags without a formal review process. The "review committee" is a cross-functional group (legal, privacy, marketing ops, IT) that evaluates each new tracking request against your privacy commitments.
The "tag-monitoring system" implies using automated scanning tools to detect unauthorized tags or configuration drift. Manual audits won't suffice at scale.
Q5: How Do We Document "Data Points Collected Through Third-Party Tracking Technologies"?
This is a common challenge. You need a living inventory that maps:
- Each tracking technology deployed (Google Analytics 4, Meta Pixel, LinkedIn Insight Tag)
- The specific data elements each technology collects (page URL, transaction value, user ID type)
- The legal basis for that collection (consent, legitimate interest, contract necessity)
- Any parameters or custom events you've configured
- The vendor's contractual restrictions on data use
Your Tag Manager container export is a starting point, but it won't show what data each tag transmits or if your vendor agreement permits that transmission. Combine technical documentation with contract review.
Q6: Does This Settlement Apply to Us?
The settlement's governance requirements aren't tax-specific. They apply to any organization that:
- Makes privacy promises about limiting data sharing
- Uses third-party tracking technologies that could transmit user data
- Handles information users consider sensitive (financial, health, location, children's data)
If you're in fintech, healthcare, education, or any sector handling regulated data types, the TaxAct settlement shows what regulators expect: formal oversight, technical monitoring, vendor contract limits, and regular audits.
Even in retail or media, the principle holds. Your privacy notice creates enforceable obligations. If you promise not to share browsing behavior with advertising partners, your Consent Management Platform needs to block those tags until users grant consent.
Next Steps
Start with your current privacy notice. Read it as a regulator would, looking for absolute statements about data sharing. Then audit your Tag Manager container against those promises.
For vendor agreements, focus on two clauses: restrictions on the vendor's use of your data for its own purposes, and prohibitions on further sharing without your approval. If those clauses don't exist, you're in the same position TaxAct was.
The settlement announcement from Connecticut Attorney General William Tong's office (August 19, 2026) provides the full list of governance requirements. Use it as a compliance checklist, not just a legal curiosity.
