The Federal Trade Commission (FTC) has warned five tax preparation companies that they may face civil penalties for sharing confidential data from taxpayers through tracking pixels and other means.

The move from federal regulators follows an investigation by The Markup last year that found major tax prep firms sent sensitive personal and financial information to Facebook as Americans filed their taxes. The data that tax prep companies shared included information on income, filing status, refund amounts, and dependents’ college scholarship amounts. 

“Consumers trust tax preparers with sensitive information about their finances, marital status, children, and health,” Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a statement announcing the action. “Companies that violate Americans’ privacy by seeking to monetize personal data without consent can face significant financial consequences.”

The Markup’s investigation was the first to reveal publicly how major tax prep companies shared private data with Facebook. TaxAct, TaxSlayer, and H&R Block were among the companies sending the most sensitive information, The Markup found. The FTC sent notices to those companies as well as Intuit, parent company of TurboTax, and the company Ramsey Tax Solutions.

Rick Heineman, a spokesperson for Intuit, which The Markup initially found shared data like usernames and email addresses with Facebook, said in a statement that the company complies with Internal Revenue Service rules and “does not share tax return information with social media platforms for marketing or any other purpose.” None of the other tax prep companies the received notices immediately responded to a request for comment. A spokesperson for Facebook’s parent company, Meta, declined to comment.

The data was sent to Facebook and Meta through a tool called the Meta Pixel. The pixel is a widely used snippet of code that gathers and transmits information as people browse the internet. Businesses that include the pixel on websites can track visitors for advertising purposes, and Meta can use the gathered data to power its algorithms. 

The Markup’s investigation led to a congressional report that found the companies had acted recklessly in their sharing of data and also to calls from federal lawmakers for regulators to take action. The FTC’s notice is the first public move from federal regulators on the issue since the article’s publication. The commission unanimously voted 3–0 to use its authority to send the notices.

A spokesperson for the agency did not respond to questions about what specifically spurred the action. But letters to the companies, copies of which the FTC posted publicly, specifically note that “tracking technologies such as pixels” and other means of gathering digital information could lead to financial penalties if consumers reasonably believe their information should have been kept confidential.

Those penalties, the letters go on to say, could cost companies more than $50,000 per violation. The tax prep companies highlighted by The Markup’s investigation, which are used by millions of customers every year, employed the pixel for an unknown period of time.

“We are aware of information suggesting that you have engaged in or are engaging in deceptive or unfair conduct,” the letters to the companies state. “You should take prompt action, including by reviewing all your practices, to ensure any deceptive or unlawful claims cease and are removed or corrected, as appropriate, and any other required disclosures are made.”