Nothing is certain except death, taxes … and tech companies making grabs for your data.
I know it’s hard to argue with free. But for too long, we’ve been letting free technology blind us to a really important question: How is somebody going to make money from this? In Silicon Valley, an adage goes, “If the product is free, that means you’re the product.”
You probably already suspected that products such as Intuit’s TurboTax and H&R Block offer limited free service as bait to sell you fancier paid services. Then there are a dozen free, no-upsell services run pro bono by the tax-prep industry — but only for people who earn less than $66,000 per year. (Dubbed “Free File,” these services are often buried; you can find them linked directly on the Internal Revenue Service website.)
A third kind of free tax prep, offered by Credit Karma, is blazing a new path: paying with your privacy. Available since 2017, Credit Karma Tax is an extension of the credit score website that’s already used by 85 million people. The tax service is really free — even if you use complicated IRS forms. It makes money by showing you tailored “offers” for credit cards and loans based on a profile of your financial life, which includes your tax returns unless you adjust a setting to opt out.
It’s a bold grab for personal data. It’s entirely legal. And it’s already inspiring other free services that want to target advertising using tax data.
Credit to Credit Karma’s CEO Kenneth Lin: He spoke openly with me about his business. One reason Credit Karma got into the tax game, he said, is because it rounds out the data it needs to determine when customers might be eligible for, say, a new personal loan. Credit Karma can make between tens and hundreds of dollars each time someone accepts one of its loan or card offers — and the more accurately it can target us, the more money it makes.
“We're gathering information on behalf of the users,” he told me. “We help consumers find the very best financial services products leveraging the information algorithms on our site.” As Forbes once described Credit Karma, it’s Big Brother with benefits.
There’s a fine line between useful and creepy with surveillance. For some, Credit Karma’s offers might be acceptable, even time- and money-saving. To me, Credit Karma Tax is taking a business idea that hasn’t worked out well for us with Facebook and applying it to even more sensitive information.
To really understand what free costs, you have to follow the data.
Show me the data
Taped on my desk are four questions I’ve learned to ask any business that wants my data:
1. What information is being used?
2. Who is it being shared with?
3. How secure is it?
4. How long are they holding on to it?
They bring some clarity to the exchange we make with Credit Karma for free tax prep.
It uses perhaps the most intimate personal data outside of health records. No one needs reminding of that — President Trump has gone to great lengths to keep his taxes private. While credit bureaus and data brokers already collect information about your finances, some details are hard for that industry to come by, such as your cash flow, mortgage deduction and savings yield.
Today, Credit Karma says it is using income data from customer tax forms to inform its personal loan business. It isn’t, so far, using information like who’s about to get a big refund or bill — but Credit Karma also hasn’t imposed any limits on tax return data it could use in the future.
You do get the opportunity to opt out of syncing up your tax returns with the other data the company uses to target ads. Credit Karma won’t say how many people choose to opt out, and its software doesn’t present it as a choice about privacy.
So who does Credit Karma share your data with? “We don’t sell data. We don’t broker data. We don’t work with hedge funds. We’re squarely focused on creating a great user experience and being a trusted adviser,” Lin said. This is required, in part, by law. The IRS forbids tax preparers from selling or sharing taxpayer data without express consent.
Credit Karma, like Facebook, doesn’t need to sell data to make money. Its business is selling access to you through highly targeted offers on its website, which provides advice on how you can improve your credit. Marketers waste money mailing card offers that we don’t want or can’t get approved for and have flocked to advertise with Credit Karma instead.
Lin disagreed with my Facebook comparison. “We're not letting advertisers target you. What we’re actually doing is finding the products you are eligible for in the financial services market,” he said.
Credit Karma is not doing some of the things we’ve come to dislike about Facebook. It doesn’t have a system for third parties to access data, and advertisers have no way of retaining your data (unless you permit Credit Karma to pre-fill a loan or credit card application for you). Credit Karma is doing the things lots of other Internet companies do — just with a much more sensitive type of data.
How secure is your tax data with Credit Karma? In 2014, before it had a tax service, Credit Karma did get in trouble with the Federal Trade Commission for not securing its app, potentially putting credit card details and Social Security numbers at risk. It says it has fixed that now, offers security protections like two-factor authentication and pays ethical hackers to look for flaws. Credit Karma says it hasn’t ever suffered a data breach.
Better hope it stays that way. When you consent to sync up your tax return in its marketing system, you give Credit Karma the legal right to use the data for 10 years. That’s forever for a start-up, during which time management could decide on new uses for your data. If you decide to shut your account, the company says it can take up to two years to delete your data entirely, because of regulatory requirements.
Paying in privacy
That’s what you’re giving up. Is it worth it?
Assuming you don’t qualify for one of the Free File services, doing taxes online might cost $50 to $150.
My privacy is worth more than that, especially given the open-ended and long-term potential uses Credit Karma has for my tax data.
“Being able to file your taxes in a safe and easy way is a good value proposition,” Lin said.
You could use Credit Karma Tax and click that opt-out box. But Lin says that pulling all your data into one place is a big part of the site’s value. “If financial services companies are going to be leveraging this information, let us tell you how you can get ahead in that system,” he said.
People who use the offers picked by Credit Karma’s systems not only get better rates, he said, but end up doing less damage to their credit scores by applying for financial products they can’t get.
Those arguments make some sense when it comes to bringing transparency and control over the shadowy world of credit reports. But why add tax returns to tech company dossiers on us? The solution to a world where too much data is being collected is not more surveillance.
Silicon Valley is taking inspiration from Credit Karma’s model. When TurboTax users finish doing their taxes, some now get a prompt to import their data into a sister site named Turbo, launched in 2018. Run by Intuit independently from its tax prep software, Turbo also uses financial data to generate personalized advice and offers for credit cards and loans. (Sharing tax data is not a requirement to use any of TurboTax’s free services.)
Credit Karma is more upfront than many other data companies about how it makes money from our information. Its website has a page illustrating its business model, though it doesn’t tie it to the free tax prep.
There’s more than just an individual privacy concern at stake.
“This is the pay-for-privacy model,” says Adam Schwartz of the Electronic Frontier Foundation, a digital rights group in San Francisco. “I’m very concerned about us moving into a society of haves and have-nots.”
Free can have all sorts of hidden costs.
Read more tech advice and analysis from Geoffrey A. Fowler:
