Connecticut’s Attorney General settled with TaxAct on 19 August 2026 over Meta and Google tags that sent taxpayers’ financial details to both companies. The $275,000 payment is the small part. The settlement also requires four controls: a review committee that approves any new tracker or change to an existing one, written records of every data point each tracker collects, a tag-monitoring system that regularly scans the site, and two independent audits. That is a regulator writing down what “governing your tags” means — and it is a usable checklist for any site, regulated or not.
What happened
According to the Attorney General’s announcement, between January 2018 and December 2022 TaxAct “used third-party tracking technologies through Meta and Google for internal data analytics and marketing”, and through them disclosed “rounded adjusted gross income, rounded tax refunds and/or taxes owed, and certain types of income and deductions” — including number of dependents, charitable contributions, investment income and mortgage or student-loan interest. Two details stand out. “TaxAct’s contract with Meta provided no limit on Meta’s ability to use the data for its own purposes”, and “TaxAct did not inform taxpayers before sharing their information.”
None of that required a bug. Tags configured to capture form fields or page events will send whatever the page contains. On a tax-preparation flow, the page contains tax data.
What the settlement requires
We have not seen the settlement document itself; this is the Attorney General’s description of its terms.
- A review committee and written procedures “to govern and approve the use of any new third-party tracking technologies or changes to existing tracking”. Adding a tag, or changing what an existing one captures, becomes a decision someone signs off — not a marketing-team edit in Tag Manager.
- Data documentation “recording data points tracked by third-party technologies”. Not a list of vendors: a list of what each one receives.
- A tag-monitoring system “that will regularly scan the company’s website to ensure third-party technologies are functioning as approved”. Approval on paper is not enough; the live site is checked against it.
- Two independent third-party audits of the tracking compliance program.
Using it as a checklist
The four controls map onto things any site can do without a settlement forcing it.
- Inventory by data point, not by vendor. For each tag, write down the parameters it sends on each type of page — URL, page title, form values, custom events, user IDs. Our guide to reading what a tag sends in the network tab is the manual way; attributing cookies to scripts covers the storage side.
- Put a gate in front of new tags. Treat a new pixel like a code change. The consent you collected may not even cover it — see whether existing consent covers a new tracker.
- Scan the live site on a schedule, and compare what fires with what was approved. A Playwright script is a reasonable start; what matters is that it runs regularly and someone reads the result.
- Look hardest at the pages with the most sensitive URLs and forms — checkout, account, health, finance, search results. That is where both this settlement and the recent court cases found the problem.
Context
The announcement notes that TaxAct had already entered a $14.5 million class-action settlement in December 2024 over the same conduct. The state settlement adds the governance terms, which is the part that changes how a company operates. The same theme runs through the courts this year: in Doe v. Adventist, what the tags uniformly sent was the evidence that made a class action possible.
Nothing here is legal advice.
“A tag monitoring system that will regularly scan the company’s website” is what CookieInspector does. Scan your site and see which third parties receive what.