Cross-Product Data Sharing Within Intuit Family

What it is

Information you enter into TurboTax can be shared with other Intuit products like Credit Karma and used to recommend financial products or show you targeted offers across the Intuit ecosystem.

Why it matters (compliance & governance perspective)

Tax data is among the most sensitive personal information people share digitally, and this clause permits it to flow into advertising and product recommendation systems beyond the original tax-filing purpose.

Consumer impact (what this means for users)

Your Social Security number, income figures, and financial account information entered for tax filing purposes may be used by Credit Karma to recommend loans, credit cards, or other financial products, and to personalize marketing you receive across Intuit platforms.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision implicates the Gramm-Leach-Bliley Act, which restricts how nonpublic personal financial information collected by financial institutions may be shared and used, with the FTC as primary enforcement authority for non-bank entities. The CCPA and CPRA also apply to California residents, requiring disclosure and opt-out rights for sharing personal information with affiliated entities for cross-context behavioral advertising. GDPR Article 5 purpose limitation principles are engaged for EU users, as secondary use of tax data for marketing may require a separate lawful basis beyond the original processing consent. GOVERNANCE EXPOSURE: High. The movement of tax-derived sensitive financial data into advertising and recommendation pipelines crosses product contexts in ways that may not satisfy GLBA's privacy notice and opt-out framework or CCPA's sensitive personal information protections. The FTC has historically scrutinized data repurposing practices where consumer reasonable expectations were not met. JURISDICTION FLAGS: California residents have heightened protections under CPRA for sensitive personal information, which includes Social Security numbers and financial account data, and may be entitled to limit the use of such data. EU and UK users are protected by GDPR and UK GDPR purpose limitation requirements. Illinois and other states with comprehensive privacy laws may also constrain this sharing. CONTRACT AND VENDOR IMPLICATIONS: Internal data sharing agreements between Intuit subsidiaries should be reviewed to ensure they satisfy applicable affiliate sharing limitations under GLBA and state privacy laws. B2B clients using QuickBooks or other Intuit products should assess whether their employees' or customers' data could be implicated by this cross-product sharing framework. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the consent mechanisms used to authorize cross-product data sharing, verify that GLBA-required privacy notices and opt-out mechanisms are current and operational, and assess whether CCPA sensitive personal information processing restrictions require additional user controls beyond current disclosures.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Collection of Sensitive Financial and Tax Data medium
• Third-Party Analytics and Advertising Partner Data Sharing medium
• California Resident Privacy Rights low
• Data Retention Policy medium
• EU and UK User Data Transfers low
• Use of Data for Personalization and Product Improvement medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.