If you use TurboTax or other Intuit products from Europe, your data is transferred to the US under legal transfer mechanisms including Standard Contractual Clauses.
This analysis describes what TurboTax's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
International data transfers of sensitive financial data are subject to ongoing regulatory scrutiny in the EU, and the adequacy and implementation of transfer mechanisms is a live compliance area following the Schrems II ruling.
Interpretive note: The exact transfer mechanism documentation and whether Intuit is certified under the EU-US Data Privacy Framework is not confirmed from the truncated document text.
The updated privacy statement no longer describes a specific opt-out procedure for advertising cookies that was previously available. The prior version stated users could 'opt out of having your personal information used or disclosed for these purposes by sliding the toggle to No and clicking Save My Choices', but this mechanism and accompanying language are no longer present in the updated disclosure. The updated terms also no longer explicitly state that IP addresses and device identifiers may be shared with advertising partners, removing prior transparency about what data types are disclosed. You should review TurboTax's main Privacy Policy to determine if opt-out mechanisms exist elsewhere or what the current data-sharing practices are.
View change record →The updated terms now explicitly state that TurboTax and its advertising partners use cookies and tracking technologies to deliver targeted advertising on and off TurboTax sites. The policy discloses that IP addresses and device identifiers may be shared with advertising partners to show you more relevant ads, and states these practices may be considered 'targeted advertising' or 'sharing' of personal information under applicable law. You can decline third-party advertising cookies by going to 'Customize Settings,' though essential website cookies required for site functionality cannot be refused.
View change record →EU and UK TurboTax users' financial data including income and tax information is transferred to the United States, where it is subject to US law including potential government access under applicable surveillance authorities.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
Your personal information may be transferred to, stored, and processed in the United States or other countries outside of your country of residence, which may have data protection laws that are different from those in your country.
Your personal information may be transferred to, and maintained on, computers located outside of your state, province, country, or other governmental jurisdiction where the privacy laws may not be as protective as those in your jurisdiction.
Monitoring
TurboTax has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If you are located in the European Union, European Economic Area, or United Kingdom, we transfer your personal information to the United States and other countries using approved transfer mechanisms including Standard Contractual Clauses as approved by the European Commission.— Excerpt from TurboTax's TurboTax Privacy Statement
REGULATORY LANDSCAPE: International transfers of personal data from the EU and UK to the US are governed by GDPR Chapter V and the UK GDPR equivalent. The EU-US Data Privacy Framework established in 2023 provides an adequacy basis for transfers to certified US entities, but Standard Contractual Clauses remain a commonly used alternative. The Schrems II ruling by the Court of Justice of the EU requires transfer impact assessments for SCCs, and the financial sensitivity of tax data may elevate the risk profile of such assessments. GOVERNANCE EXPOSURE: Medium. The use of SCCs for US transfers is legally sound if properly implemented, but requires accompanying transfer impact assessments and supplementary measures where US government access risk is assessed as material. Supervisory authority enforcement of Chapter V has increased across EU member states. JURISDICTION FLAGS: EU and UK users are the primary affected group. The UK's adequacy regime post-Brexit operates separately from the EU framework, and Intuit's transfer mechanisms must satisfy both where users span both jurisdictions. Users in Switzerland have analogous rights under the revised Swiss Federal Act on Data Protection. CONTRACT AND VENDOR IMPLICATIONS: Intuit's use of SCCs must be accompanied by documented transfer impact assessments. Any sub-processors receiving EU user data in third countries must be covered by equivalent transfer mechanisms, and the chain of transfers through advertising and analytics partners must be mapped and documented. COMPLIANCE CONSIDERATIONS: Legal teams should verify that Intuit's SCCs are on the current European Commission-approved 2021 module versions, that transfer impact assessments are documented and updated, and that EU supervisory authority guidance on transfers of sensitive financial data has been considered in Intuit's transfer framework.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
International data transfers of sensitive financial data are subject to ongoing regulatory scrutiny in the EU, and the adequacy and implementation of transfer mechanisms is a live compliance area following the Schrems II ruling.
EU and UK TurboTax users' financial data including income and tax information is transferred to the United States, where it is subject to US law including potential government access under applicable surveillance authorities.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by TurboTax.