What tax prep knows about you, why that was a moat, and why LLMs threaten it.
Sources: research/SOURCE_INDEX.md — [S14][S16]. Moat/threat framing is Analysis, labeled.
A tax return is one of the richest financial snapshots a company can hold on a person, refreshed once a year:
- Income (W-2 wages, 1099s, self-employment, investments, rentals), employer, household/marital status, dependents.
- Deductions and credits — a proxy for life (home, education, childcare, charity, health).
- Bank details (for refunds), prior-year history, and — via Credit Karma — credit and everyday-money behavior.
Uniquely, it's verified, structured, and comprehensive — not inferred from browsing, but the numbers the person swears to the government.
Tax data isn't just "sensitive" — it's governed by a specific criminal statute, and the consent architecture it mandates is the legal plumbing of the whole cross-sell flywheel.
The default rule (IRC §7216): a tax return preparer — including the software company — may use the information a taxpayer furnishes only to prepare the return. Anything else requires prior, written, knowing, voluntary consent in an IRS-prescribed format (Rev. Proc. 2013-14: named recipient, stated purpose; no retroactive consent).
The teeth (why Intuit runs mandatory training on this):
- §7216 is criminal — knowing/reckless violation = misdemeanor, up to $1,000 fine and/or 1 year imprisonment per violation ($100k for identity-theft-related cases under §6713(b)).
- §6713 is its civil twin — $250 per unauthorized disclosure (cap $10k/yr), and it requires no intent — accidental counts.
- "Per violation" = per taxpayer. At TurboTax scale, a systematic error is existential, and individual employees carry criminal exposure — hence the course.
The two-consent nuance (legally distinct, hence separate screens in TurboTax):
- Consent to USE — the preparer itself using tax data beyond return prep (e.g., income/refund size deciding which offers you see). Data never leaves TurboTax; marketing use still needs consent.
- Consent to DISCLOSE — sending tax return info to another entity. Credit Karma counts as another entity — under §7216 an affiliate is NOT the same company, so TurboTax→CK sharing needs a disclosure consent naming the recipient. Common ownership buys nothing.
- Direction matters: §7216 governs tax data flowing out of the preparer. CK credit data flowing into TurboTax is governed by GLBA (and FCRA for credit-report data) instead — the two directions of the TurboTax↔CK bridge run under different legal regimes.
Strategic consequence (Analysis): the flywheel (file 09) — refund routing, the ~80% pre-prepared return, personalized offers — runs entirely through those consent checkboxes, so consent rates are a strategic metric and the consent UX draws both design investment and press scrutiny. The trust asset framing is literal: filers consent because they trust the brand; one misuse scandal collapses the legal position and the consent rates at once.
The moat had two parts — the tax knowledge and the data. General-purpose LLMs erode the first:
- The tax-code knowledge that took decades to encode is now broadly accessible — a capable model can explain and even draft much of a return. Startups have shown you can approximate TurboTax's guided experience quickly. [S14][S27]
- This commoditizes the guidance layer and shifts the defensible advantage toward what LLMs don't have: verified first-party data, integrations, trust, guarantees, and the human expert.
So the data dimension is now Intuit's defense, not just its offense: the proprietary, consented, structured financial data (and the ecosystem it connects to) is the part a general model can't replicate — which is exactly what Intuit is leaning on in its AI response (file 11).