Your free TurboTax alternative now belongs to TurboTax

Financial software giant Intuit just bought itself another online personal finance startup — and the data of that startup’s tens of millions of customers. On Monday afternoon, the company announced that it was purchasing Credit Karma for $7.1 billion in cash and stock. Credit Karma began as a free credit monitoring service in 2007, but it recently expanded to offer savings accounts as well as tax preparation and filing software, making Credit Karma an up-and-coming competitor to Intuit’s popular TurboTax software.

The big selling point for Credit Karma is that — in stark contrast to TurboTax — its services are free. Instead of money, you give Credit Karma your financial data and endure targeted credit card and loan advertisements. For many, this has been a good deal. Credit Karma’s tax preparation software helped the company more than double its users from about 45 million at the end of 2015 to over 100 million worldwide at the beginning of 2020. Put differently, that amounts to many millions of people who are not paying for TurboTax.

Another selling point for Credit Karma for many of its taxpayer users is (well, was) that it isn’t TurboTax, which has been dogged by allegations of ethical shadiness. Last year, a ProPublica investigation revealed TurboTax’s decades-long quest to stop the Internal Revenue Service from creating its own free tax software. TurboTax instead said it would offer free filing options for lower-income taxpayers, but it also made those free options difficult to find and promoted its own “free” TurboTax services that ultimately forced many taxpayers to upgrade to its paid services. All that in mind, Credit Karma seemed like an appealing alternative to many taxpayers who didn’t like the idea of getting ripped off. Now, not only does the more appealing option for tax services belong to Intuit — now the parent company of both TurboTax and Credit Karma — but your data probably does, too.

Credit Karma’s 90 million-plus user base in the United States includes almost half of all American millennials. (It seems the rumors that millennials are financial dunces who spend all of their money on avocado toast have been greatly exaggerated. It is also possible that they are using Credit Karma to save money so that they may buy even more avocado toast.) Credit Karma wouldn’t comment on what will happen to their data, so let’s take a look at its privacy policy:

We may disclose and transfer information about you to a third party as part of, or in preparation for, a change of control, restructuring, corporate change, or sale or transfer of assets. If such a business transfer results in a material change in the treatment of your Personal Information, you will be notified by e-mail (using the primary email address on your account) or by a prominent notice on our site.

So yes, it does indeed look like all that financial data will go to Intuit. But if Intuit decides to change up how it handles your personal information, at least the company says it will give you a heads up.

This isn’t unusual. Most privacy policies include passages like this because that user data is often part of (or even all of) what makes the company being acquired so valuable. Let’s face it: Intuit is not paying $7 billion for Credit Karma’s easily replicable software or business model. Just look at what it did to Mint, another online financial manager startup it acquired in 2009 for $170 million. Like Credit Karma, Mint makes money when its users purchase products from affiliates.

Mint’s fate under Intuit might give us a sneak peek at what’s to come for Credit Karma. It ain’t great. As Fast Company wrote last month, the budget tracker has remained free but it’s been operating in what its founder Aaron Patzer described as “maintenance mode,” which means the platform is adequately performing its base functions but offering little by way of updates or innovation.

The Credit Karma acquisition is also a reminder that when you give sensitive information over to one company, you aren’t only trusting it to keep your data safe; you’re also trusting whatever company acquires it to do the same. This also could include whatever random company buys up its assets in the event of a bankruptcy. That dating site you’re on? That genealogy database you handed your DNA test results to? Your doorbell? All gobbled up by bigger companies along with your data.

Unless its privacy policy explicitly states that user data will not be transferred even in the case of an acquisition, merger, or asset sale (and even the ones that do say this can always change them), you should never assume that the company you’re giving your personal information to today is the company that owns your personal information tomorrow.

Then again, in an age where antitrust hawks are paying much closer attention to tech companies, there’s always a chance the acquisition won’t happen. Intuit and Credit Karma said they don’t expect to close the deal until the second half of 2020, and they’ll need regulators to sign off on it before that happens.

Open Sourced is made possible by Omidyar Network. All Open Sourced content is editorially independent and produced by our journalists.