1 

162 3063 

UNITED STATES OF AMERICA

BEFORE THE FEDERAL TRADE COMMISSION

COMMISSIONERS: Maureen K. Ohlhausen, Acting Chairman 

 Terrell McSweeny

In the Matter of

TAXSLAYER, LLC, a limited liability 

company. 

)

) 

) 

) 

) 

) 

)

DECISION AND ORDER

DOCKET NO. C-4626 

DECISION

The Federal Trade Commission (“Commission”) initiated an investigation of certain acts 

and practices of the Respondent named in the caption. The Commission’s Bureau of Consumer 

Protection (“BCP”) prepared and furnished to Respondent a draft Complaint. BCP proposed to 

present the draft Complaint to the Commission for its consideration. If issued by the 

Commission, the draft Complaint would charge the Respondent with violation of the Federal 

Trade Commission’s Privacy of Consumer Financial Information Rule (“Privacy Rule”), 16 

C.F.R. Part 313, recodified at 12 C.F.R. § 1016 (“Regulation P”), and the Federal Trade 

Commission’s Standards for Safeguarding Customer Information Rule (“Safeguards Rule”), 16 

C.F.R. Part 314, each issued pursuant to Title I of the Gramm-Leach-Bliley Act, 15 U.S.C.

§ 6801 et seq., and Section 5(a)(1) of the Federal Trade Commission Act, 15 U.S.C. § 45(a)(1). 

 Respondent and BCP thereafter executed an Agreement Containing Consent Order 

(“Consent Agreement”). The Consent Agreement includes: 1) statements by Respondent that it 

neither admits nor denies any of the allegations in the Complaint, except as specifically stated in 

this Decision and Order, and that only for purposes of this action, it admits the facts necessary to 

establish jurisdiction; and 2) waivers and other provisions as required by the Commission’s 

Rules.

The Commission considered the matter and determined that it had reason to believe that 

Respondent has violated the Federal Trade Commission Act, the Privacy Rule, Regulation P, and 

the Safeguards Rule, and that a Complaint should issue stating its charges in that respect. The 

Commission accepted the executed Consent Agreement and placed it on the public record for a 

period of 30 days for the receipt and consideration of public comments. Now, in further 

conformity with the procedure described in Commission Rule 2.34, 16 C.F.R. § 2.34, the 

Commission issues its Complaint, makes the following Findings, and issues the following Order: 
2

Findings

1. The Respondent, TaxSlayer, LLC, is a Georgia limited liability corporation with its 

principal office at 3003 TaxSlayer Drive, Evans, Georgia 30809.

2. The Commission has jurisdiction over the subject matter of this proceeding and over the 

Respondent, and the proceeding is in the public interest.

ORDER

Definitions

For purposes of this Order, the following definitions apply:

A. “Personal information” means individually identifiable information from or about an 

individual consumer, including but not limited to: (1) email address; (2) user account 

credentials, such as a login name and password; (3) first and last name; (4) governmentissued identification number, such as a Social Security number; (5) mobile or other 

telephone number; (6) home or other physical address, including street name and name of 

city or town; or (7) any information from or about an individual consumer that is 

combined with any of (1) through (6) above.

B. “Covered product or service” means any tax return preparation product or e-filing 

service, including any plan or program.

C. “Respondent” means TaxSlayer, LLC, and its successors and assigns.

Provisions

I. GLB Rule Violations

IT IS ORDERED that Respondent, and Respondent’s officers, agents, employees and 

attorneys, and all other persons in active concert or participation with any of them, who receive 

actual notice of this Order, whether acting directly or indirectly, in connection with any product 

or service, are hereby permanently restrained and enjoined from violating any provision of:

A. The Privacy of Consumer Financial Information Rule, 16 C.F.R. Part 313, or the Privacy 

of Consumer Financial Information Rule (Regulation P), 12 C.F.R. Part 1016; or

B. The Standards for Safeguarding Consumer Information Rule, 16 C.F.R. Part 314.

In the event that any of the statutory sections or rules identified in this Part are hereafter 

amended or modified, compliance with that statutory section or rule as so amended or modified 

shall not be a violation of this Order. 
3

II. Biennial Assessment Requirements

IT IS FURTHER ORDERED that Respondent, and its successors and assigns, in 

connection with their compliance with Section I (A) and (B) of this Order, shall obtain initial and 

biennial assessments and reports (“Assessments”) from a qualified, objective, independent thirdparty professional, using procedures and standards generally accepted in the profession. The 

reporting period for the Assessments shall cover: (1) the first one hundred and eighty (180) days 

after service of the Order for the initial Assessment, and (2) each two-year period thereafter for 

ten (10) years after service of this Order for the biennial Assessments. Each Assessment shall:

A. Set forth the specific administrative, technical, and physical safeguards that Respondent 

has implemented and maintained during the reporting period;

B. Explain how such safeguards are appropriate to Respondent’s size and complexity, the 

nature and scope of Respondent’s activities, and the sensitivity of the personal 

information collected from or about consumers;

C. Explain how the safeguards that have been implemented meet or exceed the protections 

required by Section I (B) of this Order, and

D. Certify that Respondent’s security program(s) is operating with sufficient effectiveness to 

provide reasonable assurance that the security, confidentiality, and integrity of personal 

information is protected and has so operated throughout the reporting period.

Each Assessment must be completed within 60 days after the end of the reporting period to 

which the Assessment applies. The Assessment must be obtained from a qualified, objective, 

independent third-party professional, who uses procedures and standards generally accepted in 

the profession. A professional qualified to prepare such Assessments must be: an individual 

qualified as a Certified Information System Security Professional (CISSP) or as a Certified 

Information Systems Auditor (CISA); an individual holding Global Information Assurance 

Certification (GIAC) from the SANS Institute; or a qualified individual or entity approved by the 

Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade 

Commission.

Respondent must submit the initial Assessment to the Commission within 10 days after the 

Assessment has been completed. Respondent must retain all subsequent biennial Assessments, 

at least until the Order terminates. Respondent must submit any biennial Assessments to the 

Commission within 10 days of a request from a representative of the Commission.
4

III. Acknowledgments of the Order

IT IS FURTHER ORDERED that Respondent obtain acknowledgements of receipt of this 

Order:

A. Respondent, within 10 days after the effective date of this Order, must submit to the 

Commission an acknowledgment of receipt of this Order sworn under penalty of perjury.

B. For 20 years after issuance of this Order, Respondent must deliver a copy of this Order 

to: (1) all principals, officers, directors, and LLC managers and members; (2) all 

employees, agents, and representatives having managerial responsibilities for the conduct 

specified in Provisions I through IV; and (3) any business entity resulting from any 

change in structure as set forth in the Provision titled Compliance Reports and Notices. 

Delivery must occur within 10 days after the effective date of this Order for current 

personnel. For all others, delivery must occur before they assume their responsibilities.

C. From each individual or entity to which a Respondent delivered a copy of this Order, 

Respondent must obtain, within 30 days, a signed and dated acknowledgment of receipt 

of this Order.

IV. Compliance Reports and Notices

IT IS FURTHER ORDERED that Respondent make timely submissions to the 

Commission:

A. One year after the issuance date of this Order, Respondent must submit a compliance 

report, sworn under penalty of perjury, in which:

1. Respondent must: (a) identify the primary physical, postal, and email address and 

telephone number, as designated points of contact, which representatives of the 

Commission may use to communicate with Respondent; (b) identify all of the 

Respondent’s businesses by their names, primary telephone numbers, and primary 

physical, postal, email, and Internet addresses; (c) describe the activities of each 

business, including the goods and services offered; (d) describe in detail whether 

and how Respondent is in compliance with each Provision of this Order; and (e) 

provide a copy of each Acknowledgment of the Order obtained pursuant to this 

Order, unless previously submitted to the Commission.

B. Respondent must submit a compliance notice, sworn under penalty of perjury, within 14 

days of any change in the following:

1. Respondent must submit notice of any change in: (a) any designated point of 

contact; or (b) the structure of Respondent or any entity that Respondent has any 

ownership interest in or controls directly or indirectly that may affect compliance 

obligations arising under this Order, including: creation, merger, sale, or 
5

dissolution of the entity or any subsidiary, parent, or affiliate that engages in any 

acts or practices subject to this Order.

C. Respondent must submit notice of the filing of any bankruptcy petition, insolvency 

proceeding, or similar proceeding by or against Respondent within 14 days of its filing.

D. Any submission to the Commission required by this Order to be sworn under penalty of 

perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by 

concluding: “I declare under penalty of perjury under the laws of the United States of 

America that the foregoing is true and correct. Executed on: _____” and supplying the 

date, signatory’s full name, title (if applicable), and signature.

E. Unless otherwise directed by a Commission representative in writing, all submissions to 

the Commission pursuant to this Order must be emailed to Debrief@ftc.gov or sent by 

overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, 

Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue 

NW, Washington, DC 20580. The subject line must begin: In re TaxSlayer, LLC.

V. Recordkeeping

IT IS FURTHER ORDERED that Respondent must create certain records for 20 years after 

the issuance date of the Order, and retain such records for 5 years. Specifically, Respondent 

must create and retain the following records:

A. Accounting records showing the revenues from all goods or services sold;

B. Personnel records showing, for each person providing services in relation to any aspect of 

the Order, whether as an employee or otherwise, that person’s: name; addresses; 

telephone numbers; job title or position; dates of service; and, if applicable, the reason for 

termination;

C. Records of all consumer complaints and refund requests, whether received directly or 

indirectly, such as through a third party, and any response;

D. All records necessary to demonstrate full compliance with each provision of this Order, 

including all submissions to the Commission;

E. A copy of each widely disseminated representation by Respondent that describes the 

extent to which Respondent maintains or protects the privacy, security and confidentiality

of Personal Information, including any representation concerning a change in any website 

or other service controlled by Respondent that relates to the privacy, security and 

confidentiality of Personal Information;
6

F. For 5 years from the date of the last dissemination of any representation covered by this 

Order:

1. All materials that were relied upon in making the representation; and

2. All evidence in Respondent’s possession, custody, or control that contradicts, 

qualifies, or otherwise calls into question the representation, or the basis relied 

upon for the representation, including complaints and other communications with 

consumers or with governmental or consumer protection organizations; and

G. For 5 years from the date of preparation of each Assessment required by this Order, all 

materials relied upon to prepare the Assessment, whether prepared by or on behalf of 

Respondent, including all plans, reports, studies, reviews, audits, audit trails, policies, 

training materials, and assessments, and any other materials concerning Respondent’s 

compliance with related Provisions of this Order, for the compliance period covered by 

such Assessment.

VI. Compliance Monitoring

IT IS FURTHER ORDERED that, for the purpose of monitoring Respondent’s compliance 

with this Order:

A. Within 10 days of receipt of a written request from a representative of the Commission, 

Respondent must: submit additional compliance reports or other requested information, 

which must be sworn under penalty of perjury, and produce records for inspection and 

copying.

B. For matters concerning this Order, representatives of the Commission are authorized to 

communicate directly with Respondent. Respondent must permit representatives of the 

Commission to interview anyone affiliated with Respondent who has agreed to such an 

interview. The interviewee may have counsel present.

C. The Commission may use all other lawful means, including posing through its 

representatives as consumers, suppliers, or other individuals or entities, to Respondent or 

any individual or entity affiliated with Respondent, without the necessity of identification 

or prior notice. Nothing in this Order limits the Commission’s lawful use of compulsory 

process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1.

VII. Order Effective Dates

IT IS FURTHER ORDERED that this Order is final and effective upon the date of its 

publication on the Commission’s website (ftc.gov) as a final order. This Order will terminate on 

October 20, 2037, or 20 years from the most recent date that the United States or the 

Commission files a complaint (with or without accompanying settlement) in federal court 

alleging any violation of this Order, whichever comes later; provided, however, that the filing of 

such a complaint will not affect the duration of:
7

A. Any provision in this Order that terminates in less than 20 years;

B. This Order’s application to a Respondent that is not named as a defendant in such 

complaint; and

C. This Order if such complaint is filed after the Order has terminated pursuant to this 

Provision.

Provided further, that if such complaint is dismissed or a federal court rules that the Respondent 

did not violate any provision of the Order, and the dismissal or ruling is either not appealed or 

upheld on appeal, then the Order will terminate according to this Provision, as though the 

complaint had never been filed, except that the Order will not terminate between the date such 

complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date 

such dismissal or ruling is upheld on appeal.

By the Commission.

Donald S. Clark

Secretary

SEAL:

ISSUED: October 20, 2017