Why your MTD software asks for your device details

Why tax software reads your screen size

At some point in setting up Making Tax Digital software, a careful person notices that the app has read their screen size and wonders: why does my tax software need to know about my computer?

Here is the specific answer. We can give it because we build and send this data on every Making Tax Digital API call our software makes to HMRC (almost all of it to HMRC's test environment; one live connection test reached HMRC on 29 October 2026, and as at 6 November 2026 no filing has gone through our live service), and had to argue with HMRC about one piece of it. So here is what actually leaves your machine when you file, what the law and HMRC say it is for, and the one part that is genuinely worth a second thought.

What is a fraud prevention header?

It is data about the device and connection that made an API call, attached to that call. HMRC requires a set of them on every Making Tax Digital request, and is blunt with software providers about the standing: “You are required by law to submit header data for the VAT (MTD) and Income Tax Self Assessment (MTD) APIs.”

This is not a nice-to-have that vendors compete on. A provider whose software continues to send missing or incorrect header data, after discussions with HMRC, may be fined and blocked from HMRC's APIs. The data is checked by a specialist team before production access, and monitored on every application after that.

The law behind this, SI 2019/360, says the data is for “ensuring the authenticity and security” of what is filed, and HMRC says it monitors transactions “to help protect your customers' confidential data from criminals and fraudsters”, and uses the data “to support prosecutions for tax and duty fraud”. Taken together, the values describe the machine and connection that filed as you and identify the account, which is a defensible thing for a tax authority to want.

Exactly what we send HMRC about you

Our connection method is called WEB_APP_VIA_SERVER: a website whose server connects to HMRC for you. For that method HMRC lists sixteen headers and tells software providers they must submit data for all of them. We omit two, explained below, and normally send fourteen, or fewer if a value could not be collected. Ten describe you and your connection. Read them as a landlord, not an engineer.

The other four mainly describe us, the provider, though Gov-Vendor-Forwarded also repeats your public IP. HMRC wants to know which software filed, in what version, and a public address for it.

Notice what is not there. No contents of your return beyond the figures you are filing. No browsing history. No files. It describes the machine, the moment and the account that filed, not your affairs.

The header that made us build a service

One of those fourteen has a story, and it is the most honest illustration of what this regime actually costs. Gov-Client-Public-Port is the TCP source port of your connection: the port number your connection appears from on the public internet, which a home router or your provider's network may change from the one your device chose. HMRC wants it alongside your IP address, and is strict that it must be your port: “This must not be a server port, for example 80 for http connections and 443 for https connections.”

Here was our problem. Our API sits behind Cloudflare's global edge. By the time a request reaches our own code, your original connection is long gone: Cloudflare accepted it and opened a fresh one to us. The source port HMRC wants did not reach our code. HMRC warns developers to check for this: “Some popular load balancers do not” support collecting it.

For a time we omitted the header and told HMRC why, using its own missing-data route. In July 2026 HMRC told us our application could not go ahead without it. So we built a service to collect it: echo.letsort.co.uk, a small reverse proxy we operate that your browser connects to directly, with no Cloudflare in front. It terminates your connection itself, reads your public IP and source port straight off the accepted socket, notes the moment, and hands all three back. We disabled HTTP/3 on it so the port is always a TCP source port, as the spec requires.

On when to record your IP address, HMRC's specification says it is “usually when the backend server receives the request from the client. It could be at the Web Application Firewall (WAF), load balancer, reverse proxy or the server process itself.” Our echo is a reverse proxy, but it is not in the path of the request to HMRC: it observes a separate connection your browser makes to it, at most five minutes before the request. We described the method to HMRC's fraud prevention team under ticket CMQAA-696. HMRC closed that ticket and gave us production access on 29 October 2026. That lets us connect to HMRC's live systems. It does not make LetSort HMRC recognised, and we do not claim otherwise. On a request where the echo cannot be reached, we drop the port rather than send a placeholder.

This is the real cost of the regime. A landlord presses one button. Behind it, we stood up a small service, on a server we share with another product, that exists to observe your IP and port, because a tax authority asked. You will not see it.

The two headers we deliberately do not send

HMRC is blunt with software providers: they must submit data for every header their connection method lists, and they are required by law to do so. It does not call any of them optional. But for a few, its guidance describes named circumstances in which, in its words to developers, you will not be able to collect a value, and then tells them to follow its missing-data guidance rather than invent one. We omit two, and told HMRC about both. Our replies gave email and password as the reason for the first, and did not mention emailed links.

The honest move here is to declare the omission, not to paper over it. Sending an invented or placeholder value to make a checklist look complete is exactly what a fraud prevention regime is meant to catch. We told HMRC's specialist team which two headers we omit, on the record, under a support ticket, and our explanation of the first described password sign-in without mentioning emailed links. If you want to read the full filing sequence these headers ride along with, we wrote that up separately.

So is this a privacy problem?

It is a fair question, and the honest answer is: mostly no, with one part worth sitting with. What reaches HMRC describes the device and connection that filed and identifies the account, including your sign-in email address. HMRC says it monitors transactions to protect taxpayers' data from fraudsters and uses the data to support fraud prosecutions, and the 2019 memorandum to the regulations says it has no bearing on the calculation or assessment of any tax. It is not the contents of your tax affairs beyond the figures you are submitting anyway, and it is not your browsing or your files.

Nor is it something you opted into. We are required to send the data by law, which is why, in data-protection terms, our basis for processing it is a legal obligation rather than consent you gave and could have withheld. Under UK GDPR, data collected to meet a legal obligation cannot simply be reused for something unrelated, such as marketing.

The part worth sitting with is the honest one: this is, however benign the intent, monitoring of the device and connection you file from, and at LetSort it includes a small service we run to observe your IP and port. HMRC's transaction monitoring privacy notice (updated 3 March 2025) covers data collected when you use MTD-compatible software. It says records are kept for 6 years plus the current year, and that, to develop reliable device identification, its device profiling shares IP addresses and device information with a third-party supplier with data centres in the EU and America. It does not name the supplier or say which services’ data this covers. The echo runs on a server hosted by Hetzner in Germany. The right response is not alarm; it is to ask a vendor which connection method it uses, which headers it omits and why, and how long it keeps the data.

What this tells you when you choose software

Most landlords cannot check header quality themselves, and HMRC tells vendors not to share their header status. The check you can make is HMRC's software finder, which lists software that has been through HMRC's recognition process. HMRC requires headers in sandbox calls before it grants production access, says they “will be checked by a specialist team”, and may fine and block a provider that keeps sending wrong data after discussions with HMRC. Production access is permission to connect to HMRC's live systems. It does not mean HMRC recommends the product: HMRC says it does not recommend any product or software provider. A listing does not tell you how good a product's headers are, and GOV.UK says products that were in development are now listed in the finder too.

There is a newer test. On its developer hub (updated 15 September 2026), HMRC says it is no longer accepting production access requests for new 2026–27 quarterly update products. It does not say how this affects requests already in progress. Ask any vendor you are considering whether it can file your 2026–27 updates today, for all your income sources, not whether it plans to.

Here is our own answer. Our request was already in progress when HMRC closed the window. On 29 October 2026 HMRC gave LetSort production access, which lets it connect to HMRC's live systems. That does not make it HMRC recognised, and we do not claim otherwise. As at 6 November 2026 no filing has gone through LetSort's live service, and the full filing journey has only run in HMRC's test environment. One live connection test reached HMRC, which refused the next step because that account was not signed up for Making Tax Digital. LetSort covers UK property income only and does not send other income. Its Free plan covers one UK property, and paid plans are not on sale. HMRC's press release of 12 August 2026 says quarterly updates need to be sent through HMRC-recognised software. The regulations (SI 2026/336, regulations 3 and 9) say “functional compatible software”. LetSort is not HMRC recognised and is not on its software list, so if you need to file now, choose a product from HMRC's finder and check it is available now.

Three questions you can ask. Which connection method do you use? Which headers do you omit, and why? And have you been given production access, and are you on HMRC's software finder?

Common questions

Sources

From HMRC's developer hub, GOV.UK and legislation.gov.uk. The behaviour described is our own code; the quoted HMRC wording was re-checked live on 6 November 2026. HMRC's main fraud prevention guidance shows “Version 3.3 issued 27 January 2025” and keeps a dated change log, while some adjacent pages carry no date, so the quotes are stated as at the day we checked.

• SI 2019/360 (the law that puts the duty on software suppliers)
• SI 2019/360, regulation 3 (the duty, and the exception where a user has blocked or altered the data)
• SI 2019/360 Explanatory Memorandum (2019; helps identify who is using HMRC services; no bearing on the calculation or assessment of any tax)
• HMRC direction under regulation 2(2) (the metadata required of software suppliers (last updated 16 April 2025))
• HMRC: send fraud prevention data (the legal requirement, and the fine-and-block)
• HMRC: fraud prevention change log (no entries dated 2026 as at 6 November 2026)
• HMRC: fraud prevention, web app via server (the header list and the “you will not be able to collect a value” wording)
• HMRC: Gov-Client-Public-Port (must not be a server port such as 80 or 443)
• HMRC: Gov-Client-Public-IP-Timestamp (collection at the WAF, load balancer, reverse proxy or server)
• HMRC: MTD for Income Tax end-to-end service guide (production access closed for new 2026–27 quarterly update products (updated 15 September 2026))
• HMRC: how to integrate (production access, and the specialist-team header check)
• HMRC: getting it right (header status is not to be shared; no placeholder values)
• GOV.UK: choose the right software (support all your income sources; HMRC does not recommend any product; products in development now in the finder (updated 13 July 2026))
• HMRC: find Making Tax Digital for Income Tax software (the software finder; LetSort is not listed as at 6 November 2026)
• HMRC press release, 12 August 2026 (updates “need to be sent through HMRC-recognised software”)
• SI 2026/336, regulation 3 (what “functional compatible software” means)
• SI 2026/336, regulation 9 (quarterly updates must use functional compatible software)
• HMRC: transaction monitoring privacy notice (6 years plus the current year; sharing with a third-party supplier (updated 3 March 2025, checked 8 November 2026))
• UK GDPR, Article 5 (limits on further processing)

Related

• What actually happens when your software files an MTD update
• The landlord's compliance year: every date that actually matters