Denmark Sends the Return First

Every March, about five million Danes can log in and find their tax already done. The annual statement, the årsopgørelse, has been assembled from what employers, banks, pension funds and mortgage lenders reported during the year. It shows the income, the deductions, the tax withheld, and the balance owed or refunded. If it is right, the taxpayer does nothing. It stands. If it is wrong, they change the line that is wrong, and a correction window runs until spring, with refunds starting to arrive in April.1

Denmark began pre-filling returns in 1988, the first country to do so at scale.2 This archive usually argues from failure. The Danish return mostly works, and it gets the same test the failures get, question by question. It passes most of it. The places where it fails are the more useful part, because they fail on the same records, in the same state, and the technology cannot explain the difference between the two outcomes.

Who does the adapting

The first question is who has to fit a life into the institution’s categories.

In most tax systems the answer is the filer. She collects the forms, finds the numbers, learns which box they go in, and certifies the result under penalty. The American version of that burden is large enough to support an industry that lobbies to keep it.3 In Denmark the work was moved onto the parties who already hold the numbers. Employers report wages monthly to the national income register, banks report interest and balances, and mortgage lenders report what was paid. By the time the statement is built, roughly ninety-five percent of all income has been reported by someone other than the person who earned it.4

That shift did more than save filers an evening. In a large audit experiment, Henrik Kleven and colleagues found that evasion on third-party-reported income was about 0.3 percent, against 37 percent on income people reported themselves.4 The state that asked less of people collected more accurately, because it had moved the reporting to the parties who could not easily shade it. The burden went upward and the accuracy came with it.

This archive keeps recommending that move, and here a whole country has made it. The institution holds the facts, so the institution does the assembling, and the person’s part shrinks to what only she can know.

Whether the record can be seen before it binds

An earlier essay warned about the reform Denmark represents. Remove the form, and you remove the one place where a person stated her own facts. The facts about her are then settled in records other parties assembled for other purposes, and those records bind her without her having said anything.5 The missing half of the reform, that essay argued, is a record shown to the person and correctable before it takes effect.

Denmark built the missing half. The statement is a proposal until the correction window closes. Every figure on it is visible, attributed to the party that reported it, and editable. After the window, a person can still ask to reopen the assessment until the first of May in the fourth year after the income year, on factual or legal grounds.6 The preliminary assessment, the forskudsopgørelse that sets withholding for the coming year, works the same way in advance. For 2025, more than a million people changed theirs within two months of it opening, a record, and the number of changes has risen by about a fifth since 2019.7

Those changes are work, and the work does not fall evenly. The people changing their forecasts are disproportionately young, and the items they change are income, commuting deductions and interest: the parts of a life that move. A salaried employee with a mortgage and one bank account may never touch the system. A freelancer with three clients and a new flat touches it every quarter. The design moved the ordinary case upward and left the irregular case with the person. Under the test this archive uses, that allocation is right, since the irregular facts are the ones only the person holds.8 But it means the system’s smoothness is partly a property of the lives it was built around.

What it costs to say no

The third question is what refusal costs. Here Denmark’s answer is less comfortable. There is no opting out of the income register. Employers report whether or not the employee wants them to; the personal identification number that joins the records is assigned at birth or on arrival. The arrangement cannot claim consent. Its legitimacy rests on what the state does with the join, and on the person’s ability to see and dispute what the join produces. As long as the record faces her, shown before it binds, the lack of exit is tolerable. The same join pointed somewhere she cannot see is a different matter.

Where it fails

It is pointed somewhere else.

Udbetaling Danmark, the agency that pays pensions, child benefits, housing support and other transfers, uses the same national records for fraud control. Its data unit has built up to sixty algorithmic models to flag people for investigation. Amnesty International spent more than two years investigating the system and published its findings in November 2024 under the title Coded Injustice.9 The models draw on residency and movements, citizenship, place of birth, family relationships, travel and ties to countries outside the European Economic Area. One, which Amnesty calls “Really Single,” estimates whether a person receiving a single person’s benefit is really living alone. Another flags people with connections abroad. Amnesty found that the models risk discriminating against migrants, people with disabilities, people on low incomes and racialized groups, and argued that parts of the system may amount to the social scoring the EU’s AI Act prohibits. The agency disputes that reading. One person Amnesty interviewed described the experience of being investigated as “sitting at the end of the gun.”

Put the three questions to this system and every answer runs the other way. The agency sees the pattern first, because it has every file. The person flagged bears the cost of the model’s errors: she must show she is single, or resident, or not what the score suggests. And the record is never shown before it binds. She does not see the score that selected her, the features that produced it, or the rate at which the model is wrong about people like her. Detection has moved upward, and the cost of detection’s errors has stayed below. An earlier essay called that combination the signature of a corrector that will not be corrected.10

Denmark has failed this way before, on the tax side itself, when collection rather than assessment was automated. The tax agency began designing EFI in 2005, a system meant to automate collection of debts owed to the public sector, and put it into operation in 2013. By 2015 it was collecting debts that had already passed their limitation period, and failing to collect others. The tax minister shut down its automatic collection that September, saying the system was so riddled with errors there was no alternative.11 The state then spent years rebuilding by hand what the machine had been trusted to do. The property valuation system followed a similar arc: suspended valuations, a replacement promised within two years, costs that multiplied many times over, and by 2021 about 715,000 owners due refunds of roughly thirteen billion kroner for property tax they had overpaid while the system was unfinished.12

Neither of those failures involved a record the citizen could see and fix. In both, the state’s machinery acted on people, and the people found out afterward.

What the case shows

The annual statement and the fraud models run on the same income register and the same personal number, in the same high-trust state, under the same ministers. One is a model of what the archive asks for. The other is a textbook case of what it warns against. What separates them is the direction the knowledge faces and who pays when it is wrong. How much the state knows is the same in both.

In the tax statement, the record is addressed to the person. She sees it first, it binds only after she has had the chance to dispute it, and the burden of the ordinary case sits with the parties who produced the numbers. In the fraud models, the record is addressed to the institution. The person meets it only as an accusation, and the burden of the model’s error is hers.

This gives the test in Who Corrects the Corrector a concrete form.10 A capacity to know about people is legitimate when its output is shown to them before it acts, when its errors are paid for by the party that made them, and when it is corrected on a trigger that does not depend on the vigilance of the people it harms. The Danish tax statement meets the first two and partly meets the third: the statement corrects the ordinary case without anyone watching, though the irregular case still depends on the person noticing. The fraud models meet none of them. Law and design decide which of the two a state builds, whatever the underlying data looks like.

There are limits to what the case can carry. Denmark’s tax base is broad and simple, its employers and banks report reliably, and its public administration starts from a level of trust that most countries do not have. A country that copied the pre-filled statement without the correction window, or without reliable third-party reporting, would get the form’s disappearance and none of its replacement. And the Danish case says little about the hard question the remedies essay left open: who decides whether a burden recurs across a class, when that decision is itself a classification.

It does show that the choice is real. A state can know a great deal about people and put that knowledge in front of them, or know the same things and keep them to itself. Denmark does both, on the same records, and the difference is plain to anyone who has been on the receiving end of either.