"In contrast to earlier guidance, the IRS won't assert the taxability of identity theft protection even if the employer provides it before any data breach occurs.... Many states follow the IRS's lead in determining taxable income for state income tax purposes. But that doesn't mean a state can't take a contrary position ... Identity theft protection is not a 'qualified benefit' for purposes of cafeteria plans under section 125 of the federal tax code, so employees cannot purchase this protection on a pretax basis."