IRS Form 7216: Tax Return Disclosure Consent, Rules, and Penalties

IRS Section 7216 disclosure rules bar any paid tax return preparer from disclosing or using a client’s tax return information for anything other than preparing that return, unless a specific regulatory exception applies or the taxpayer signs a compliant written consent. Breaking the rule is a federal misdemeanor punishable by up to $1,000 in fines and a year in prison per violation, with the fine ceiling rising to $100,000 when identity theft is involved.¹ A parallel civil penalty of $250 per incident, capped at $10,000 per preparer per year, sits under Section 6713 and applies even without any showing that the preparer acted knowingly.²

Who the Rules Apply To

The statute defines “tax return preparer” broadly. It reaches the individual who fills out the return, the firm that employs them, partners, corporate officers, and any employee who handles client data along the way.¹

It also captures people providing auxiliary services. A company that develops tax preparation software or hosts filing platforms falls inside Section 7216 the moment it touches client data. The same is true of contractors handling data entry, document processing, or IT support for a preparation firm. Once someone receives tax return information through any of these roles, they become a tax return preparer for purposes of the statute’s penalties.

What Counts as Tax Return Information

Tax return information is any data a client provides for or in connection with preparing a return.¹ Names, Social Security numbers, addresses, W-2s, and bank account details are the obvious examples. The definition also pulls in anything else the client furnishes during the engagement: family details shared in conversation, notes about a side business, documents about rental property, records of medical expenses.

The test is whether the information was provided in connection with the return, not whether it feels sensitive. Preparers sometimes assume that data they already knew about a client, or data that seems trivial, is outside the rule. It isn’t.

The Default Rule

The core prohibition is simple. A preparer cannot disclose client tax return information to anyone, or use it for any purpose other than preparing the return, without either a regulatory exception or the taxpayer’s written consent.¹

The prohibition applies inside the same organization too. A preparer at a large financial services firm cannot hand client return data to the firm’s investment advisory division without proper consent, even though both share a corporate parent. The wall between tax preparation and everything else is absolute unless an exception applies.

Disclosures That Don’t Require Consent

Treasury regulations carve out narrow situations where disclosure or use is permitted without written consent from the taxpayer:

Filings with the IRS and state or local tax authorities for return preparation or audit compliance.
Sharing within the same firm among employees who need the data to prepare or review the return.
Production compelled by court order or subpoena.
Seeking legal advice about the engagement.
Insurance claims or lawsuits involving the preparer’s professional work.
Use by an attorney or CPA who also prepared the return in delivering other legal or accounting services to the same client, such as estate planning or financial statement work. In the normal course of those other services, disclosure to third parties like lenders can occur unless the taxpayer objects.

These exceptions are limited by their own terms. The legal-and-accounting-services carve-out only applies to licensed attorneys and CPAs performing services for the same taxpayer whose data they hold. A preparer without one of those credentials cannot use it.³

A separate exception covers quality and peer reviews conducted by attorneys, CPAs, enrolled agents, or enrolled actuaries eligible to practice before the IRS. Any evaluative report from the review must not identify taxpayers by name or ID number if anyone beyond the reviewer or reviewed preparer could see it, and identifying documents must be destroyed after the review.³

What a Valid Consent Requires

When no exception applies, the preparer needs the taxpayer’s written consent. The regulations are exacting about what a valid consent looks like.

Every consent, regardless of taxpayer type, must identify the preparer and the taxpayer by name, state the purpose of the disclosure or the specific use, name the recipient, describe the particular information involved, and carry the taxpayer’s signature and date. If the consent is for solicitation of products or services, each type of product or service must be listed individually. A blanket reference to “financial products” is not enough; if the plan is to solicit for mortgages, mutual funds, or insurance, each must be spelled out.⁴

Individuals vs. Business Entities

For business entity clients, a consent can appear inside an engagement letter and can cover both disclosure and use in a single document. For individual Form 1040 filers, the rules tighten. Consent must be a separate written document, and consents for use and disclosure must be provided as separate consents. Individuals must also be allowed to affirmatively select each disclosure or use. Opt-out boxes, where the taxpayer has to deselect unwanted sharing, aren’t permitted.⁵

Conditioning Preparation on Consent

A preparer generally cannot refuse to prepare a return because the taxpayer declines to sign a consent form. Tying services to consent makes the consent involuntary and therefore invalid. One narrow exception: a preparer may condition services on consent when the disclosure is to another preparer who will help finish the return.⁴

Duration, Withdrawal, and Required Warning

If a consent form doesn’t specify how long it lasts, it expires one year from the date the taxpayer signed. A taxpayer can withdraw consent at any time, whatever the form says. Every consent must also carry a specific statement telling the taxpayer they can report misuse to the Treasury Inspector General for Tax Administration, including TIGTA’s phone number (1-800-366-4484) and email (complaints@tigta.treas.gov).⁶ A consent form missing that language doesn’t satisfy the rules.

Sending Client Information Overseas

Any plan to send client data to a person or office outside the United States triggers extra requirements. The preparer must inform the taxpayer that their information will go outside the country and get written consent before it leaves.⁷

The consent must include this exact language: “This consent to disclose may result in your tax return information being disclosed to a tax return preparer located outside the United States.”⁵ It applies even when the overseas recipient is an employee of the same firm or a subsidiary of the same parent company. The practical burden falls hardest on larger firms that outsource data entry, bookkeeping, or return review offshore.

Marketing and Cross-Selling

This is where preparers most often stumble. A preparer may keep a list of client names, addresses, email addresses, phone numbers, and return type. That list can be used to solicit more tax preparation services or to send general tax, business, or economic information for educational purposes. It cannot be used to market anything else.³

Statistical compilations built from return data are allowed for internal management use, but not for marketing. Any compilation tying dollar amounts of refunds, credits, or deductions to returns cannot be used in advertising at all. The regulations specifically say that using anonymous statistical data to market financial advisory or asset planning services is not authorized without taxpayer consent.³

To use return data to sell insurance, investments, loans, or anything else unrelated to tax preparation, the preparer needs a valid, product-specific consent.

Selling or Transferring a Tax Practice

When a firm is sold, merged, or otherwise transferred, client data moves with it. The regulations permit transfer of a taxpayer list as part of the sale or disposition of the entire tax preparation business. Pre-sale due diligence is also allowed, provided it happens under a written confidentiality agreement that bars the prospective buyer from using or further disclosing the information for any purpose other than evaluating the deal.⁸

The buyer steps into the seller’s shoes and is bound by the same restrictions. Statistical compilations may be transferred on the same terms. What isn’t allowed: selling or exchanging a client list for value outside the sale of the actual business. Monetizing a client list without transferring the practice requires individual consent from every affected taxpayer.

Penalties

Violations split into two tracks. They can apply at the same time for the same conduct.

Criminal

Conviction under Section 7216 requires proof that the preparer acted knowingly or recklessly. The offense is a misdemeanor. Each violation carries a fine of up to $1,000, up to one year in prison, or both, plus prosecution costs. The fine ceiling rises to $100,000 per violation when the misconduct falls within Section 6713(b)’s enhanced provisions for identity-theft-related conduct.¹

Civil

Section 6713 imposes a civil penalty of $250 per unauthorized disclosure or use, capped at $10,000 per preparer per calendar year.² Unlike the criminal statute, the civil penalty doesn’t require any showing that the preparer acted knowingly or recklessly. A careless mistake can trigger it. The $10,000 cap sounds low for a big firm, but each preparer inside the firm faces the cap separately, and criminal exposure has no comparable ceiling.

Data Breaches

Preparers often ask whether a hack triggers Section 7216 liability. Criminal exposure requires the disclosure to be knowing or reckless, so a preparer whose systems are compromised despite reasonable security measures likely has not made a knowing or reckless disclosure. A preparer who ignored basic cybersecurity practices, failed to encrypt sensitive data, or left known vulnerabilities in place could face an argument that the breach was reckless. The IRS expects preparers to maintain written data security plans, and the absence of one would not help against a recklessness claim. The civil penalty under Section 6713 doesn’t require the same mental state, so exposure for sloppy security is more immediate even without a criminal case. State boards of accountancy may also impose administrative penalties for breaches that can run substantially higher than the federal civil amount.

1
Office of the Law Revision Counsel. 26 USC 7216 – Disclosure or Use of Information by Preparers of Returns
2
Office of the Law Revision Counsel. 26 USC 6713 – Disclosure or Use of Information by Preparers of Returns
3
eCFR. 26 CFR 301.7216-2 – Permissible Disclosures or Uses Without Consent of the Taxpayer
4
GovInfo. 26 CFR 301.7216-3 – Disclosure or Use Permitted Only With the Consent of the Taxpayer
5
Internal Revenue Service. Revenue Procedure 2008-12
6
Internal Revenue Service. Revenue Procedure 2008-35 – Requirements for Every Consent
7
Internal Revenue Service. FAQs Related to Strengthened Taxpayer Control over Tax Information
8
GovInfo. 26 CFR 301.7216-2 – Permissible Disclosures or Uses Without Consent of the Taxpayer