Federal Tax Information, or FTI, is any tax data the IRS collects, processes, or shares with another agency to administer the tax code. It covers your income, deductions, credits, payments, filing status, and identifying details like your Social Security number, and it carries some of the strictest confidentiality protections federal law applies to any category of personal information. Those protections follow the data wherever it goes, so when the Department of Education, a state Medicaid office, or a child support agency receives tax data from the IRS, that information remains FTI in their hands and must be guarded under the same federal rules.
What Counts as FTI
The legal definition sits in Section 6103 of the Internal Revenue Code, which splits FTI into two pieces: “return information” and “taxpayer identity.”1Office of the Law Revision Counsel. 26 USC 6103 – Confidentiality and Disclosure of Returns and Return Information Return information is the broad bucket. It covers the nature and amount of your income, your deductions, credits, assets, liabilities, tax payments, whether your return is under examination, and anything else the IRS has recorded while determining a tax liability. Taxpayer identity is narrower: your name, mailing address, and taxpayer identifying number.
In day-to-day terms, FTI includes your wages, filing status, adjusted gross income, pension distributions, and IRA withdrawals. The category also stretches in ways people don’t always expect. When an agency pulls IRS data into its own files, the mixed dataset becomes FTI under the commingling rules in IRS Publication 1075.2Internal Revenue Service. Publication 1075 – Tax Information Security Guidelines for Federal, State and Local Agencies Any figure an agency calculates from IRS data that could be used to work backward to the original tax numbers is treated as FTI too. The Department of Education, for example, treats the payroll tax allowance its system derives from IRS income data as FTI, because the original income figure can be reconstructed from it.3U.S. Department of Education – Federal Student Aid. Guidance on the Use of Federal Tax Information FTI Free Application for Federal Student Aid FAFSA Data and Non-FAFSA Data
One boundary matters. Information you voluntarily hand to an agency is not FTI, even if the same numbers appear on your tax return. A pay stub you give a state benefits office is that agency’s own record. If the agency later pulls your income directly from IRS systems, that IRS-sourced copy is FTI. The source of the data decides, not the content.
Who Handles FTI Beyond the IRS
The IRS is the primary custodian, but Section 6103 authorizes it to share tax data with a long list of agencies for purposes beyond tax collection. Each disclosure is scoped: the IRS doesn’t hand over a full return, only the specific elements the receiving agency is authorized to use for its stated purpose.
- The Social Security Administration receives wage and self-employment income data to administer Social Security benefits.
- The Department of Education receives income and tax data through the FAFSA process to determine eligibility for Pell Grants, student loans, and income-driven repayment plans.
- The Department of Health and Human Services receives return information to verify eligibility for Medicaid, children’s health insurance, and Affordable Care Act marketplace plans.
- Agencies running SNAP and HUD housing assistance programs that require income verification also receive FTI.
- State child support enforcement agencies access FTI to locate noncustodial parents and set support obligations.
State tax departments receive FTI to run their own tax systems, and any contractor working for an authorized agency is bound by the same confidentiality rules the agency itself must follow.
How Agencies Must Protect It
IRS Publication 1075 is the governing security document. Every agency that receives tax data from the IRS has to follow it, and the IRS Office of Safeguards enforces compliance across the full lifecycle of FTI, from receipt through destruction.2Internal Revenue Service. Publication 1075 – Tax Information Security Guidelines for Federal, State and Local Agencies
Access is restricted to employees who have both authorization and a specific need to see the data for their official duties. Role-based controls limit each person to the elements their work actually requires. Everyone who handles FTI, including contractors and subcontractors, must pass a background investigation and complete safeguarding training before touching any tax data.
On the technical side, FTI must be encrypted in transit across networks and at rest on storage devices. Agencies maintain audit logs tracking who accessed FTI, when, and what they did with it, and the IRS requires FTI to be labeled within databases so administrators can enforce controls at the data-element level and identify which systems fall within compliance review.4Internal Revenue Service. Protecting Federal Tax Information FTI in Databases Through Labeling
Facilities storing or processing FTI need restricted access, secure containers, and visitor controls. Disposal is tightly specified. Ordinary trash disposal is not acceptable. Paper must be cross-cut shredded, pulped, or incinerated, and electronic media must be physically destroyed by shredding, pulverizing, disintegrating, or incinerating; wiping a drive on its own does not satisfy the standard.5Internal Revenue Service. Media Sanitization Guidelines
The Office of Safeguards conducts on-site reviews of agencies handling FTI roughly every three years, covering every IT system that processes, stores, receives, or transmits the data, including headquarters, field offices, consolidated data centers, and third-party providers such as cloud hosts, call centers, and print vendors.6IRS Safeguards. Safeguards Review IT Scoping An agency that fails a review risks losing access to IRS data, which can disrupt eligibility determinations for millions of program participants.
Penalties for Looking at or Sharing FTI Without Authorization
Federal law separates two kinds of violations: unauthorized disclosure, meaning sharing FTI with someone who shouldn’t have it, and unauthorized inspection, meaning looking at it without a legitimate reason. Both are criminal, but the penalties for disclosure are substantially heavier.
Willfully disclosing a return or return information to an unauthorized person is a felony. The penalty is a fine of up to $5,000, up to five years in prison, or both. Federal employees convicted of this offense are automatically dismissed. The same penalties reach state and local agency employees who receive FTI under Section 6103, and any private person who obtains and then publishes FTI without authorization.7Office of the Law Revision Counsel. 26 USC 7213 – Unauthorized Disclosure of Information
Unauthorized inspection, sometimes called browsing, is a misdemeanor. Even if an employee never shares what they saw, simply looking at tax information without authorization carries a fine of up to $1,000, up to one year in prison, or both. Federal employees convicted of browsing are also terminated.8Office of the Law Revision Counsel. 26 USC 7213A – Unauthorized Inspection of Returns or Return Information
You can also sue for civil damages, separate from any criminal case. The statute sets a floor of $1,000 per unauthorized act, regardless of whether you can prove actual harm. If your actual damages exceed that figure, you recover the higher amount. Willful misconduct or gross negligence opens the door to punitive damages, and the court can award attorney’s fees and litigation costs.9Office of the Law Revision Counsel. 26 USC 7431 – Civil Damages for Unauthorized Inspection or Disclosure of Returns and Return Information
If Your FTI Is Breached
When an agency discovers or suspects that FTI has been accessed or disclosed without authorization, it must notify the Treasury Inspector General for Tax Administration and the IRS Office of Safeguards within 24 hours. The agency is not supposed to wait for an internal investigation to confirm FTI was involved; the clock starts as soon as a possible issue is identified.10Internal Revenue Service. Reporting Unauthorized Accesses, Disclosures or Data Breaches If the agency plans to notify affected individuals or release a media statement, it must share those plans and the text of any communications with the Office of Safeguards before issuing them.
Timing for notifying the people whose data was exposed depends on the agency’s own incident response policy. Federal law does not set a single nationwide deadline for individual notifications after an FTI breach, so when you hear from the agency can vary. If you do receive a breach notice involving your tax information, the $1,000-per-act civil damages provision gives you a remedy even if you cannot yet point to a measurable financial loss.