Section 7216 Explained: Tax Preparer Client Data Rules

Internal Revenue Code §7216 makes it a criminal offense for a tax return preparer to knowingly or recklessly use or disclose taxpayer return information for any purpose other than preparing that taxpayer's return, without written consent. Penalties reach $1,000 and up to one year in prison per violation, with additional civil penalties of $250 per disclosure under §6713.

The rule matters more in 2026 than it ever has, because two things changed: tax work moved to the cloud, and firms started feeding client documents to AI tools. Both are disclosures in the eyes of the regulation.

Who counts as a "tax return preparer"

Broader than most people assume. Treasury Regulation §301.7216-1(b)(2) defines the term to include not just the person signing the return, but also:

• Anyone who prepares a return, or assists in preparing one, for compensation
• A person who develops software that is used to prepare or file a tax return
• Any Authorized IRS e-file Provider
• Anyone who provides auxiliary services in connection with preparing a return

That means your software vendor is a covered preparer in its own right — directly exposed, not merely contractually obligated to you. When you evaluate a platform that touches taxpayer data, you are evaluating a party that carries the same criminal statute you do.

Use versus disclosure — two separate prohibitions

Term	Definition	Everyday example
Disclosure	Making return information available to any third party	Sending a client's W-2 to an outside bookkeeper or an AI vendor's API
Use	Any circumstance in which the preparer refers to return information for a purpose other than preparing that return	Mining last year's returns to market a financial-planning service, or to train a model

The distinction trips firms up. You can violate §7216 without a single byte leaving your office — internal use for an unrelated purpose is enough.

What the penalties actually are

• §7216 (criminal): a misdemeanor — fine of up to $1,000, imprisonment of up to one year, or both, plus costs of prosecution, per violation.
• §6713 (civil): $250 per prohibited use or disclosure, capped at $10,000 per calendar year. Civil penalties apply whether or not the conduct was knowing or reckless.

The civil penalty is the realistic exposure for a sloppy workflow; the criminal statute is what makes this different from ordinary privacy compliance.

What you can do without consent

Treasury Regulation §301.7216-2 lists the permitted uses and disclosures. The ones that matter most in practice:

Disclosure to other preparers and auxiliary service providers

Under §301.7216-2(d), you may disclose return information to another tax return preparer for the purpose of preparing that taxpayer's return — no consent needed. This is the provision that covers your staff, a contract preparer, and arguably a processing vendor.

There is a hard limit built into it: the recipient must be located within the United States. Disclosure to a preparer or auxiliary service provider outside the US requires the taxpayer's written consent under §301.7216-3. For a cloud or AI vendor, this makes "where is the processing actually happening?" a compliance question, not an infrastructure trivia question.

Anonymous statistical compilations

Under §301.7216-2(o), you may produce anonymous statistical compilations of return information to support your own business. The conditions are strict: no figure may be derived from fewer than ten returns, and the compilation may not be sold or otherwise disclosed for compensation.

Aggregate accuracy statistics qualify. A record-level corpus of a thousand returns does not.

Other common exceptions

• Disclosures to the taxpayer themselves, or to their designee under a valid authorization
• Disclosures required by court order, subpoena, or federal or state law
• Disclosures for the preparer's own use in a legal proceeding or professional ethics investigation
• Retention of records and quality or peer reviews

When you do need consent — and how it must look

Consent under §301.7216-3 is not a checkbox buried in an engagement letter. For Form 1040-series returns, Revenue Procedure 2013-14 sets mandatory formatting and language. The requirements include:

1. A separate written document for each consent — one for use, one for disclosure; they cannot be combined into a general waiver
2. Signed and dated by the taxpayer before the use or disclosure occurs
3. Identification of the specific recipient and the specific purpose — open-ended consents are invalid
4. Mandatory statutory language telling the taxpayer that federal law does not require consent and that consent is voluntary
5. A duration; if none is stated, the consent expires one year from the date signed
6. Additional mandatory warning language when the recipient is located outside the United States

Two rules that catch firms out:

• You cannot condition your services on consent. Refusing to prepare a return unless the client signs a marketing consent invalidates the consent.
• You generally cannot ask twice. If a taxpayer declines, the regulations bar a second request for a substantially similar consent for that tax year. A consent campaign that goes badly cannot be retried.

The AI question every firm is asking

"Can I paste a client's W-2 into ChatGPT?" It is the right question, and the answer depends on three things.

Scenario	§7216 analysis
Sending a client's documents to an AI service to prepare that client's return, US-hosted, under a contract	Most defensibly covered by the auxiliary service provider provision in §301.7216-2(d). Get the no-training terms in writing.
Same, but the model or vendor processes outside the US	Requires taxpayer consent with the offshore-specific mandatory language.
Using client returns to train or fine-tune a model, or to build a product	A use beyond preparing that taxpayer's return. Needs consent — or de-identification, which needs no one's permission.
Pasting return data into a free consumer chatbot with default terms	Hard to defend. Consumer terms typically permit the provider to use inputs to improve its service, which is a use beyond preparing that return.

The practical takeaway: the tool matters less than the contract behind it. Before any client data reaches an AI vendor, get a written data-processing agreement that confirms US processing, no use of your data for model training, and defined retention and deletion.

A workable compliance posture

1. Add §7216 consent language to your engagement letter process for the coming season, drafted to the Rev. Proc. 2013-14 format as separate documents. Every return from that point forward is covered. This is the cheapest fix available.
2. De-identify historical data rather than chasing consent. For testing, analytics, or model work you need amounts and layouts, not names and Social Security numbers. De-identification requires no consent, and it avoids the no-second-request trap.
3. Inventory every third party that touches return information — cloud storage, e-signature, OCR, AI, offshore staffing, your practice management platform. Each one is a disclosure. Each one needs a basis.
4. Get the vendor terms in writing. "We don't train on your data" in a marketing page is not a contract term.
5. Document your reasoning. §7216 turns on knowing and reckless conduct; a written analysis of why a disclosure fit an exception is meaningful evidence.

How §7216 fits with your other obligations

§7216 governs what you may do with taxpayer data. It sits alongside, and does not replace, your duty to protect that data. The FTC Safeguards Rule requires every tax firm to maintain a documented security program — see our guide to WISP requirements for tax firms under the FTC Safeguards Rule for what that plan must contain.

The IRS covers both themes in Publication 4557, Safeguarding Taxpayer Data, and maintains a dedicated Section 7216 Information Center with current guidance and examples.

Frequently asked questions

Does §7216 apply to my software vendor, or only to me?

Both. Treasury Regulation §301.7216-1(b)(2) expressly includes anyone who develops software used to prepare or file a return, and any Authorized IRS e-file Provider. Your vendor is a covered preparer with its own criminal exposure — which is a reasonable thing to ask about during procurement.

Does my engagement letter cover §7216 consent?

Usually not. For 1040-series returns, Rev. Proc. 2013-14 requires consent to be a separate written document with specific mandatory language, a named recipient, and a stated purpose. A general clause inside a longer engagement letter does not satisfy that format.

Can I use a cloud platform to store client documents without consent?

Storage and processing in connection with preparing that client's return generally falls within the permitted disclosures in §301.7216-2, provided the provider is located in the United States. Offshore processing changes the answer and requires consent.

Can I use my client returns to train an AI model?

Not without consent. Training is a use beyond preparing those taxpayers' returns, and the commercial purpose puts it outside the statistical-compilation provision. De-identifying the data first is the cleaner path — de-identified information is no longer taxpayer return information, so no consent is required.

What is the difference between §7216 and §6713?

They cover the same conduct with different penalties. §7216 is the criminal statute and requires knowing or reckless conduct. §6713 is a strict-liability civil penalty of $250 per violation, capped at $10,000 per calendar year, that applies regardless of intent.

Do I need consent to send a client's return to their mortgage lender?

Yes. Disclosure to a third party at the taxpayer's request still requires a valid §7216 disclosure consent identifying that recipient, unless it is made under a separate authorization such as Form 4506-C or a properly executed power of attorney.

Where XyloDocs fits

XyloDocs is an AI tax workflow platform for tax firms: clients send documents by SMS, WhatsApp, email, or portal; the platform organizes them by client and tax year, handles bilingual status communication, and exports a clean package to the firm's tax software. Because that workflow is a disclosure of return information, we treat the §7216 questions above as product requirements — see our security controls and data handling practices, or review the full feature set to see how documents move through the system.

Last verified: August 9, 2026 This article is general information about federal tax practice rules, not legal advice. §7216 is a criminal statute and its application is fact-specific — consult a tax attorney about your firm's particular use of client data, especially before any AI or analytics project.