If you prepare tax returns for a living, the client data on your screen is not really yours to do with as you please. A short, often overlooked rule in the tax code decides what you can and cannot do with it. That rule is Section 7216, and the consent it requires is something every preparer should understand before sharing a single client file.
This guide explains what the rule is, what counts as using or sharing tax return information, when you need written consent, and what a valid consent form has to say. The aim is to make a dry compliance rule clear enough that you can act on it with confidence. One note before we start: this is general information, not legal advice, so check official guidance or a tax attorney for your specific situation.
The rule is a criminal provision in the Internal Revenue Code that controls how each tax return preparer handles client tax data. In plain terms, it prohibits tax return preparers from knowingly or recklessly disclosing or using tax return information for any purpose other than preparing the return, unless the client has given permission first.
The companion rule, Section 6713, adds a civil penalty for the same conduct. Together they set the boundary the Internal Revenue Service expects every preparer to respect. The full statute lives in the tax code text, and the IRS keeps a plain-language information center that is worth a bookmark. The point to hold onto is simple. The data belongs to the client, and the law treats misuse of it as a serious matter, not a paperwork slip.
The rule turns on two words, so it helps to define them. A disclosure means handing tax return information to someone else, inside or outside your firm. A use means doing something with that information yourself for a purpose beyond preparing the return. Both the sharing and use of that data fall under the rule, and either one without consent can be a problem.
Tax return information is broad. It covers anything you get from the client or generate during return preparation, from income figures to the fact that someone is even a client. So if you take that tax information and email it to an outside service, that is a disclosure. If you mine it to pitch a financial product, that is a use. The phrase use of tax return information is wide on purpose, and the safest assumption is that any use or disclosure beyond the return itself needs a look at whether consent applies.
Here is the part that trips people up, because not every action needs a signed form. You do not need consent for things that are part of normal return preparation, like having staff in your firm provide preparation services on the file or providing the finished return to the client. Sharing with the IRS when required is fine too.
You do need taxpayer consent when the handling steps outside that lane. The common triggers are sending data to a third party, using a return to market other services, sharing information across business lines, or preparing the return with help located outside the United States. That last one matters if you outsource any part of your tax preparation work. The moment client data leaves your firm for an outside preparer, you have a reportable event on your hands, and consent is the thing that keeps it legal. When in doubt, treat the consent step as part of your intake, not an afterthought.
A casual email saying "is it ok if we share your info" does not cut it. The regulations set specific rules for what a valid 7216 consent form has to contain, laid out in Revenue Procedure 2013-14, and a form that misses them is not valid.
At a minimum, it has to identify you as the preparer and name who is receiving the information, describe exactly what is being disclosed and why, and carry the taxpayer's signature and date. It also has to include the required mandatory language, including a line telling the client they are not required to sign. The client controls the scope and the timing, so a consent can be limited to a set period, and it is good practice to let clients know they can decline or limit it, and may revoke their consent at any time later on. One more wrinkle for offshore work: when the information goes to a preparer outside the US, the taxpayer's Social Security number generally cannot be included unless it is masked or protected, so the paperwork and the data handling have to account for that. Each consent must be a separate, standalone document, signed before the disclosure or use happens, never buried in an engagement letter.
This is where the stakes become real. Because the rule carries criminal weight, a knowing or willful violation is a misdemeanor that can bring a fine of up to 1,000 dollars, up to a year in prison, or both, plus the cost of prosecution. These criminal penalties are not theoretical. That is a heavy outcome for mishandling a client file.
The civil side under Section 6713 adds a penalty for each improper sharing or use, and the numbers climb when the violation is tied to identity theft. These penalties exist precisely because tax return information is a prime target for fraud, and a leak of an income tax return can feed exactly the fraud the law is built to prevent. Acting carelessly with client data is not a small risk. It is one the tax code punishes directly.
Outsourcing is one of the most common reasons a firm needs consent, so it deserves its own word. Many US firms send overflow returns to an offshore partner during busy season, and that handoff is a textbook example under the rule. Done right, it is completely legal. You obtain a proper consent, you use a partner with strong controls, and you keep the client informed.
A serious outsourcing partner treats this as standard. At Madras Accountancy, client data is handled under strict data security controls, and we work the way compliant firms expect when they move tax work offshore. If you want to understand the model before you commit, our guide to accounting outsourcing in India walks through how the relationship works. The takeaway is that 7216 is not a reason to avoid outsourcing. It is simply the step you build into the process.
You do not need a law degree to get this right, just a steady routine. Build consent into your client intake so it happens before any data moves. Use compliant, approved forms rather than something you wrote yourself. Keep signed consents on file, store client data securely, and ask any outside partner exactly how they protect what you send them. If your process covers those, you are handling the rule the way it intends, and you can focus on the actual work. If you want help setting up compliant, secure tax support, our team is glad to talk it through.
1. What is Section 7216? It is a criminal rule in the federal tax code that bars any preparer from knowingly or recklessly disclosing or using tax return information for any purpose other than preparing the return, unless the taxpayer consents first. Section 6713 adds a parallel civil penalty for the same conduct.
2. What is a 7216 consent? It is the taxpayer's written permission allowing a preparer to disclose or use their tax return information beyond preparing the return. Without it, actions like sending data to a third party or using a return to market other services can violate the rule. The consent must meet specific federal requirements to be valid.
3. When do I need a consent form? You need one whenever an action falls outside normal return prep. Common triggers include outsourcing returns, sharing data with a third party, cross-marketing services, or using a preparer located outside the US. You do not need consent for routine work inside your firm or for required sharing with the agency.
4. What goes into a valid 7216 consent form? It must identify the preparer and the recipient, describe what information is shared and why, include the IRS mandatory language, and carry the taxpayer's signature and date. It must be a standalone document signed before the sharing happens, and for offshore disclosures the Social Security number generally cannot be included unprotected.
5. What are the penalties for violating the rule? Because it carries criminal weight, a violation is a misdemeanor that brings a fine of up to 1,000 dollars, up to one year in prison, or both, plus prosecution costs. Section 6713 adds civil penalties per improper sharing or use, and those amounts increase when the violation involves fraud.
6. Does outsourcing tax preparation require consent? Yes. Sending client returns to an outside or offshore preparer is a sharing of tax return information, so you need a valid consent before the data leaves your firm. With proper consent and a partner that uses strong data security controls, outsourcing is fully compliant with the rule.
7. Can a taxpayer refuse or limit a consent? Yes. It must tell the taxpayer they are not required to sign, and they control the scope and the time period the consent covers. Many firms also let clients withdraw permission going forward. A taxpayer who declines simply cannot have their information used or disclosed for that purpose.
8. Where can I find the official 7216 rules? The IRS publishes a 7216 information center and a set of frequently asked questions for preparers, and the consent requirements are detailed in Revenue Procedure 2013-14. The statute itself sits in the federal tax code. For your specific facts, confirm with official guidance or a tax attorney.
%2075-100%20(2).png)
An 83(b) election lets a startup founder pay tax on restricted stock at grant, not vesting. Learn how it works and why you must timely file one.
%2075-100%20(4).png)
How the mega backdoor Roth works in 2026: after-tax 401(k) dollars converted to a Roth IRA, so high earners build tax-free retirement savings.
%2075-100%20(7).png)
Form 9465 is the IRS installment agreement request taxpayers file to request a monthly installment plan when they cannot pay in full.
