Section 7216 of the Internal Revenue Code makes it a federal crime for a tax return preparer to knowingly or recklessly disclose or use a client’s tax return information for any purpose other than preparing that return — unless an exception applies or the client signs a valid written consent first.
A violation is a misdemeanor carrying up to one year in prison and a fine of up to $1,000 per violation, plus the costs of prosecution. Its civil companion, IRC §6713, adds $250 per improper disclosure or use with no intent requirement at all.
For most firms, compliance comes down to one document executed correctly and on time. If your firm sends returns to an outsourcing partner, cross-sells financial products, or shares client data with a lender, the 7216 consent form is the control that stands between a routine business practice and a criminal statute.
Key Takeaways
- Consent is the default, not the exception. Unless Treas. Reg. §301.7216-2 specifically permits a disclosure or use, you need signed consent before it happens.
- §6713 is strict liability. The $250-per-disclosure civil penalty applies whether or not the disclosure was knowing or reckless — capped at $10,000 per calendar year.
- Identity-theft-related violations are far costlier. The Taxpayer First Act of 2019 raised the civil penalty to $1,000 per disclosure ($50,000 annual cap) and the maximum criminal fine to $100,000.
- 1040-series consents have their own rulebook. Rev. Proc. 2013-14 governs format, mandatory language, duration, and e-signature standards.
- Offshoring triggers extra requirements. Disclosure to a preparer outside the United States always requires consent, and SSNs must be masked unless specific safeguards and a separate consent are in place.
- Timing is unforgiving. A consent signed after the disclosure has already occurred is not a cure.
What Is Section 7216 and Who Does It Cover?
IRC §7216 is a criminal provision enacted to protect the confidentiality of information taxpayers hand over to preparers. The operative rules live in Treasury Regulations §§301.7216-1 through 301.7216-3.
The definition of “tax return preparer” under these regulations is broader than most practitioners expect. It reaches:
- Anyone in the business of preparing or assisting in preparing returns
- Employees of such a person
- Providers of auxiliary services — including e-file providers, software processors, and service bureaus
- Contractors who receive tax return information from a preparer, who are held to the same standards and penalties
That last point matters. When your firm routes a 1040 to an offshore team or a contract preparer, that party becomes a tax return preparer subject to §7216 in its own right — and your firm remains responsible for the disclosure that put the data there.
“Tax return information” is equally broad. It covers any information furnished in connection with return preparation, in any form, including information the taxpayer supplied verbally, data your firm derived from it, and the fact that a person is even your client.
When Is Consent Required Under Section 7216?
Treas. Reg. §301.7216-2 lists disclosures and uses permitted without consent. Everything outside that list requires a signed consent under §301.7216-3.
No consent needed
- Disclosure to the IRS, or under a court order or subpoena — §301.7216-2(a), (e)
- Preparing a state or local return from the same data — §301.7216-2(c)
- Sharing within your own firm to prepare that client’s return — §301.7216-2(c)
- Disclosure to a U.S.-based preparer assisting with that return — §301.7216-2(d)(1)
- Peer review, quality review, or practice review — §301.7216-2(p)
- Disclosure to your professional liability insurer — Rev. Rul. 2010-4
Consent required
- Disclosure to a non-U.S. preparer or processor — §301.7216-3(b)(4)
- Sending client data to a lender, mortgage broker, or insurance carrier
- Cross-selling wealth management, advisory, or financial products
- Providing data to a third-party vendor for any purpose other than preparing that return
- Using client data to market services unrelated to tax return preparation
A recurring compliance failure lives at the seam between those two lists. Firms correctly learn that sending a return to another preparer for assistance is permitted without consent — then apply that rule to an offshore partner, where it does not hold.
What a Compliant Consent Must Contain
For Form 1040-series clients, Rev. Proc. 2013-14 (as modified by Rev. Proc. 2013-19) sets the format and content requirements. A consent that misses these elements is not merely weak — it is invalid, meaning the disclosure it purported to authorize is unauthorized.
Content requirements
- Identify the intended purpose of the disclosure or use in plain language
- Identify the specific recipient(s), by name
- Describe the particular tax return information being disclosed or used
- State the duration; if left blank, the consent is deemed effective for one year from the signature date
- Include the mandatory federal notice explaining that the client is not required to consent and that information disclosed may not be protected from further use
- Include the TIGTA complaint notice with contact details
- Be signed and dated by the taxpayer before the disclosure or use occurs
Format requirements
- Separate written consents for disclosure and for use — one document cannot silently do both
- Paper consents on 8½″ x 11″ paper in no smaller than 12-point type
- Electronic consents with text at least as large as the site’s standard body text, plus a compliant affirmative e-signature (typed name and date, PIN, or equivalent)
- A copy provided to the client at the time of signing
Timing limits: A preparer cannot condition return preparation on the client signing a consent, and cannot request consent to disclose or use information for soliciting business unrelated to return preparation after handing the completed return to the client for signature.
7216 and Offshoring: The High-Risk Zone
Tax preparation outsourcing is now mainstream, and it is where §7216 exposure concentrates. Three rules govern it:
First, consent is mandatory before any tax return information crosses the U.S. border to a preparer or processor. The permitted-disclosure exception for preparer-to-preparer assistance is limited to preparers located within the United States.
Second, the client’s Social Security Number must be fully masked or redacted before disclosure to a non-U.S. preparer, unless two conditions are both met: the offshore preparer maintains adequate data protection safeguards as defined in the revenue procedure, and the client has specifically consented to disclosure of the SSN.
Third, the consent must be obtained before the data leaves — not before the return is filed, and not at the point the engagement letter is signed unless the consent itself independently meets every §301.7216-3 requirement.
Firms that outsource should pair the consent with vendor due diligence: written data protection commitments, access controls, retention and destruction terms, and the right to audit.
Best Practices for 7216 Compliance
- Map your data flows annually. List every third party that touches client tax data — software, portals, lenders, offshore teams, contractors — and mark which flow relies on which rule.
- Version-control your consent templates. Store executed consents with the return file, not in a general CRM.
- Build consent into the intake workflow, before data leaves your environment, rather than mid-season when the disclosure is already pending.
- Train seasonal staff. Temporary preparers and administrative staff cause a disproportionate share of casual disclosures.
- Track expiration dates. A consent with no stated duration lapses at one year; multi-year engagements need renewals.
- Document refusals. A client’s decision not to consent should be recorded, along with the alternative workflow used.
- Align §7216 with your WISP. Data security plan requirements and §7216 controls reinforce each other, and reviewers increasingly look for both.
Common 7216 Mistakes Firms Make
- Treating the engagement letter as a consent. It is not, unless it independently satisfies every format and content rule.
- Using a single blanket consent to cover both disclosure and use.
- Obtaining consent after data has already been transmitted offshore.
- Bundling consent language into a privacy policy or click-through terms.
- Leaving the recipient described generically (“our service providers”) rather than named.
- Failing to mask SSNs before offshore transmission.
- Assuming verbal or email approval from the client is sufficient.
- Reusing a prior-year consent past its one-year default duration.
Conclusion
Section 7216 compliance is not a seasonal task — it is a data governance discipline that runs year-round. The statute is old, but the exposure is modern: outsourcing, cloud software, client portals, and AI-assisted workflows all create disclosure points that did not exist when the rules were written.
Firms that map their data flows, use compliant consent templates, and obtain signatures before data moves will handle §7216 as routine operations. Firms that treat it as boilerplate are carrying criminal exposure on a $250-per-page technicality.
Frequently Asked Questions
What is Form 7216?
There is no IRS form numbered 7216. “Form 7216” is industry shorthand for the taxpayer consent document required under IRC §7216 and Treas. Reg. §301.7216-3. Firms draft their own, following Rev. Proc. 2013-14.
What is a 7216 consent used for?
It authorizes a tax return preparer to disclose or use a client’s tax return information for a purpose beyond preparing that specific return — for example, offshore preparation support, referrals to a lender, or cross-selling advisory services.
What are the penalties for violating Section 7216?
A §7216 violation is a misdemeanor: up to one year of imprisonment, a fine of up to $1,000 per violation, or both, plus prosecution costs. IRC §6713 separately imposes $250 per improper disclosure or use, capped at $10,000 per calendar year. For violations connected to taxpayer identity theft, those figures rise to $1,000 per disclosure with a $50,000 annual cap, and a maximum criminal fine of $100,000.
Does a client have to sign a 7216 consent?
No. Consent must be knowing and voluntary, and a firm cannot make return preparation conditional on signing. If a client declines, the firm must proceed without the disclosure or use.
How long is a 7216 consent valid?
For the duration the taxpayer specifies. If no duration is stated, it is deemed to expire one year from the signature date.
Do 7216 rules apply to business returns?
Section 7216 applies to income tax returns generally, but the additional format and content rules in Rev. Proc. 2013-14 are specific to the Form 1040 series. Non-1040 consents still must satisfy §301.7216-3.
Can a 7216 consent be signed electronically?
Yes, provided the electronic consent meets the display, type-size, and affirmative e-signature standards in Rev. Proc. 2013-14.
