IRC §7216 Consent: When Tax Preparers Need One (2026)

PLAIN-ENGLISH GUIDE · UPDATED SEPTEMBER 2026

Federal law makes it a crime for a paid tax preparer to share a client’s tax information — or use it for anything besides preparing their return — without the client’s signed permission first. That permission is called a consent, and the law behind it is Internal Revenue Code Section 7216. It has to be in writing, signed and dated before anything is shared, and it has to say who gets what, and why.

Do I need one? →Already have practice software? ↓

The short version

Sharing a client’s tax information outside your firm, or using it for something other than their return, needs a signed consent first.
The consent names who gets the information, exactly what they get, and why.
You cannot make it a condition of doing the return.
The client gets a copy when they sign. If it does not say how long it lasts, it lasts one year.

Do I need a consent? Common situations

The rule covers the return itself, the documents behind it, and figures worked out from it — an income estimate typed into an email counts the same as the return attached to it.

Situation	Consent needed?	Why
Sending a client’s figures or documents to their financial advisor	Yes, to share	It leaves your firm. The consent names the advisor, the information and the purpose. (Treas. Reg. §301.7216-3(a))
Sending a return or income figures to a client’s mortgage lender or bank	Yes, to share	Same rule. The client can always hand over their own copy — the law limits the preparer, not the taxpayer.
Using what is on a client’s return to offer them something that is not tax or accounting work — investments, insurance, a loan	Yes, a separate consent to use	Using the information is covered as well as sharing it, and a consent to use must be its own document. (§301.7216-3(c)(1))
Having part of a return prepared or reviewed by someone outside the United States	Yes	The no-consent exceptions for other preparers stop at the U.S. border, and there are extra limits on Social Security numbers for individual clients. (§301.7216-2(c), (d); §301.7216-3(b)(4))
Staff inside your own firm working on the return	No	Your own people preparing the return, in the U.S. (§301.7216-2(c))
Another U.S. preparer helping with the return, or your e-file or tax software provider	No	Help with preparing and filing the return itself. (§301.7216-2(d))
A CPA or law firm using the information for its own other accounting or legal work for the same client	No	A narrow exception for firms practicing accountancy or law. (§301.7216-2(h))
Answering a subpoena or court order	No	(§301.7216-2(f))
Your firm’s peer review or quality review	No	(§301.7216-2(p))

What the consent has to say

Every Section 7216 consent, for every kind of client, must include:

Your firm’s name and the client’s name
Who will receive the information, when it is being shared
Exactly what information
Why — the purpose
The client’s signature and the date they signed

Treas. Reg. §301.7216-3(a)(3)

And five rules about how it is used:

Signed before anything is shared. A consent collected afterwards does not cover what already went out. (§301.7216-3(b)(1))
Sharing and using are separate documents. One form cannot authorize both. (§301.7216-3(c)(1))
The client gets a copy when they sign. (§301.7216-3(c)(3))
It cannot be a condition of the work. A consent the client had to sign to get their return done is not valid. (§301.7216-3(a)(1))
Timing matters for anything unrelated to tax prep. You cannot ask for a consent to market unrelated services after you have handed over the finished return for signature. (§301.7216-3(b)(2))

Extra rules for individual clients who file a Form 1040

For individual clients, the IRS adds requirements for the form itself in Revenue Procedure 2013-14:

Its own document, about nothing but the consent — on paper or on screen. (Rev. Proc. 2013-14 §5.01, §5.03)
On paper: at least 8½ by 11 inches, and at least 12-point type. (§5.02)
Wording the IRS prescribes, including that the client does not have to sign to get their return prepared, and how to report misuse to the Treasury Inspector General for Tax Administration. (§5.04)
The client chooses each item. When one consent covers several items, the client must be able to pick each one; a form where they have to untick what they do not want is not allowed. (§5.04(2), §5.05)

Business clients that do not file a Form 1040 are outside Rev. Proc. 2013-14. Their consent still needs everything in the section above, but it can be in any format — including your engagement letter. (§301.7216-3(a)(3)(iii))

What it costs to get wrong

Kind	Penalty
Criminal	A misdemeanor: a fine of up to $1,000 ($100,000 when the disclosure is tied to identity theft), up to one year in prison, or both, plus the costs of prosecution. (IRC §7216(a))
Civil	$250 for each disclosure or use, up to $10,000 a year — $1,000 each and up to $50,000 a year when tied to identity theft. (IRC §6713)

The criminal provision reaches disclosures made knowingly or recklessly. In practice the exposure for a small firm is rarely one dramatic leak — it is a routine email to an advisor or a lender that nobody thought of as a disclosure.

Already have practice management software you like?

Most firms do not need new software to get this right. They need the consent part: send it, get it signed, keep the proof, and know the moment a client withdraws it. CPA Hub does this inside the product today. We are deciding whether to offer it on its own, for firms that are happy with what they already use.

If you would use it, put your name down. You will hear from us once, when there is something to try.

Frequently asked questions

Is a Section 7216 consent the same as an engagement letter?

For individual clients who file a Form 1040, no — the consent has to be its own document, about nothing but the consent. For business clients that do not file a 1040, the consent can be in any format, including your engagement letter.

How long does a Section 7216 consent last?

As long as the consent says. If it does not say, it lasts one year from the date the client signed it.

Can a client refuse to sign and still have their return prepared?

Yes. A firm cannot make the consent a condition of doing the return. A consent the client was required to sign is not a valid consent.

Does Section 7216 apply to enrolled agents and non-CPA preparers?

Yes. It applies to anyone in the business of preparing returns, or of providing services connected with preparing them — CPA, enrolled agent, attorney or unlicensed preparer alike.

Is Section 7216 the same as the FTC Safeguards Rule?

No. The Safeguards Rule is about keeping client information secure. Section 7216 is about who you may share it with and what you may use it for. Most tax firms answer to both.