When Do You Need Section 7216 Consent From Clients?

Section 7216 is a criminal statute governing when you can disclose or use a client’s tax return information for anything beyond preparing that return. Doing it without valid consent, where consent is required, carries real criminal exposure. That’s separate from anything the FTC Safeguards Rule covers. Most disclosures and uses outside a narrow set of exceptions need the client’s consent, and that consent has to follow a specific format the IRS has already prescribed. Two of the situations firms miss most often: sending data to a preparer outside the U.S., and running client information through a general-purpose AI tool.

Key takeaways

• Section 7216 is a criminal statute governing disclosure or use of tax return information, separate from and in addition to the FTC Safeguards Rule.
• Consent is required for most disclosures or uses beyond preparing the return itself, unless a specific exception in the regulations applies.
• The consent form’s format is legally prescribed. A separate document for each disclosure or use, no blank spaces left to fill in later, and it can’t be a condition of doing business with you.
• Sending client data to a preparer located outside the U.S. is one of the clearest, most commonly missed triggers, and it requires its own specific language on top of standard consent.
• Running client data through a general-purpose AI tool likely doesn’t fit the narrow exceptions either, which is the legal mechanism underneath the broader shadow AI problem.

Why this is a criminal statute, separate from your WISP

Section 7216 makes it a criminal offense to knowingly or recklessly disclose or use a client’s tax return information for anything outside preparing that return, without valid consent where consent is required. A related provision, Section 6713, adds civil penalties on top of that for the same unauthorized disclosure or use.

That’s a different category of exposure than most of what a WISP covers. The FTC Safeguards Rule and IRS Publication 4557 govern how you protect data you’re allowed to have. Section 7216 governs whether you’re allowed to send that data somewhere, or use it for something, at all. Your firm can have a fully compliant WISP and still violate 7216 if a specific disclosure never had the consent it needed.

When do you actually need consent?

Consent isn’t required for the disclosures and uses the regulations already carve out, things like sharing information with your own staff to prepare the return, or transmitting it to the IRS for e-filing. Outside those specific exceptions, most other disclosures or uses need the client’s written consent before they happen.

The definition of “tax return preparer” under these rules is deliberately broad. It covers anyone in the business of preparing or assisting with returns, any employee whose work supports that process, and any business providing auxiliary services connected to preparation. The person who signs the return is only one of many roles it reaches. If your firm is unsure whether a disclosure or use falls inside an existing exception or needs a signed consent, that’s a question worth putting to counsel directly. Guessing carries real stakes if the answer turns out to be no.

What does the consent form actually have to look like?

The format isn’t left up to your firm’s judgment. Revenue Procedure 2013-14 prescribes specific rules for any consent involving a client filing a Form 1040-series return, and getting the format wrong can invalidate a consent even if the client genuinely agreed to it.

None of this is the kind of thing to reconstruct from memory or a template found online. The exact required language changes based on what’s being disclosed and to whom, and the current mandatory language lives in Rev. Proc. 2013-14 itself. A firm building or updating its consent forms should be working from that source directly, with counsel.

Why offshoring is one of the clearest triggers

Sending a client’s Social Security number or other tax return information to a preparer located outside the United States requires consent, and it requires specific additional language on top of the standard disclosure consent.

This is one of the more commonly missed triggers because the relationship itself often looks routine from the firm’s side. A review service, a data entry vendor, an outsourced preparation arrangement, all of these can trigger it. The regulation cares about the location of the preparer receiving the data. How routine the arrangement feels doesn’t factor in. If any part of your firm’s workflow sends client tax information to a preparer outside the U.S., confirm that against the actual consent requirement directly. A general engagement letter likely doesn’t already cover it.

Where AI tool use fits into this

Section 7216’s exceptions were written for specific, known categories: your own staff, e-file transmission, quality review, and a handful of others defined in the regulations. A general-purpose AI tool that a staff member pastes client data into doesn’t obviously fit any of them.

That’s the legal mechanism underneath a problem Verito has covered from the governance side. When client data goes into a consumer AI tool without a firm’s knowledge or approval, the practical risk is losing control of that data. The legal question underneath it is whether that disclosure or use ever had valid consent behind it. The consent mechanics are the focus here. Deciding what tools are approved and building a policy around them is a separate question worth its own read.

This isn’t legal advice. The exact consent language your firm needs should come from counsel working directly from Rev. Proc. 2013-14. What’s true regardless: the exposure is real, it’s separate from your WISP, and it doesn’t wait for a firm to have a policy before it applies.

Talk to us about your firm’s compliance documentation →