{"id":8144,"date":"2026-09-24T06:35:00","date_gmt":"2026-09-24T10:35:00","guid":{"rendered":"https:\/\/verito.com\/blog\/?p=8144"},"modified":"2026-09-03T11:26:14","modified_gmt":"2026-09-03T15:26:14","slug":"section-7216-consent-requirements","status":"publish","type":"post","link":"https:\/\/verito.com\/blog\/section-7216-consent-requirements\/","title":{"rendered":"When Do You Need Section 7216 Consent From Clients?"},"content":{"rendered":"\n<p><strong>Section 7216 is a criminal statute governing when you can disclose or use a client\u2019s tax return information for anything beyond preparing that return. Doing it without valid consent, where consent is required, carries real criminal exposure. That\u2019s separate from anything the FTC Safeguards Rule covers. Most disclosures and uses outside a narrow set of exceptions need the client\u2019s consent, and that consent has to follow a specific format the IRS has already prescribed. Two of the situations firms miss most often: sending data to a preparer outside the U.S., and running client information through a general-purpose AI tool.<\/strong><\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>Key takeaways<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Section 7216 is a criminal statute governing disclosure or use of tax return information, separate from and in addition to the FTC Safeguards Rule.<\/li>\n\n\n\n<li>Consent is required for most disclosures or uses beyond preparing the return itself, unless a specific exception in the regulations applies.<\/li>\n\n\n\n<li>The consent form\u2019s format is legally prescribed. A separate document for each disclosure or use, no blank spaces left to fill in later, and it can\u2019t be a condition of doing business with you.<\/li>\n\n\n\n<li>Sending client data to a preparer located outside the U.S. is one of the clearest, most commonly missed triggers, and it requires its own specific language on top of standard consent.<\/li>\n\n\n\n<li>Running client data through a general-purpose AI tool likely doesn\u2019t fit the narrow exceptions either, which is the legal mechanism underneath the broader shadow AI problem.<\/li>\n<\/ul>\n<\/blockquote>\n\n\n\n<div class=\"wp-block-rank-math-toc-block\" id=\"rank-math-toc\"><h2 id=\"table-of-contents\">Table of Contents<\/h2><nav><ul><li><a href=\"#why-this-is-a-criminal-statute-separate-from-your-wisp\">Why this is a criminal statute, separate from your WISP<\/a><\/li><li><a href=\"#when-do-you-actually-need-consent\">When do you actually need consent?<\/a><\/li><li><a href=\"#what-does-the-consent-form-actually-have-to-look-like\">What does the consent form actually have to look like?<\/a><\/li><li><a href=\"#why-offshoring-is-one-of-the-clearest-triggers\">Why offshoring is one of the clearest triggers<\/a><\/li><li><a href=\"#where-ai-tool-use-fits-into-this\">Where AI tool use fits into this<\/a><\/li><\/ul><\/nav><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"why-this-is-a-criminal-statute-separate-from-your-wisp\"><strong>Why this is a criminal statute, separate from your WISP<\/strong><\/h2>\n\n\n\n<p><strong>Section 7216 makes it a criminal offense to knowingly or recklessly disclose or use a client\u2019s tax return information for anything outside preparing that return, without valid consent where consent is required. A related provision, Section 6713, adds civil penalties on top of that for the same unauthorized disclosure or use.<\/strong><\/p>\n\n\n\n<p>That\u2019s a different category of exposure than most of what a <a href=\"https:\/\/verito.com\/written-information-security-plan\/\" target=\"_blank\" rel=\"dofollow\" >WISP<\/a> covers. The FTC Safeguards Rule and <a href=\"https:\/\/verito.com\/irs-pub-4557\/\" target=\"_blank\" rel=\"dofollow\" >IRS Publication 4557<\/a> govern how you protect data you\u2019re allowed to have. Section 7216 governs whether you\u2019re allowed to send that data somewhere, or use it for something, at all. Your firm can have a fully compliant WISP and still violate 7216 if a specific disclosure never had the consent it needed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"when-do-you-actually-need-consent\"><strong>When do you actually need consent?<\/strong><\/h2>\n\n\n\n<p><strong>Consent isn\u2019t required for the disclosures and uses the regulations already carve out, things like sharing information with your own staff to prepare the return, or transmitting it to the IRS for e-filing. Outside those specific exceptions, most other disclosures or uses need the client\u2019s written consent before they happen.<\/strong><\/p>\n\n\n\n<p>The definition of \u201ctax return preparer\u201d under these rules is deliberately broad. It covers anyone in the business of preparing or assisting with returns, any employee whose work supports that process, and any business providing auxiliary services connected to preparation. The person who signs the return is only one of many roles it reaches. If your firm is unsure whether a disclosure or use falls inside an existing exception or needs a signed consent, that\u2019s a question worth putting to counsel directly. Guessing carries real stakes if the answer turns out to be no.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-does-the-consent-form-actually-have-to-look-like\"><strong>What does the consent form actually have to look like?<\/strong><\/h2>\n\n\n\n<p><strong>The format isn\u2019t left up to your firm\u2019s judgment. Revenue Procedure 2013-14 prescribes specific rules for any consent involving a client filing a Form 1040-series return, and getting the format wrong can invalidate a consent even if the client genuinely agreed to it.<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Requirement<\/th><th>What it means in practice<\/th><\/tr><\/thead><tbody><tr><td>Separate documents<\/td><td>A consent to disclose and a consent to use can\u2019t share the same document. Each one stands alone.<\/td><\/tr><tr><td>No blank spaces<\/td><td>The form can\u2019t be signed with blanks left to be filled in afterward. It has to be complete when signed.<\/td><\/tr><tr><td>Not a condition of service<\/td><td>You can\u2019t require a signed consent before agreeing to prepare someone\u2019s return.<\/td><\/tr><tr><td>Affirmative only<\/td><td>Consent has to be an active, deliberate yes from the client, never an assumed default.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-separate-consent-1024x576.jpg\" alt=\"Separate client consent documents cinematic visual | Verito\" class=\"wp-image-8158\" srcset=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-separate-consent-1024x576.jpg 1024w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-separate-consent-300x169.jpg 300w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-separate-consent-768x432.jpg 768w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-separate-consent-1536x864.jpg 1536w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-separate-consent-380x214.jpg 380w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-separate-consent-800x450.jpg 800w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-separate-consent-1160x653.jpg 1160w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-separate-consent-150x84.jpg 150w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-separate-consent.jpg 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>None of this is the kind of thing to reconstruct from memory or a template found online. The exact required language changes based on what\u2019s being disclosed and to whom, and <a href=\"https:\/\/www.irs.gov\/pub\/irs-drop\/rp-13-14.pdf\" target=\"_blank\" rel=\"nofollow noopener\">the current mandatory language lives in Rev.&nbsp;Proc. 2013-14 itself<\/a>. A firm building or updating its consent forms should be working from that source directly, with counsel.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"why-offshoring-is-one-of-the-clearest-triggers\"><strong>Why offshoring is one of the clearest triggers<\/strong><\/h2>\n\n\n\n<p><strong>Sending a client\u2019s Social Security number or other tax return information to a preparer located outside the United States requires consent, and it requires specific additional language on top of the standard disclosure consent.<\/strong><\/p>\n\n\n\n<p>This is one of the more commonly missed triggers because the relationship itself often looks routine from the firm\u2019s side. A review service, a data entry vendor, an outsourced preparation arrangement, all of these can trigger it. The regulation cares about the location of the preparer receiving the data. How routine the arrangement feels doesn\u2019t factor in. If any part of your firm\u2019s workflow sends client tax information to a preparer outside the U.S., confirm that against the actual consent requirement directly. A general engagement letter likely doesn\u2019t already cover it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"where-ai-tool-use-fits-into-this\"><strong>Where AI tool use fits into this<\/strong><\/h2>\n\n\n\n<p><strong>Section 7216\u2019s exceptions were written for specific, known categories: your own staff, e-file transmission, quality review, and a handful of others defined in the regulations. A general-purpose AI tool that a staff member pastes client data into doesn\u2019t obviously fit any of them.<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-ai-disclosure-1024x576.jpg\" alt=\"Client tax data entering an AI tool cinematic visual | Verito\" class=\"wp-image-8159\" srcset=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-ai-disclosure-1024x576.jpg 1024w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-ai-disclosure-300x169.jpg 300w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-ai-disclosure-768x432.jpg 768w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-ai-disclosure-1536x864.jpg 1536w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-ai-disclosure-380x214.jpg 380w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-ai-disclosure-800x450.jpg 800w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-ai-disclosure-1160x653.jpg 1160w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-ai-disclosure-150x84.jpg 150w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/section-7216-consent-requirements-ai-disclosure.jpg 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>That\u2019s the legal mechanism underneath a problem Verito has covered from the governance side. When client data goes into a consumer AI tool without a firm\u2019s knowledge or approval, the practical risk is losing control of that data. The legal question underneath it is whether that disclosure or use ever had valid consent behind it. The consent mechanics are the focus here. Deciding what tools are approved and building a policy around them is a separate question worth its own read.<\/p>\n\n\n\n<p>This isn\u2019t legal advice. The exact consent language your firm needs should come from counsel working directly from Rev.&nbsp;Proc. 2013-14. What\u2019s true regardless: the exposure is real, it\u2019s separate from your WISP, and it doesn\u2019t wait for a firm to have a policy before it applies.<\/p>\n\n\n\n<p><a href=\"https:\/\/verito.com\/contact\/\" target=\"_blank\" rel=\"dofollow\"><strong>Talk to us about your firm\u2019s compliance documentation \u2192<\/strong><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"Section 7216 is a criminal statute governing when you can disclose or use a client\u2019s tax return information&hellip;\n","protected":false},"author":12,"featured_media":8157,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-8144","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-knowledge-base"},"acf":[],"_links":{"self":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts\/8144","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/comments?post=8144"}],"version-history":[{"count":2,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts\/8144\/revisions"}],"predecessor-version":[{"id":8160,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts\/8144\/revisions\/8160"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/media\/8157"}],"wp:attachment":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/media?parent=8144"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/categories?post=8144"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/tags?post=8144"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}