The Taxpayer's Files
Introduction A tax return contains some of the most sensitive information a taxpayer gives the government. Income, addresses, financial relationships, dependents, businesses, and other identifying details may all become part of the federal government’s records.
That is why Congress has generally treated tax information differently from ordinary government records.
It particularly became important after Watergate, when abuses of government access to taxpayer information demonstrated how easily financial records could be used as tools for political or law-enforcement purposes. Congress responded by improving the confidentiality guarantees in 26 U.S.C. § 6103, which generally prohibits the Internal Revenue Service from disclosing tax-return information, except under specifically defined circumstances.¹
In September 2026, the U.S. Court of Appeals for the District of Columbia Circuit ruled that an IRS procedure for responding to Immigration and Customs Enforcement requests for taxpayer information violated § 6103’s statutory requirements. The court described a process under which IRS officials had disclosed tens of thousands of taxpayer records after ICE requests covering more than one million people.²
The dispute raises the question of how much one government agency has the authority to obtain and use information that another agency possesses.
Confidentiality as the Rule
Section 6103 starts with a broad principle: tax returns and return information are confidential.³
But that does not mean there is no disclosure. Congress has created numerous exceptions that allow disclosure for specific purposes. Tax information can, under certain conditions, be shared with state tax authorities, congressional committees, federal prosecutors, and other government officials.³ Some law-enforcement disclosures require a court order or other statutory safeguards.⁴
The design is intentional. Congress did not just tell the IRS to “protect privacy.” It designed a legal system that defined who may receive tax information and what conditions apply. That makes § 6103 more than a privacy policy. It is a limitation on government power.
The Government Already Knows Enough
Modern technology makes those limits particularly important. The federal government possesses enormous databases with information collected for different purposes. The IRS possesses tax records, the Department of Homeland Security possesses immigration information, and the Department of Justice possesses criminal investigation records. Other agencies possess health, benefits, employment, and financial information.
Digital systems make it possible to connect those databases. But that does not necessarily create legal authority. That is at the heart of the current dispute.
The D.C. Circuit explained that § 6103 allows certain disclosures to federal agencies investigating non-tax crimes, so long as the statutory requirements are satisfied.⁵ The court found that the IRS’s specialized procedure did not reliably ensure those requirements were met.
In some instances, the procedure allowed ICE requests to be processed even if the request did not contain an actual taxpayer address or failed to identify an appropriate individual personally and directly involved in a qualifying investigation.²
The problem was not that information had been shared but that the government had created a process for sharing information under conditions which Congress had not authorized.
Information Sharing Is Still Government Action
That distinction matters because modern government is increasingly reliant on interagency cooperation.
There are obvious reasons to share information. Fraud investigations may require financial records, and criminal investigations may require identifying information. Tax records can contain information that is useful to enforcing laws that have nothing to do with taxation.
Congress has recognized these needs by creating exceptions to § 6103.⁴ But the existence of a legitimate governmental objective does not necessarily authorize every way it can be achieved.
An agency cannot necessarily turn a narrow disclosure exception into a general information-sharing system.
The D.C. Circuit treated the IRS’s procedure as final agency action under the Administrative Procedure Act because it determined the conditions under which IRS employees were required to transfer taxpayer information.² The court therefore reviewed not only individual disclosures but the agency’s underlying system for making those disclosures.
From Individual Request to Mass Database
The scale of modern data sharing changes the privacy problem. A request for one person’s tax address is different from a system designed to process requests involving more than one million people.
The D.C. Circuit noted that the ICE-related procedure had already been used in requests concerning approximately 1.28 million taxpayers, while more than 47,000 taxpayer records had ultimately been disclosed.²
A system operating at that scale cannot rely solely on individuals remembering every statutory requirement. It needs safeguards built into the process itself.
That is exactly where the court found a problem. The procedure effectively replaced substantive statutory checks with automated fields that could be satisfied without establishing that the underlying legal requirements had actually been met.²
The technology made disclosure easier. The law required that disclosure remained narrower.
The Privacy Problem
Tax privacy is not about hiding information from the government. People know that filing a tax return requires disclosure. The government has a legitimate reason to collect that information because it has to administer the tax system.
The privacy principle is different: information provided to the government for one lawful purpose does not necessarily become available for all other governmental purposes.
This principle is similar to data-minimization ideas found throughout modern privacy law. A person’s tax information can be legitimately collected for tax administration without becoming an unrestricted source of identity information for another agency.
That distinction is particularly significant when people have no practical choice about providing the underlying information in the first place.
The Watergate Lesson
The history of § 6103 demonstrates why Congress chose a detailed approach to disclosure. Before the reforms that occurred following Watergate, government officials had greater opportunities to obtain and use taxpayer information in politically sensitive circumstances.¹ Congress responded by placing disclosure rules directly into federal law.
The Lesson was that information held by government can itself become a source of power. Congress therefore decided that the executive branch should not be entirely to its own judgment about when taxpayer information could pass between agencies.
The statute creates a structure in which disclosure authority depends on instructions from Congress.
Privacy Versus Enforcement
There is unavoidable tension here. Government agencies need information to enforce the law. Excessive restrictions can make investigations more difficult and prevent agencies from identifying fraud or other crimes.
But unlimited information sharing would create another problem. The government would be in possession of a tremendous network of personal information that could be recombined for purposes far removed from those for which it originally provided information.
The legal question is therefore not whether the government should share information. It is who decides when sharing is permissible.
If Congress establishes a specific exception, agencies may use it within its limits. If agencies can expand those exceptions through internal procedures, then statutory privacy protections become much weaker.
The Digital Government Problem
The modern government does not need to collect new information every time it starts a new investigation. It can search information it already possesses. That creates a new form of government power: the power to connect databases.
The legal system has traditionally focused on whether the government may obtain a particular piece of information. Increasingly it must also consider whether the government may combine information collected by different agencies for different purposes.
The answer will determine the practical meaning of privacy in a digital bureaucracy. A database can make information permanent. An automated system can make disclosure nearly instantaneous. Neither changes the underlying statute.
Why It Matters
The Taxpayer’s Secret matters because tax confidentiality represents a broader principle of limited government.
Citizens cannot avoid the federal tax system; they must always provide the government with sensitive financial information. Congress responded by creating legal boundaries for what the government may do with that information.
Those boundaries matter even when another agency has a legitimate law enforcement purpose. The D.C. Circuit’s September 2026 decision demonstrates why. The question was not about whether ICE’s objectives were important. It was whether the IRS had followed the disclosure rules Congress had written.²
That is a crucial distinction. Government agencies exist to enforce the law. They do not get to rewrite the conditions under which they may obtain information simply because technology makes broader access possible.
Conclusion
The modern government possesses more information than any previous government in American history. That makes the law governing information transfers increasingly important.
Tax returns illustrate the problem particularly well. The government must collect detailed financial information to administer the tax system, but Congress has deliberately restricted how that information can be redistributed.
Those restrictions are not obstacles to government. They are instructions to government. The IRS may possess the information. ICE may need information. But the Constitution’s larger principle is reflected in the statute standing between them: government possession is not government permission.
Center for Taxpayer Rights v. IRS, No. 26-5006, slip op. at 2–4 (D.C. Cir. Sept. 8, 2026). The court discussed the history of § 6103 and Congress’s response to abuses involving taxpayer information exposed during Watergate.
Id. The D.C. Circuit held that the IRS’s Data-Exchange Procedure was final agency action reviewable under the Administrative Procedure Act and likely contrary to § 6103.
I.R.C. § 6103. The IRS explains that § 6103 generally prohibits disclosure of tax information while establishing specified exceptions.
I.R.C. § 6103(i). Under the statute, certain disclosures to federal law enforcement agencies for non-tax criminal investigations require specified statutory conditions, including court involvement in some circumstances.
Center for Taxpayer Rights, slip op. at 19–22. The court concluded that the IRS procedure failed to ensure compliance with statutory requirements concerning taxpayer addresses and identification of personnel personally and directly engaged in qualifying criminal investigations.
Comments