Yes, your employer can send your W-2 electronically, but not simply as an attachment to a regular email. Under IRS rules, W-2s can be emailed or otherwise delivered electronically only after you have given specific written consent, received a list of required disclosures, and the delivery method actually protects the sensitive data on the form. Plain, unencrypted email meets the first two conditions on paper but fails the third, which is why most employers use a secure portal instead.
Electronic Delivery Requires Your Consent First
The rule that governs this is straightforward: before an employer can deliver a W-2 in any electronic format, the employee has to affirmatively agree to receive it that way. Silence is not consent. You have to take a clear action showing you agree, and that action has to demonstrate you can actually open the file in whatever format the employer plans to use. If the employer intends to post W-2s as PDFs, having you log in and download the consent document as a PDF proves you can handle that file type and satisfies the requirement.
If you never consent, the employer has to send you a paper W-2. The same applies if you consented at some point and later changed your mind. Employers can decide whether a withdrawal of consent takes effect immediately or on a specific later date, and they can treat a request for a paper copy as an automatic withdrawal. Once your withdrawal is effective, the employer cannot deliver that year’s W-2 electronically.1Internal Revenue Service. Publication 15-A (2026), Employer’s Supplemental Tax Guide
What the Employer Has To Tell You Before You Consent
The IRS does not let employers collect consent without first giving you a conspicuous written statement covering all of the following:
- You will receive a paper W-2 if you don’t consent to electronic delivery.
- How long the consent lasts and what it covers.
- How to request a paper copy after consenting, and whether that request counts as withdrawing consent entirely.
- How to revoke consent, when the revocation takes effect, how the employer will confirm it, and the fact that withdrawing consent doesn’t affect W-2s already issued.
- Any circumstances in which electronic delivery will stop automatically, such as leaving the company.
- How to update your contact information so you keep receiving electronic W-2s.
- A commitment from the employer to notify you if its own contact information changes.
If any of these disclosures is missing, the consent isn’t valid. An electronic W-2 furnished without valid consent hasn’t legally been furnished at all, which exposes the employer to the same penalties as if they had never sent one.1Internal Revenue Service. Publication 15-A (2026), Employer’s Supplemental Tax Guide
Why Regular Email Is a Bad Way To Send a W-2
Nothing in the IRS regulations uses the word “email” or forbids it by name. The rules talk about “electronic format” without dictating a channel. In principle, an employer with valid consent and disclosures in place could argue that emailing a W-2 satisfies the rules. In practice, this is where the compliance case falls apart.
A W-2 contains your Social Security number, full legal name, home address, and detailed income information. Standard email transmits in plain text and sits unencrypted on mail servers, forwarding servers, and the recipient’s inbox. Anyone who gains access to that inbox, whether through a data breach, a phishing attack, or a shared computer, can read the form. The IRS’s own guidance on sending sensitive documents by email requires encrypting every attachment with a strong password of at least twelve characters and communicating that password separately, by phone. Putting the password in the same email defeats the purpose.2Internal Revenue Service. Sending and Receiving Emails Securely
Even encrypted email lacks the access controls a secure portal offers. There’s no way to confirm you opened the file, no audit trail if something goes wrong, and no way to revoke access after delivery. For an employer handling dozens or hundreds of W-2s, coordinating individual encrypted attachments and separate phone calls for passwords isn’t realistic. So while emailing a W-2 is not flatly prohibited, doing it in a way that actually meets the IRS security expectation is difficult enough that most payroll professionals don’t try.
How Compliant Electronic Delivery Actually Works
The standard method is a secure online portal. The employer uploads or generates each W-2, and you log in with unique credentials to access your own form. The portal encrypts data both in transit and at rest, logs access attempts, and lets you download or print copies whenever you need them. Every major payroll platform works this way.
A common variant uses email only as a notification channel. You receive a message telling you the W-2 is ready and containing a link, not the form itself. Clicking the link takes you to a separate secure site where you authenticate before viewing or downloading the document. The tax data never sits in your inbox.
Whichever method the employer chooses, it has to protect data during both transmission and storage. And if the employer changes the technology needed to access the forms, it has to notify you before the change, describe the new hardware or software requirements, and collect fresh consent. An employee who can’t open the file under the new system hasn’t received the W-2, and the employer’s obligation hasn’t been met.1Internal Revenue Service. Publication 15-A (2026), Employer’s Supplemental Tax Guide
The electronic system also has to stay accessible through at least October 15 of the filing year. If the portal shuts down before then and you haven’t downloaded your form, you may need it during that window for amended returns or state filings.
What To Do If Your Employer Emailed Your W-2
If your W-2 arrived as an ordinary email attachment with no password protection, the form is still valid; the IRS rules govern the employer’s conduct, not the tax status of the information itself. But the exposure of your Social Security number and wage data is real. A few practical steps:
- Save the file somewhere secure and delete the email from your inbox, sent folder, and trash. If you forwarded it, delete those copies too.
- Ask your employer whether they collected written consent and provided the required disclosures. If they didn’t, tell them the delivery didn’t comply and ask how they plan to secure future forms.
- Watch for signs of identity theft. A W-2 sitting in an email account is the exact data package a scammer needs to file a fraudulent return in your name.
If your W-2 hasn’t arrived at all by the end of January, contact your employer’s payroll or HR department first. Confirm your mailing address is correct for paper delivery, or that your portal account is active for electronic delivery. Most missing-W-2 situations come down to a wrong address or a deactivated login. If you still don’t have the form by the end of February, call the IRS at 800-829-1040 with your name, address, phone number, Social Security number, the dates you worked, and the employer’s name, address, and phone number. The IRS will contact your employer and send you Form 4852 as a substitute.3Internal Revenue Service. If You Don’t Get a W-2 or Your W-2 Is Wrong
The short version for anyone weighing whether to accept electronic delivery: a W-2 sent through a password-protected portal you log into is generally fine. A W-2 that shows up as an attachment in your regular inbox is a signal that your employer is cutting corners on data security, whatever the IRS rules technically permit.