Form 7216 Consent Form: Valid Requirements and Penalties

A 7216 consent form is a written authorization a tax return preparer must get from you before disclosing or using your tax return information for any purpose other than preparing your return. The label is informal shorthand. The IRS does not publish a fill-in-the-blank version, and the actual IRS Form 7216 is an unrelated filing for corporate transactions under Section 355. Each preparer drafts their own consent document, and it has to follow the technical requirements in Treasury Regulation Section 301.7216-3 and Revenue Procedure 2013-14. A consent that misses even one requirement is treated as no consent at all.¹

When a Preparer Needs Your Consent

A preparer can freely use your information to prepare your return, help with that preparation, or give you tax advice connected to it. Anything outside that narrow lane needs your signed consent (or has to fall within one of the specific regulatory exceptions covered further down).

Outsourcing to a Third Party

When a preparer sends your data to an outside vendor for data entry, processing, or review, that transmission is a disclosure that requires consent. It doesn’t matter whether the vendor is across town or overseas. Offshore outsourcing gets extra scrutiny: if a contractor’s employee located outside the United States can view your information on a server, even without the ability to download or print it, the preparer must get your consent first.²

A narrow carve-out exists for contractors who program, repair, test, or maintain tax preparation software. Their employees can see the data only to the extent necessary for that service, and only if they receive written notice that Sections 7216 and 6713 apply to them personally. Skip the notice and the disclosure becomes unauthorized.²

Marketing Non-Tax Products or Services

Using information from your return to pitch a non-tax product requires consent. Using your reported capital gains to market an investment fund, or your medical expenses to pitch long-term care insurance, both cross the line. The consent has to be specific to the type of service being marketed and the particular data being used. A blanket promotional email to every tax client based on their return data is not permitted without individual consent tied to the specific information and purpose.

Sharing With Affiliated Companies

Sharing a parent company doesn’t create an automatic right to share data. When a financial services firm wants to pass your itemized deductions to its wealth management arm, or route your income data to its insurance division, a signed consent is required. Corporate structure is irrelevant under the regulations.

Analytics and Reporting Separate From the Return

Using tax return information to generate financial reports, run predictive models, or produce analytics separate from preparing the return itself needs consent. Even where nothing is being sold to you, repurposing your data for a non-tax analysis triggers the requirement.

What a Valid Consent Document Has to Contain

The rules are technical and unforgiving. If the document falls short on any of the following, the disclosure is unauthorized.

Voluntary and Not Bundled Into Preparation Services

The consent must be knowing and voluntary. A preparer generally cannot condition tax preparation on your signing a consent; feeling pressured to sign so the preparer will do your return makes the consent invalid.³ The single exception is a consent to outsource the return preparation itself. There, the firm may decline to provide services or adjust its fees if you refuse, because the outsourcing is part of how it delivers the work you hired it for.¹

Specific About Who, What, and Why

Vague, blanket consents are invalid. The document has to name the preparer, name you, identify the exact purpose of the disclosure or use, and specify which items of tax return information are involved. If the preparer only needs your adjusted gross income, the consent cannot authorize handing over your entire return. When information is going to a third party, that recipient must be named.³

A Standalone Document

The consent has to be its own written document. It cannot be buried in an engagement letter’s fine print or blended into general terms of service, though it can be furnished as an attachment to an engagement letter. Multiple disclosure consents can share one document, and multiple use consents can share one document, but disclosure consents and use consents must always sit on separate documents. Where several consents share a page, you must be able to affirmatively select each one individually.¹

Signed Before the Disclosure, With a Stated Duration

The signature has to come before the preparer discloses or uses the information. Retroactive consent doesn’t cure an unauthorized disclosure. The document must state how long the consent lasts. If it doesn’t, it defaults to one year from the signature date.¹

Revocable at Any Time

You can revoke your consent at any time regardless of the stated duration, and the document must explain how. Once the preparer receives your revocation, all disclosure and use for the authorized purpose must stop immediately.

Prescribed Warning Language and Formatting

Revenue Procedure 2013-14 prescribes specific warning language. The exact wording depends on whether the consent covers disclosure to a third party, disclosure in the context of outsourced preparation, or internal use. All three versions open with, “Federal law requires this consent form be provided to you.” They then explain that the preparer cannot disclose or use your information without consent, that signing is not required to receive tax preparation services (with the outsourcing exception), and that the consent runs for the period you specify or one year by default.¹

The disclosure version also warns that once your information reaches a third party, federal law may not protect it from further sharing by that recipient.

Formatting is regulated too. On paper, every page must relate solely to the consent, and the type has to be at least 12-point. On screen, the text must be at least as large as the standard body text used elsewhere on the site or in the software, with sufficient contrast between the text and background.¹

Electronic Consent: Why a Checkbox Isn’t Enough

Consent can be given electronically, but a simple “I agree” button doesn’t cut it. You have to take an affirmative action that both verifies your identity and demonstrates knowing consent. Revenue Procedure 2013-14 allows three methods:¹

A PIN of at least five characters that the preparer assigns and that you manually enter. The software cannot pre-fill the PIN.
Your typed name, followed by pressing enter. The name field cannot be auto-populated.
At least five characters unique to you, such as the answer to a shared secret question, that the preparer uses to verify identity.

The common thread: one-click consent is never valid. You have to do something that shows you actually read and agreed to the specific disclosure or use.

Disclosures That Don’t Require Your Consent

Not every share needs a signed form. The regulations allow a preparer to disclose your information without asking in several narrow situations, including compliance with a court order or subpoena, response to a professional ethics investigation or a PCAOB inspection, reporting a suspected crime to law enforcement, sharing with a related taxpayer whose interests are not adverse to yours (when you haven’t prohibited it), disclosure to the fiduciary of your estate after death or incapacity, and the preparer’s own retention of your records to prepare future returns or respond to an IRS examination.² These exceptions are read narrowly.

What Happens If a Preparer Discloses Without Valid Consent

The penalties stack. Under Section 6713, the IRS can assess a civil penalty of $250 for each unauthorized disclosure or use, capped at $10,000 per preparer per calendar year. When the disclosure is connected to identity theft, the per-violation penalty rises to $1,000 with a $50,000 annual cap, tracked separately from the standard cap.⁴

Section 7216 adds criminal exposure. A preparer who knowingly or recklessly discloses or uses tax return information in violation of the rules commits a misdemeanor punishable by a fine of up to $1,000, up to one year in prison, or both. Where the violation involves identity theft, the maximum fine rises to $100,000.⁵

The IRS Office of Professional Responsibility can also impose censure, suspension, or disbarment from practice before the IRS, and those sanctions are published in the Internal Revenue Bulletin.⁶

You may have your own civil claim. Section 7431 provides a private right of action for unauthorized inspection or disclosure of return information in violation of Section 6103. Successful plaintiffs recover the greater of $1,000 per act or actual damages, plus litigation costs, and punitive damages where the violation was willful or grossly negligent. The statute of limitations is two years from the date you discover the unauthorized disclosure.⁷

1
Internal Revenue Service. Revenue Procedure 2013-14
2
eCFR. 26 CFR 301.7216-2 – Permissible Disclosures or Uses Without Consent of the Taxpayer
3
eCFR. 26 CFR 301.7216-3 – Disclosure or Use Permitted Only With the Taxpayers Consent
4
Office of the Law Revision Counsel. 26 USC 6713 – Disclosure or Use of Information by Preparers of Returns
5
Office of the Law Revision Counsel. 26 USC 7216 – Disclosure or Use of Information by Preparers of Returns
6
Internal Revenue Service. Announcements of Disciplinary Sanctions in the Internal Revenue Bulletin
7
Office of the Law Revision Counsel. 26 USC 7431 – Civil Damages for Unauthorized Inspection or Disclosure of Returns and Return Information