Any Five Digits Will Do: The IRS, ICE, and Section 6103
By Jason B. Freeman
On September 8, 2026, the D.C. Circuit affirmed an order blocking the IRS from sending taxpayer address information to Immigration and Customs Enforcement through an automated process that disclosed 47,289 records in the summer of 2025. The unanimous panel held that the IRS “Data-Exchange Procedure” likely violates the section 6103 taxpayer confidentiality rules. It also held that an unpublished, internal IRS procedure is a final agency action that a court can review under the Administrative Procedure Act. The first holding impacts immigration enforcement. The second one reaches every tax practitioner who has ever wanted to challenge how the IRS actually runs a program.
The statute expressly required ICE (the requesting agency) to provide each requested taxpayer’s name and address to qualify for the exception that otherwise statutorily prohibits disclosing taxpayer information. The IRS’s system merely checked whether ICE provided an address field that held five or nine digits (apparently a proxy for a zip code), whether or not that information was associated with the taxpayer. If so, the IRS’s procedure automatically validated the request and generated the taxpayer information to provide to ICE–no more questions asked. Any random five digits would do.
What the D.C. Circuit Decided
The unanimous panel in Center for Taxpayer Rights v. Internal Revenue Service, No. 26-5006, affirmed the lower court’s November 21, 2025 order in the U.S. District Court for the District of Columbia, which stayed the procedure under 5 U.S.C. § 705, barred further disclosures except in strict compliance with section 6103(i)(2), and required the IRS to notify the district court before answering any new request from the Department of Homeland Security.
Because the case involves an appeal of a preliminary injunction, the court asked whether the plaintiffs are likely to succeed, not whether they’ve actually won. It concluded that they are, and it didn’t hedge: “The Data-Exchange Procedure indisputably contravenes the requirements of section 6103.”
The opinion begins with some history. Congress rewrote section 6103 in 1976 after Watergate-era misuse of tax information, resulting in a statute that makes returns and return information confidential unless a specific exception applies. The exception at issue, section 6103(i)(2), allows the IRS to disclose return information other than taxpayer return information for a nontax federal criminal investigation. But it comes with conditions. The request must state “the name and address of the taxpayer,” the taxable period, the statutory authority, and “the specific reason or reasons why such disclosure is, or may be, relevant.” The information may go only to officers “personally and directly engaged in” the investigation.
How the Procedure Worked
The IRS and DHS signed a memorandum of understanding in April 2025 setting out how ICE would request addresses under section 6103(i)(2). In February 2026, a different D.C. Circuit panel held in Centro de Trabajadores Unidos v. Bessent, 167 F.4th 1218, that the memorandum was a nonbinding policy statement and not final agency action.
On June 27, 2025, ICE requested the last known addresses of some 1.28 million people. The IRS built an automated procedure to process the requests. According to the opinion, its screening step checked that required fields weren’t empty. The address field passed if it contained any five- or nine-digit number. When ICE supplied a taxpayer identification number, the system returned the taxpayer’s address on file regardless of what ICE had typed in the address field. More than 90 percent of the 47,289 records the IRS produced came through that TIN-matching route, and for more than 90 percent of the matches the procedure never checked whether ICE had provided a valid address.
The government didn’t defend every disclosure. The court recorded counsel’s statement at argument that “the Government would readily admit that there were mistakes made[,] that some information was disclosed not in compliance with the statute.” It also noted the acknowledgment that some transfers were “concededly unlawful.”
The “specific reason” requirement fared no better. ICE’s requests carried the same general statement of relevance across the board. “It beggars belief to call that vague, unbounded reasoning ‘specific,'” the court wrote, though it left open whether that defect was a one-time failure or a permanent feature of the procedure.
Is an IRS Script Reviewable?
Yes, if it binds the people who run it. The IRS argued that its procedure was never published and never announced, so there was no agency action to review. The court disagreed. Finality under the APA turns on whether an action marks the consummation of the agency’s decision-making and fixes rights or obligations, not on whether anyone printed it in the Federal Register. The procedure was written, it bound IRS employees, it ran on demand, and it replaced the individualized review the IRS had previously performed under Internal Revenue Manual 11.3.28.2. “We accordingly hold that the Data-Exchange Procedure is final agency action reviewable under the APA.”
The court described the shift as a move from individualized review “to a mass, automated review of millions of records at the press of a button.” That description fits a lot of what the IRS does now. Automated underreporter matching and computer-generated penalty assessments both run on procedures that bind employees and operate at scale.
Tax practitioners have spent the last five years learning the avenues for APA challenges against the IRS. CIC Services held that the Anti-Injunction Act didn’t bar a taxpayer’s pre-enforcement challenge to a reporting notice. Courts then set aside Notice 2007-83 and the micro-captive notice for skipping notice and comment, and Loper Bright changed the standard for challenging Treasury regulations. Those cases were about published guidance. This one holds that unpublished operating procedures count too.
Two limits. The Anti-Injunction Act wasn’t at issue, because disclosing an address isn’t the assessment or collection of tax, and a challenge to an automated assessment program would have to clear that bar first, as our discussion of sovereign immunity and the Anti-Injunction Act explains. And the decision binds courts in the D.C. Circuit. Outside of that, it’s persuasive authority, although venue rules often allow plaintiffs to sue federal agencies in the District of Columbia.
Section 7431 Didn’t Block Review
The government’s second argument was that Congress had already chosen the remedies for unlawful disclosure: civil damages under section 7431 and criminal penalties under section 7213. If those remedies were exclusive, the APA would be off the table. The court found those remedies too narrow to displace the APA: “We decline to conclude that Congress, by attaching criminal and civil consequences to individual employees’ violations of section 6103, meant to bar APA review of IRS policies implementing the section.”
That’s a sensible reading of the damages statute, which works after the fact. Section 7431(c) awards the greater of $1,000 for each act of unauthorized disclosure or actual damages, plus punitive damages for willful or grossly negligent disclosures. A $1,000 check doesn’t un-send a file.
Section 7431 is still the route for an individual taxpayer whose information was sent. The claim runs against the United States, and it must be filed within two years after the taxpayer discovers the unauthorized disclosure. The statute also gives the government a defense for disclosures resulting from a good-faith but erroneous interpretation of section 6103.
What Happens Next
The D.C. Circuit withheld its mandate, which is routine while the rehearing period runs. Because the United States is a party, the government has 45 days from the September 8 judgment to seek panel or en banc rehearing, and a certiorari petition would follow on its own clock. The district court’s order remains in effect throughout, and the case returns there for further proceedings on the merits.
The court closed with a warning that sounds like it was written for the next case: “The IRS is now on notice twice over regarding the legal inadequacies of its summer 2025 disclosures.”
What Practitioners Should Do
For clients who file with ITINs, and for mixed-status households, the immediate advice is continuity. The injunction is in place, disclosures require strict statutory compliance and advance notice to the court, and nothing in the decision changes a taxpayer’s filing obligations. The Taxpayer Bill of Rights lists confidentiality among the rights that section 6103 protects, which may require a fresh explanation to clients.
For clients who believe their information was disclosed, document the date they first learned of it. The two-year period in section 7431(d) runs from discovery, and the government will argue that September 2026 press coverage started the clock. Requests under the Freedom of Information Act and the Privacy Act can help build the record, and the district court docket in No. 1:25-cv-00457 describes the categories of data involved.
For practitioners challenging IRS operations generally, the opinion is a template. Identify the written procedure, demonstrate that it binds employees, compare it to the Internal Revenue Manual and to what the IRS has said in public, and show that it runs without individualized review. Our tax litigation and tax controversy practice has been building APA challenges on the same foundation.
Questions
Can the IRS share my tax information with other federal agencies?
Only under an exception in section 6103. For a nontax criminal investigation, section 6103(i)(2) requires a written request that states the taxpayer’s name and address, the taxable period, the statutory authority, and the specific reason the information is relevant. The D.C. Circuit held that the IRS’s automated process for ICE requests likely didn’t meet those conditions.
Does this decision stop all sharing with ICE?
No. It blocks disclosures that don’t strictly comply with section 6103(i)(2) and requires the IRS to notify the district court before responding to new DHS requests. Disclosures that satisfy the statute remain possible, and the earlier Centro decision upheld the April 2025 memorandum of understanding itself.
Can I sue if the IRS disclosed my information unlawfully?
Section 7431 allows a civil action against the United States for knowing or negligent unauthorized disclosure. Damages are the greater of $1,000 per act or actual damages, with punitive damages available for willful or grossly negligent disclosure. The suit must be filed within two years of discovering the disclosure, and the government can raise a good-faith defense.
This article is provided for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship. The law is fact-specific and subject to change, and readers should consult qualified counsel about their particular circumstances.
