Lesson 2: IRC §7216: The Foundation

The federal criminal statute that governs everything

Learning Objectives

After completing this lesson, you will be able to:

Identify the three elements of a §7216 violation
Explain what "tax return information" covers and why it is broader than most practitioners realize
Distinguish between "disclosure" and "use" as separate prohibited acts
Describe the criminal and civil penalties and explain why the statute matters even when prosecution is rare
Apply the lesson from the Charles Littlejohn case to your own practice

What §7216 Actually Says

IRC §7216(a) provides, in relevant part:

Any person who is engaged in the business of preparing, or providing services in connection with the preparation of, returns of the tax imposed by chapter 1, or any person who for compensation prepares any such return for any other person, and who knowingly or recklessly, (1) discloses any information furnished to him for, or in connection with, the preparation of any such return, or (2) uses any such information for any purpose other than to prepare, or assist in preparing, any such return, shall be guilty of a misdemeanor...

Let's translate that into plain English and then unpack each element.

Plain-English Version: If you prepare income tax returns for compensation, and you knowingly or recklessly share or use client tax information for any reason other than preparing that return, without the client's consent and without a specific legal exception, you have committed a federal crime.

The Three Elements

To establish a §7216 violation, the government must prove three things:

Element 1: Tax Return Preparer

You must be a "tax return preparer", someone engaged in preparing, or providing services in connection with the preparation of, income tax returns (returns under chapter 1 of the Internal Revenue Code). This is an extremely broad definition. It covers:

CPAs who prepare 1040s, 1120s, 1065s, 1120-Ss, and other returns
Enrolled agents
Non-credentialed paid preparers
Employees of a tax preparation firm who assist with return preparation
Bookkeepers who extract data used in return preparation
Software vendors who provide services in connection with return preparation (this is important for understanding why cloud AI vendors may themselves become subject to §7216 once they receive your clients' data)

If you have a PTIN and prepare returns for compensation, you are a tax return preparer under §7216.

Element 2: Knowingly or Recklessly

The statute requires either knowing or reckless conduct. "Knowing" is straightforward. "Reckless" is where practitioners get into trouble without intending to.

Recklessness means consciously disregarding a substantial and unjustifiable risk. In practical terms: if you use a cloud AI tool with client data without having done any §7216 analysis, and you are a CPA who is reasonably expected to know the rules, a court could find that you recklessly disregarded the risk of disclosure. "I didn't know" is not a defense if you should have known.

⚠️ RISK: The "recklessly" standard is the reason this statute reaches practitioners who never set out to do anything wrong. Using client data in a tool you have not analyzed for §7216 compliance, while being a licensed professional who is charged with knowing the rules, is exactly the kind of conduct the recklessness standard was designed to reach.

Element 3: Discloses or Uses

These are two separate verbs. Most practitioners focus on "discloses," but "uses" is independently prohibited and separately important.

Disclosure: Making tax return information known to any person in any manner whatever (Treas. Reg. §301.7216-1(b)(5)).
Use: Any circumstance in which a tax return preparer refers to, or relies upon, tax return information as the basis to take or permit an action (Treas. Reg. §301.7216-1(b)(4)).

Why the use prohibition matters: Even if you argue that sending data to a local AI model on your own hardware is not a "disclosure" to a "person" (the argument we develop in Lesson 10), the use prohibition still applies. Using client tax data to train a custom model, to generate general-purpose business content, or for any purpose other than preparing that client's return could be a violation even if the disclosure element is not met.

"Tax Return Information": How Broad Is It?

This is where practitioners are often surprised. "Tax return information" under §7216 is not limited to the four corners of the tax return. Treas. Reg. §301.7216-1(b)(3)(i) defines it as any information:

"...furnished in any form or manner for, or in connection with, the preparation of a tax return of the tax imposed by chapter 1..."

The definition includes:

The client's name, address, and taxpayer identification number (TIN/SSN/EIN)
Financial information: income, deductions, credits, account numbers
Information on source documents: W-2s, 1099s, K-1s, brokerage statements
The client's email asking you about whether a home office deduction is available
A voicemail transcription describing a business expense
Bookkeeping data exported from QuickBooks that feeds into the return
Draft narratives you prepared based on the client's facts
The fact that someone is your client at all (the existence of the relationship)
Information the client provided that does not end up on the return
Your analysis and notes about the client's tax situation

⚠️ RISK: Telling ChatGPT "I have a client who is a freelance graphic designer in Georgia with $85,000 in gross receipts and I need help drafting a memo about their home office deduction" has disclosed tax return information under §7216, even if you never used the client's name. The facts you described were "furnished in connection with the preparation of a tax return."

Notice that "derived information" is also covered: information you derived from the return or in the process of preparing it (Treas. Reg. §301.7216-1(b)(3)(ii)). This means analytical outputs, even summaries, memos, or notes you create, can be tax return information if they contain or are derived from client data.

"Disclosure" Defined

Treas. Reg. §301.7216-1(b)(5) defines disclosure as:

"...the act of making tax return information known to any person in any manner whatever."

The phrase "in any manner whatever" is deliberately and extraordinarily broad. Treasury chose this language to capture every conceivable means of communication:

Oral disclosure
Written disclosure
Electronic transmission
Fax
API call
File upload
Paste into a text box
Screen share where client data is visible

The disclosure does not require:

The information to be retained by the recipient
The client to be identifiable
Any harm to result
Any intent to harm
That the recipient actually reads the information

"Use" Defined

"Use" under §301.7216-1(b)(4) covers any circumstance in which you "refer to, or rely upon, tax return information as the basis to take or permit an action." This prohibition:

Bars using client information to market other services to that client without consent (cross-selling a financial planning service based on what you know from the return)
Bars using aggregate client data for your own business analytics without consent
Bars using client data to build or fine-tune any AI model
Applies independently of whether a "disclosure" also occurred

Criminal Penalty

A violation of §7216(a) is a federal misdemeanor. The penalty:

Fine of up to $1,000 per violation
Imprisonment of up to 1 year per violation
Or both

Each separate disclosure is a separate violation. In a practice with hundreds of clients, unauthorized AI use throughout a tax season could theoretically be charged as hundreds of separate violations. In practice, prosecutors would likely charge aggregated counts, but the per-violation structure underscores the severity.

The Civil Companion: §6713

Section 6713 is the civil companion to §7216. It does not require criminal intent, any unauthorized disclosure or use, regardless of mental state, triggers civil liability:

$250 per disclosure or use
$10,000 per year cap

The $10,000 cap applies per taxpayer per year. A firm that uses an uncontracted cloud AI tool with 50 clients' data could face civil liability for each disclosure. The cap limits the per-taxpayer exposure but not the total exposure across multiple clients.

📌 PRACTICE TIP: The §6713 civil penalty is the more likely enforcement mechanism for most practitioners. It requires no proof of intent, and it can be asserted through an IRS examination or a taxpayer civil suit. Do not let the rarity of §7216 criminal prosecutions lull you into thinking the exposure is theoretical.

Why Prosecutions Are Rare (and Why That Doesn't Mean the Risk Is Low)

Pure §7216 prosecutions are uncommon. Most criminal cases involving unauthorized disclosure of tax return information are charged under 26 USC §7213 (which has a higher penalty ceiling but a similar structure) or under general federal fraud and computer access statutes. The Littlejohn case, described below, was actually prosecuted under §7213, not §7216.

But the rarity of prosecution does not mean the statute is toothless:

The §6713 civil penalty requires no prosecution.
A §7216 violation is often the predicate for more serious charges (obstruction, fraud, computer access violations).
State bar or AICPA ethics investigations can follow even where no criminal charge is filed.
Malpractice and engagement-based civil claims by clients can flow from unauthorized disclosure.

Key Case Study: United States v. Charles Littlejohn

Facts: Charles Littlejohn was a consultant for Booz Allen Hamilton, which contracted with the IRS. Between 2018 and 2020, Littlejohn exploited his access to IRS systems to steal tax return information belonging to former President Donald Trump and more than 7,600 other high-net-worth individuals. He disclosed this information to ProPublica and The New York Times, which published articles using the stolen data.

Prosecution: In October 2023, Littlejohn pleaded guilty to one count of unauthorized disclosure of tax return information under 26 USC §7213 (not §7216, but the same conceptual framework).

Sentence: On January 29, 2024, U.S. District Judge Ana C. Reyes sentenced Littlejohn to the maximum statutory sentence of 5 years in federal prison, 3 years of supervised release, and a $5,000 fine. The judge called the disclosures "an attack on our constitutional democracy." She expressed frustration that only one count was charged, stating: "The fact that he is facing one felony count, I have no words for."

What This Shows:

Courts take tax disclosure violations seriously. A judge appointed by a Democratic administration sentenced a man who leaked tax records that were embarrassing to a Republican President to the maximum allowable term. The political valence was irrelevant. The conduct was unacceptable.
The maximum penalty was applied. Littlejohn's sentencing guidelines range was 8–14 months. He received 5 years, more than three times the top of the guidelines. Courts have discretion to punish severely.
The statute applies to contractors, not just direct employees. Littlejohn was a contractor to a government contractor. The principle extends: a cloud AI vendor who receives your client's data and misuses it is also a tax return preparer subject to §7216. You are responsible for choosing vendors appropriately.
Volume matters. Leaking "thousands of returns" was treated as categorically different from a single incident. A practice that routinely uses client data in unauthorized AI tools over an entire tax season creates cumulative exposure.

✅ COMPLIANCE NOTE: The Littlejohn case involved intentional misconduct. Most practitioners will never face anything remotely comparable. But the case illustrates the underlying principle that Congress has attached serious consequences to unauthorized disclosure of tax return information, and courts enforce those consequences.

Key Takeaways

§7216 is a federal criminal statute, up to $1,000 fine and 1 year imprisonment per violation, that applies to any tax return preparer who knowingly or recklessly discloses or uses client tax return information outside the return preparation purpose.
"Tax return information" is extremely broad: it includes any information furnished in connection with return preparation, including the fact of the client relationship itself.
"Disclosure" means making information known to any person in any manner whatever, no harm required, no intent required, no retention required.
"Use" is a separate prohibited act that applies even when no third party receives the data.
The civil companion §6713 ($250/disclosure, $10,000/year cap) requires no criminal intent and is the more likely enforcement mechanism for most practitioners.
Charles Littlejohn received 5 years in federal prison for unauthorized disclosure in January 2024, courts enforce this statute severely when the facts warrant it.

Quick Review

Q1 (True/False): A §7216 violation requires proof that the client was harmed by the disclosure.

Answer: False. The statute requires only that the disclosure occurred knowingly or recklessly. No harm to the client is required. The disclosure itself is the violation.

Q2 (True/False): "Tax return information" includes only data that actually appears on the filed return.

Answer: False. Tax return information includes all information furnished for, or in connection with, the preparation of a return, including documents, emails, notes, conversations, and derived information, whether or not it appears on the final return.

Q3 (True/False): A practitioner who uses an AI tool without having analyzed §7216 but does not intend to harm anyone cannot be found to have violated the statute.

Answer: False. The "recklessly" standard does not require intent to harm. A licensed professional who uses client data in a tool without having done the §7216 analysis, and who is charged with knowing the professional rules, may be found to have recklessly disregarded the risk of disclosure.

Q4 (True/False): Section 6713 applies only when there is also a §7216 criminal violation.

Answer: False. Section 6713 is an independent civil penalty. It requires no proof of criminal intent. Any unauthorized disclosure or use triggers it.

Q5 (True/False): Charles Littlejohn received a 5-year sentence even though he only pleaded guilty to one count of disclosure.

Answer: True. Five years was the statutory maximum on the single count charged. The judge explicitly noted her frustration that only one count was charged and sentenced to the maximum to deter future violations.

← Lesson 1: The Big Picture · Study Guide home · Lesson 3: The Exceptions Framework (§301.7216-2) →