Julia Chirkova
In a significant ruling that highlights potential overreach in government data sharing, a federal judge has determined that the Internal Revenue Service (IRS) violated federal law on approximately 42,695 occasions by improperly sharing confidential taxpayer addresses with U.S. Immigration and Customs Enforcement (ICE). U.S. District Judge Colleen Kollar-Kotelly issued her decision on February 26, concluding that the majority of the nearly 47,300 addresses disclosed to ICE last August were transmitted without the IRS adequately verifying that ICE had provided a valid address for the individual whose records were being sought.
This ruling stems from ongoing litigation challenging a data-sharing arrangement between the IRS and the Department of Homeland Security (DHS), the parent agency of ICE. The core of the legal challenge centers on the IRS’s adherence to strict federal requirements designed to protect the privacy of taxpayer information.
The Legal Framework for Taxpayer Data Protection
Federal law, specifically Section 6103(i)(2) of the Internal Revenue Code (IRC), mandates stringent procedures before the IRS can release confidential taxpayer information, including addresses, to other government agencies. A fundamental requirement is that any agency requesting such data must first provide the IRS with the name and a verifiable address of the specific individual whose records are being sought. This safeguard is crucial for ensuring that sensitive tax information is accessed only for clearly identified individuals and not used as a broad investigative tool without proper justification.
The judge’s ruling indicates that the DHS, and by extension ICE, failed to meet this critical requirement in a substantial number of instances. The court found that the IRS disseminated taxpayer addresses without confirming that ICE’s requests included a valid "address of the taxpayer" as stipulated by law.
Details of the IRS’s Data Disclosure Process
Judge Kollar-Kotelly’s decision meticulously details the automated processes employed by the IRS when handling requests from ICE. According to the court’s findings, the IRS utilized one of two "mutually exclusive" computerized matching systems to determine if ICE-supplied information warranted the disclosure of taxpayer addresses.
The primary method, termed "TIN Matching," accounted for the vast majority of the disclosures. Under this process, if ICE provided a taxpayer’s first name, last name, and Social Security Number (SSN), the IRS would disclose the individual’s last known address if those details matched records within the IRS system. Crucially, the court noted that in these TIN Matching instances, the IRS did not conduct any further inquiry into the address ICE provided beyond an initial automated check for a zip code proxy. This meant that the IRS was not confirming whether the address ICE supplied actually belonged to the taxpayer in question, but rather if the provided name and SSN matched IRS records.
The second matching process, "Address Matching," was employed only when ICE’s request did not include an SSN. In these cases, the IRS would confirm that the first name, last name, and address provided by ICE matched the name and associated address in the IRS’s own records. This method, while more stringent in its address verification, was used far less frequently.
Out of the total 47,289 taxpayer addresses disclosed to ICE, the judge found that 90.3%, or 42,695 addresses, were released through the TIN Matching process. The remaining 9.7%, totaling 4,594 addresses, were disclosed via Address Matching. The ruling specifically identifies the 42,695 disclosures made through TIN Matching as violations of IRC Section 6103(i)(2) because the IRS failed to confirm that ICE’s request included the "address of the taxpayer with respect to whom the requested return information relate[d]."
Background of the Data-Sharing Agreement
The dispute originated from a data-sharing agreement signed in April 2025 between Treasury Secretary Scott Bessent and Homeland Security Secretary Kristi Noem. This agreement authorized ICE to submit names and addresses of individuals residing in the U.S. without legal status to the IRS for cross-verification against tax records. At the time of its announcement, the Treasury Department stated that the initiative was designed to support President Donald Trump’s agenda of border security and his broader immigration enforcement efforts, which had already led to an increase in deportations and workplace raids.
However, the agreement immediately drew criticism from immigrant advocates who argued that it infringed upon privacy laws and undermined the privacy rights of all Americans. The controversy was significant enough to prompt the resignation of Melanie Krause, who was the acting IRS commissioner when the agreement was finalized, in protest of the policy.
Discovery and Legal Proceedings
The extent of the data disclosure and its potential illegality first came to light through reporting by The Washington Post. Citing sources familiar with the matter, the newspaper indicated that the data sharing appeared to breach legal safeguards for taxpayer data and had only recently been uncovered.
The IRS later confirmed aspects of The Washington Post‘s reporting in a court filing earlier in February. In a sworn declaration, Dottie Romo, the agency’s chief risk and control officer, stated that the IRS had indeed shared confidential taxpayer information even when DHS lacked sufficient data to positively identify specific individuals. This admission was a pivotal moment in the litigation.
Judge Kollar-Kotelly highlighted the significance of Romo’s declaration in her ruling. She stated that the declaration not only corroborated the court’s finding of IRC Section 6103(i)(2) violations due to the disclosure of thousands of addresses without proper address verification but also revealed that the IRS had provided this sensitive information in response to requests that the agency now admits were legally flawed.
Broader Implications and Future Considerations
The federal judge’s ruling carries substantial implications for how government agencies can share sensitive personal information and for the privacy protections afforded to U.S. taxpayers. The decision underscores the importance of strict adherence to legal protocols, even in the context of national security and immigration enforcement.
For the IRS, the ruling necessitates a re-evaluation of its data-sharing protocols with other government entities. The agency will likely need to implement more robust verification mechanisms to ensure compliance with federal law, particularly concerning the release of personally identifiable information. This could involve enhancing automated checks, increasing human oversight, or modifying the criteria for accepting and processing data requests from partner agencies.
For ICE and DHS, the decision serves as a stark reminder of the legal boundaries governing their investigative practices, especially when leveraging data from other federal departments. The ruling suggests that broad data access without meticulous individual identification and address verification is not permissible under current law.
Immigrant advocacy groups, who have consistently raised concerns about the potential for such data-sharing agreements to lead to increased surveillance and targeting of immigrant communities, may view this ruling as a victory. It reinforces their arguments that these agreements can have a chilling effect on individuals and may lead to a erosion of trust between the public and government institutions.
The legal challenge was initiated by the Center for Taxpayer Rights, an organization dedicated to advocating for taxpayer privacy and fair treatment. Their lawsuit aimed to halt what they perceived as an unlawful expansion of government surveillance capabilities through the misuse of confidential tax data.
The IRS and DHS have not yet issued a detailed public response to the judge’s ruling, beyond the admissions made in court filings. However, it is expected that the agencies will need to address the court’s findings and potentially revise their data-sharing policies and procedures to prevent future violations. The case highlights a critical tension between the government’s need for information to enforce laws and the fundamental right to privacy that is enshrined in legal protections for taxpayer data. The outcome of this litigation could set a precedent for future data-sharing agreements between federal agencies, emphasizing the paramount importance of lawful data handling and the safeguarding of personal information.
