- Preparers must obtain written consent before sharing taxpayer return information with third parties or marketing partners.
- Unauthorized data disclosure carries civil penalties up to $50,000 in cases involving identity theft.
- Taxpayers should retain essential records for at least three to seven years depending on the situation.
Tax preparers generally must obtain written consent before using or disclosing a taxpayer’s return information for purposes outside return preparation. Unauthorized sharing can expose them to civil penalties of $250 per use or disclosure, up to $10,000 per calendar year.
The privacy rules cover far more than income figures. Returns can contain Social Security numbers, ITINs, passport-linked identity details, foreign bank accounts, rental income, crypto transactions, immigration-related residency facts, tuition records and family information.
The consent must be knowing and voluntary. It should identify the preparer, taxpayer, purpose, recipient where required, information involved, signature and date.
Free toolSubstantial Presence Test CalculatorA vague waiver is not enough. Taxpayers should be able to see who will receive their information and why.
The rules also reach marketing, offshore support and identity-theft-related misuse. Separate recordkeeping rules determine how long taxpayers should preserve the documents behind a filed return.
Consent must identify the information, recipient and purpose
A preparer generally cannot use or disclose return information before obtaining consent unless a specific regulatory exception applies. The restriction can cover sharing with a lender, financial adviser, insurer, affiliate, software provider, offshore support team or marketing partner.
A consent document may state how long it remains effective. If it gives no duration, the consent generally lasts one year from the signing date. A permission signed for one filing season should not automatically become permanent approval for later uses.
Taxpayers can request a copy of the executed consent. The preparer must provide a copy or give the taxpayer an opportunity to print or save a completed electronic version.
Marketing requests have an additional timing restriction. A preparer may not request consent to use or disclose return information for solicitation unrelated to return preparation after providing the completed return for signature.
If a taxpayer rejects that solicitation consent, the preparer cannot ask again for a substantially similar purpose for the same return. That restriction covers offers involving loans, insurance, investments, financial products and unrelated services.
Offshore access can require consent and SSN safeguards
U.S. firms may use support teams in India, the Philippines, Canada, Mexico or other countries. Using an overseas team does not automatically make the arrangement illegal, but the information rules still apply.
When a U.S.-located preparer discloses return information to a preparer outside the United States, consent is generally required before the disclosure. For individual Form 1040-series taxpayers, regulations also restrict sending Social Security numbers to preparers outside the United States.
The number generally must be redacted or masked unless a limited safeguard exception applies. Taxpayers should ask whether documents will be accessed abroad and what protections apply to SSNs and ITINs.
That question is especially relevant to people filing Form 1040-NR, claiming treaty benefits, requesting ITINs, reporting U.S. rental income or working with a remote or overseas preparer.
Unauthorized use can bring civil and criminal exposure
IRC section 6713 applies to a person engaged in return preparation, or compensated for preparing returns, who discloses return information or uses it for a purpose other than preparing or assisting with a return.
The ordinary penalty is $250 for each unauthorized use or disclosure, with a maximum of $10,000 per calendar year. When the conduct is connected to an identity theft crime, the penalty rises to $1,000 for each use or disclosure, capped at $50,000 per calendar year.
IRC section 7216 addresses knowing or reckless conduct. A violation is a misdemeanor that may carry a fine, imprisonment of up to one year and prosecution costs.
The statute also allows a much higher fine for identity-theft-related misuse covered by section 6713(b), rather than the ordinary $1,000 amount. Improper sharing can therefore become more than a customer-service dispute.
IRS authorizations do not replace preparer consent
A preparer’s permission to use or disclose return information is different from an authorization allowing someone to communicate with the IRS.
The third-party authorization checkbox on a return generally permits a designated person to discuss limited return-processing matters with the IRS for the current return. That authorization generally lasts one year from the original due date and does not allow representation in an audit or other compliance activity.
Form 8821 provides broader IRS disclosure authority. Form 2848 may be required for representation before the IRS. Neither form serves as a substitute for the consent governing a preparer’s use or disclosure of return information.
Before sending documents, taxpayers should ask these questions:
- Who will access the documents?
- Will work occur outside the United States?
- Will an SSN or ITIN be shared or masked?
- Will the information be used for marketing or financial products?
- Will affiliates receive it?
- Will the taxpayer receive a copy of the consent?
- How long will documents be stored?
- How will they be deleted or returned?
- What happens after a data breach?
Recordkeeping periods can extend beyond the three-year rule
For tax year 2026, taxpayers should preserve records supporting income, deductions and credits until the applicable limitation period expires. The same records can support amended returns, refund claims, future filings, loans, immigration paperwork and audit responses.
The general period for many returns is three years from the filing date. A return filed before its due date generally counts as filed on the due date. Supporting documents can include W-2s, 1099s, interest and dividend statements, bank confirmations, deduction records and credit records.
Other situations require longer retention:
| Situation | Recordkeeping period or rule |
|---|---|
| Omitted income exceeding 25% of gross income shown on the return | Six years |
| Certain omitted income attributable to foreign financial assets exceeding $5,000 | Six years |
| Fraudulent return or no valid return filed | No limitation period for assessment |
| Refund claim | Generally the later of three years after filing or two years after payment |
| No return filed and refund sought | Generally two years after payment |
| Worthless securities or bad debt loss claim | Seven years |
| Employment tax records | At least four years after tax is due or paid, whichever is later |
| Property records | Until the limitation period expires for the year of sale or other disposition |
The six-year rule matters to NRIs, U.S. citizens abroad, green card holders and visa workers with foreign wages, bank interest, rental income, brokerage accounts, crypto or other offshore assets. Records should be retained longer when omitted foreign income or assets may be an issue.
There is no assessment limitation period when a taxpayer files a fraudulent return or fails to file a valid return. Old records should not be discarded in those circumstances.
Refund deadlines can also cut off recovery of an overpayment. Missed credits, excess withholding, estimated-tax overpayments, foreign-tax-credit issues, student-related credits and NRI withholding claims may all depend on filing within the applicable period.
Property, payroll and digital records need special handling
Property files often outlive ordinary income records. Taxpayers should retain purchase documents, closing statements, improvement invoices, depreciation schedules, refinancing records, repair records and sale documents until the limitation period expires for the sale year.
Those records establish depreciation, amortization, depletion, basis, gain or loss. The rule also applies when a home becomes a rental property. In a nontaxable exchange, records for both the old and replacement property should be kept until the limitation period expires for the year the replacement property is disposed of.
Employers must keep employment tax records for at least four years after the tax becomes due or is paid, whichever is later. The files should include wage payments, withholding, Forms W-4, payroll deposits, Forms 941, Forms 940, Forms W-2, contractor-classification support and employment agreements.
Electronic storage is acceptable if records remain clear, accurate and usable for determining tax liability. Screenshots, spreadsheets, email receipts and accounting exports should be organized and backed up rather than left only inside a bank app, brokerage portal, crypto exchange, property dashboard or foreign-bank account.
Cross-border taxpayers need a durable document file
A useful file can include filed federal and state returns, W-2, 1099, 1042-S and K-1 forms, Form 1040-NR records, treaty statements, foreign salary and tax-payment records, Form 8938 and FBAR support, foreign bank statements and brokerage statements.
It can also include crypto exports, rental-property records, mortgage and property-tax records, immigration-status and day-count records, tuition and Form 1098-T records, dependent documents, ITIN and SSN records, business expenses, payroll files, charitable receipts, stock-option and RSU records, foreign-tax-credit support and refund or payment confirmations.
These documents may later support green card financial history, visa paperwork, mortgage applications, school financial aid, business loans, estate administration and foreign-tax-credit claims.
The common mistakes are predictable: signing a broad form without reading it, permitting marketing use without clear authorization, overlooking overseas access, assuming a return can be shared freely with a lender or immigration adviser, losing the exact filed copy, and relying on a portal that may close before the limitation period ends.
For cross-border taxpayers, the 2026 filing file may need to survive relocation, visa changes, a family member’s death, account closures and the loss of access to foreign accounts. The applicable retention period can therefore last well beyond the next filing season.
This article is for informational purposes only and does not constitute tax advice. Consult a qualified tax professional or CPA about your specific situation.
