IRC 7216 disclosure consent: can tax preparers use or share client data for AI?

Short answer

Tax return information stays out of AI training sets and out of data licenses. Section 7216 of the Internal Revenue Code, and the Treasury regulations under it, restrict preparers from disclosing or using that information beyond what the regulations allow, and the consents they contemplate are written, specific to a purpose and signed before the disclosure. No SourceX license involves return data, and none needs it.

What a preparer can do is narrower and cleaner: tell a business owner that SourceX exists, and let the owner decide whether the company applies with its own operating records. The rest of this page shows where that line falls.

What do section 7216 and the regulations cover?

Three ideas carry most of the weight. The primary texts are 26 U.S.C. 7216 and Treasury Regulation 26 CFR 301.7216-1 through -3; they are not linked from our sources, so read the current text with counsel rather than relying on any summary, this one included.

• Who is covered. The rules reach people in the business of preparing returns or providing services connected with return preparation, together with the staff who help them. That is wider than CPA firms.
• What is protected. Tax return information is defined broadly. It is not limited to the filed return; it generally covers information the taxpayer gives you and information you derive or generate in connection with preparing the return.
• Use as well as disclosure. The rules restrict using the information, not only handing it to someone else. Choosing which clients to pitch for a non-tax service by mining their returns may be a use; ask counsel.

Consents carry content and format requirements, and a consent given for one purpose does not stretch to another. The statute attaches penalties to violations, so check the current text and ask counsel what applies to your situation.

Why return information never belongs in an AI data license

Even if a consent could be drafted, return data is the wrong material. AI labs and data buyers want records of work being done: tickets and how they were resolved, project histories, sales cycles with outcomes. A return summarizes results, and it carries some of the most sensitive financial and personal detail a person or company has.

Other regimes point the same way:

• GLBA's privacy provisions, summarized on the FTC's Gramm-Leach-Bliley Act guidance page, call for notices and opt-out rights before covered financial institutions share customer information with certain nonaffiliated third parties. The Safeguards Rule guide for CPA firms covers the security side.
• FTC staff wrote in January 2024 that promises not to use customer data for undisclosed purposes, such as training or updating models, are enforceable wherever they appear, including privacy policies and terms of service (FTC staff post).
• A month later, FTC staff warned that adopting more permissive data practices, such as AI training, through a quiet retroactive change to terms or a privacy policy may be unfair or deceptive (FTC staff post). Rewriting next season's engagement letter is not a shortcut.

Both FTC posts are staff guidance, not rules, but they show how regulators read data promises. Professional confidentiality adds another layer, covered in the AICPA confidential client information rule guide.

What can a preparer say when introducing a client's business?

The test is where each fact came from. If you learned it while preparing a return, leave it out and ask the owner instead.

The company's operating records are a different matter from your file. Its CRM history, help desk tickets and project files belong to the company, which decides whether to license them after its own rights review. AI buyers value that material because it is consented and rights-cleared, as why buyers want licensed data explains.

The clean-room introduction

1. Raise the topic in conversation, never through a mailing list built from your return database.
2. Let the owner screen the company: a US business that has had 50+ full-time employees at peak (contractors excluded), several years of documented operations, rights to its records and a sponsor who can sign. The company fit checker needs no contact details.
3. Get the owner's consent to the introduction, and disclose in writing that a referral reward may follow.
4. Send your referral link, or submit the referral form using only details the owner gave you.
5. Stay out of the data path; the company works with SourceX directly, as how it works describes.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, up to $100,000 per referred company, payable only after the buyer pays and SourceX receives its fee; no reward is guaranteed. Whether you may accept one depends on your credentials and state; start with whether a tax preparer can accept a referral fee. Tax advisors new to the program can also read the referral program guide for tax advisors.

Questions to confirm with counsel

• Is anything we plan to say about this client tax return information under the regulation's definition?
• Would selecting which clients to approach count as a use that needs consent?
• If we rely on an existing consent, does its stated purpose actually cover this introduction?
• How do our state's confidentiality rules and the AICPA Code interact with section 7216 for this client?

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

Next step

After busy season, ask the owners of your larger business clients the fit questions directly, and keep return data out of the conversation. Then register as a partner and send interested owners your referral link.