IRS Data Sharing with ICE: A Breach of Trust and What It Means for Taxpayer Privacy
A recent ruling has exposed a significant breach of taxpayer privacy, revealing that the IRS violated federal law approximately 42,695 times by improperly sharing confidential taxpayer data with Immigration and Customs Enforcement (ICE). The issue, first reported by the Washington Post, centers around a flawed verification process that allowed ICE to obtain addresses with minimal, and often insufficient, information.
The Flawed Verification Process: A System Designed to Fail
Federal law requires requesting agencies, like ICE, to provide both the name and address of the individual they are seeking when requesting taxpayer information from the IRS. This safeguard is intended to prevent the IRS from being used as a tool for broad, untargeted fishing expeditions. But, the IRS’s implementation of this law was shockingly inadequate.
According to U.S. District Judge Colleen Kollar-Kotelly, the IRS employed a “TIN Matching” process for the vast majority of requests. This process only verified the name and Social Security number (TIN) against IRS records. Critically, it failed to validate the address provided by ICE. The only check in place was a rudimentary filter looking for a five or nine-digit number – essentially, any string resembling a zip code.
As the judge pointedly noted, a zip code is not an address. ICE could have submitted requests with placeholder addresses like “Don’t Care 12345” or “00000” and still received taxpayer information. This meant that the IRS was disclosing confidential data based on incredibly flimsy verification.
The Scale of the Problem: 90% of Disclosures Were Faulty
Of the 47,289 taxpayer addresses shared with ICE, a staggering 90.3% – those 42,695 instances – went through this flawed TIN Matching process. Only 9.7% of requests underwent a process that even attempted to verify the address provided by ICE.
The examples of deficient addresses submitted by ICE are particularly alarming. The IRS disclosed taxpayer information based on requests containing “Failed to Provide,” “Unknown Address,” or “NA NA” as the address. In other cases, the “address” referred to jails, detention facilities, or prisons without including a street number.
Delayed Disclosure and Concerns About Transparency
The Department of Treasury identified these issues on January 23, 2026, and immediately notified DHS. However, the government waited nearly three weeks – until February 11 – to inform the plaintiffs and the court about the 42,695 violations of federal law. This delay raises serious questions about transparency and the government’s commitment to protecting taxpayer privacy.
Judge Kollar-Kotelly expressed “some concern” regarding the completeness of the administrative record, noting a “disconnect between the agency clients and counsel.”
The Ongoing Legal Battle and Implications for Immigration Enforcement
The case is currently before the DC Circuit, where the government is appealing the earlier order blocking the data-sharing arrangement. DHS continues to defend the program as essential for immigration enforcement, claiming information sharing is vital for identifying individuals in the country, including those deemed “violent criminals.”
What Does This Mean for Taxpayer Privacy?
This case highlights a critical vulnerability in the protection of taxpayer information. The IRS’s failure to adequately verify address information created a significant risk of abuse and potential harm to individuals. The delayed disclosure of these violations further erodes public trust in the government’s ability to safeguard sensitive data.
Pro Tip:
Regularly review your credit report and consider a credit freeze to help protect yourself from identity theft and unauthorized access to your personal information.
FAQ
- How many times did the IRS violate federal law? The IRS violated federal law approximately 42,695 times.
- What was the main issue with the data sharing? The IRS failed to adequately verify the addresses provided by ICE before disclosing taxpayer information.
- How long did it take for the government to disclose the violations? The government waited nearly three weeks to inform the court and plaintiffs after identifying the problem.
This situation underscores the need for robust safeguards and increased oversight to ensure taxpayer data remains confidential and protected from misuse.
Worth a look