Section 7216 Consent: What Tax Preparers Can Use for Marketing

Section 7216 consent is written client authorization that IRC §7216 and its implementing regulations require before a tax return preparer discloses or uses a client's tax return information in specific ways — but asking your own clients for a Google review after you prepared their own return is generally a different question than disclosing their data to an outside party, and the exact boundary deserves a careful look before you build a marketing program around it. That distinction trips up a lot of firms, because §7216 gets talked about as a blanket "don't touch tax data for marketing" rule, when the real structure is narrower and more specific. Getting the review-request side of this right matters enough that it's worth building compliant review requests for tax clients around a clear understanding of what the rule actually restricts, rather than either ignoring it or over-restricting your own marketing out of excess caution. What Section 7216 actually covers IRC §7216 makes it a federal offense for a tax return preparer to knowingly or recklessly disclose or use tax return information, except as specifically authorized by the statute, regulations, or the client's written consent. "Tax return information" is defined broadly — it's not just the numbers on the filed return, but essentially any information a preparer obtains or generates in connection with preparing a return, including information the client provided that never even made it onto the final form. The penalty structure includes both criminal and civil exposure for violations , which is part of why this rule gets treated with more caution than a typical marketing-compliance concern. Treasury Regulation 301.7216-2 and 301.7216-3: the structure underneath the statute The statute itself is short; the real detail lives in the Treasury regulations implementing it. Treas. Reg. §301.7216-2 lays out a list of specific, permitted disclosures and uses that don't require separate client consent — things like disclosures to other preparers within the same firm for preparing the return, or disclosures required by court order. Treas. Reg. §301.7216-3 covers the consent mechanism itself: the form, content, and timing requirements for situations where consent is required and hasn't been separately authorized by §301.7216-2. The practical question for most firms isn't "does §7216 apply to us" — it almost always does, since any return preparer is covered — it's "does this specific use of client data fall inside one of §301.7216-2's permitted categories, or does it need a signed consent under §301.7216-3." Marketing to your own existing clients, about your own services Here's where the review-request question actually lives. Asking your own clients, through your own systems, to leave a review about your own firm's service is commonly treated differently from disclosing a client list or return data to an unrelated third-party marketer for an unrelated purpose — the regulations distinguish between a preparer's own solicitation of its own existing clients and disclosure to outside parties . That means a firm sending its own clients a text or email after filing season, asking for feedback on the service, is operating in meaningfully different territory than a firm handing its client list to a marketing agency that would see names tied to tax situations. The caveat matters: "commonly treated differently" is not the same as "automatically fine in every configuration." How the campaign is built changes the analysis — whether any return information beyond basic contact details is exposed to a third-party tool in the process, whether the request itself reveals anything about the return (never ask "how did you like getting that $4,200 refund?"), and whether the firm is using a vendor that would need its own access to tax data to run the campaign. This is exactly the kind of boundary where a firm should get a specific answer from its own counsel rather than relying on a general rule of thumb, especially before scaling a review-request program across the whole client list. When written consent is clearly required Some situations sit clearly on the "you need signed consent" side of the line, and it's worth knowing them even if your firm isn't in one right now. Sharing a client list — with names, contact information, and anything that identifies them as tax clients — with an outside marketing vendor who would process that data as part of running a campaign generally requires the specific written consent §301.7216-3 describes. The same goes for disclosing return information to a third party for a purpose unrelated to preparing the return itself, like referring a client's financial details to an unaffiliated financial product provider. If your firm is considering any arrangement where an outside party would see client data tied to their tax situation, that's the trigger to get a proper consent form in place before moving forward, not after. What a compliant consent form generally needs Where consent is required, §301.7216-3 and its related guidance specify requirements for the form's content, format, and the circumstances under which it must be presented — including, in some cases, restrictions on bundling consent requests with other documents the client is signing anyway . Firms that do need a signed consent for a particular use of client data should work from a form reviewed by counsel familiar with the current regulation, rather than adapting a generic template — the requirements are specific enough that small deviations can matter. A worked example: where the line actually falls Consider a fictional firm, Harrow & Dale Tax Services. Every April and October, Harrow & Dale's office manager pulls a list of clients whose returns were just filed and accepted, and sends each one a short text: "Thanks for trusting us with your taxes this year — if you have a minute, we'd appreciate a Google review." The message references no refund amount, no filing outcome, nothing about the return itself. The firm is using its own client contact list, built from its own engagement with those clients, to ask about its own service. That's the kind of use that typically sits closer to the firm's own solicitation of its own clients rather than a disclosure to an outside party. Now suppose Harrow & Dale instead hires an outside marketing agency and hands over its full client list — names, emails, and a spreadsheet column noting each client's refund or balance-due amount, so the agency can "personalize" the outreach. That configuration is different in two ways: an outside party is now receiving tax return information (the refund/balance data), and that party didn't need it to send a basic review request in the first place. Including that column is exactly the kind of unnecessary data exposure that turns a routine marketing task into a §7216 question worth getting in front of before the list ever leaves the building . Review requests that stay inside the rule Whatever your firm concludes about the consent question for its own review-request program, a few things stay constant and matter more day-to-day than the consent analysis itself. The request message should never reference any specific tax detail — no refund amount, no filing outcome, nothing that could be read as using return information in the solicitation itself. It should go to every client the same way, regardless of how their return turned out; selectively asking only clients you expect to be happy is review gating, which is illegal under the FTC's rule on fake and deceptive reviews (16 CFR §465) independent of anything in §7216. And no incentive — a discount, a gift card — should ever be tied to leaving a review. A simple, generic message sent to every client after their return is filed and accepted — something like the templates in our guide on review request text message templates — avoids the consent question almost entirely, because it doesn't touch return information at all; it's just a firm asking its own clients for feedback on its own service. Whatever happens on the request side, the reply side carries its own separate, absolute rule: a reply to a review must never confirm the reviewer is a client or reference any tax or financial detail, regardless of whether consent was ever an issue for the request. We cover that in detail in How CPAs Should Respond to Negative Reviews Without Breaching Confidentiality, and the broader reputation picture — including tax-season timing and platform-by-platform specifics — is in our pillar guide, Accounting Firm Reputation Management. Building this into a yearly rhythm instead of a one-time decision Firms that handle this well tend to treat the review-request process as a fixed part of the filing workflow rather than a marketing campaign they revisit each year. The request goes out automatically once a return closes — the same week every year, to every client, with the same generic wording — rather than being drafted fresh by whoever happens to be free during the busiest weeks of tax season. That consistency does double duty: it keeps the request itself simple enough to stay clearly inside the "firm asking its own clients" category, and it removes the temptation to "personalize" messages with details that shouldn't be there in the first place. A firm that's already decided, once, exactly what the message says and exactly who it goes to doesn't have to re-litigate the §7216 question every single filing season. Frequently asked questions Does asking a client for a review require a signed §7216 consent form? Often not, if the request comes from the firm itself to its own existing clients, references no tax detail, and doesn't route client data through a third party that would need its own access to it — but this is a fact-specific question with conditions attached, and firms running or scaling a review-request program should confirm the specific setup with counsel rather than assume. Can a third-party review-request tool see client tax data? It shouldn't need to, and that's the safest way to design the workflow — the tool only needs a name and a contact method to send a generic request, never a tax detail, a return status, or anything else that would make the tool itself a party handling tax return information. What happens if a firm gets this wrong? Section 7216 carries both criminal and civil exposure for improper disclosure or use of tax return information , which is why the stakes here are higher than a typical marketing-compliance question. The practical fix is simple even if the legal analysis isn't: keep review requests generic and client-data-free, and get a real consent form in place — reviewed by counsel — for any situation where an outside party would actually see return information. Every review from Google, Facebook and Yelp in one inbox → Try Tailwind free. Tailwind runs $5 a month per tool, or $50 a month for the Full plan covering every tool, with the first month free and no card required to start.