The IRS built the system last summer to answer a request from Immigration and Customs Enforcement for the last known addresses of 1.28 million people, according to the ruling.
Congress passed the privacy law in the 1970s, after the Watergate scandal exposed how the executive branch had used taxpayer files to harass its enemies, Circuit Judge Cornelia Pillard wrote for the panel. It bars the IRS from sharing tax records with any other federal agency unless strict conditions are met.
One condition is that the requesting agency must provide the name and address of each taxpayer whose records it wants, the ruling said.
The IRS program checked only whether ICE had entered five or nine digits in the address field, according to the ruling. The digits did not have to form a real zip code, and ICE did not have to provide a street, a city or a state.
The IRS turned over addresses in response to ICE requests that listed the taxpayer's address as "Unknown Address," "Failed to Provide," or "NA NA," the ruling said.
"A zip code is not an address, and a zip code proxy, as the IRS would define it, might as well be a set of random numbers," U.S. District Judge Colleen Kollar-Kotelly wrote in February, in a passage the appeals court quoted. "For instance, ICE could have submitted a request with an 'address' like, 'Don't Care 12345,' or, '00000,' and still received a taxpayer's address."
"The IRS's operative policy to provide information on those terms flies in the face of the statutory command," Pillard wrote.
The IRS handed over 47,289 taxpayer records in August 2025, and more than 90% came through a matching process that never checked the address ICE supplied, according to the ruling.
Kollar-Kotelly put a number on that in February, finding the agency had broken the privacy law roughly 42,695 times.
The law also limits disclosure to agency employees who are "personally and directly engaged" in a criminal investigation of that particular taxpayer, Tuesday's ruling said. The IRS program required only that ICE fill in a point-of-contact field, which would accept an entry such as "Unknown" or "TBD."
ICE listed the same person as the point of contact on all 1.28 million requests. Earlier that month, the agency had also asked the IRS for records on more than 7 million people it said had entered the country illegally.
The district court called it "facially implausible" that a single person could be personally and directly engaged in roughly 47,000 criminal matters, let alone 1.28 million.
"[I]t is unreasonable to think that, in one month, the same Assistant Director could be 'personally and directly engaged' in 7.6 million criminal matters under one statute and 1.2 million criminal matters under another," Kollar-Kotelly wrote.
The appeals court also noted the government's acknowledgment that ICE wanted the data to support the White House's mass deportation agenda. On that record, the district court found the material raised an inference that ICE's claim to be running criminal investigations "was pretext."
A third requirement is that the requesting agency explain specifically why the records are relevant to its investigation, the ruling said.
ICE's cover letter for all 1.28 million requests said only that the information "may contain address information which is potentially at issue" in investigating a violation of the law against remaining in the country after a removal order, according to the ruling.
"It beggars belief to call that vague, unbounded reasoning 'specific,'" Pillard wrote, adding that the IRS "flouted its own statutory obligation" by accepting it.
Justice Department lawyers argued on appeal that the district court's order "impedes and delays federal law enforcement" by restricting information ICE is entitled to receive, the ruling said.
"But that's a gripe with Congress, not the court," Pillard wrote.
The Trump administration also objected to a part of the order requiring the IRS to tell the district court before answering any future Homeland Security request for taxpayer information, calling it "highly unusual and harmful."
"That argument is weak sauce where the district court has permitted the IRS to file any necessary notifications 'under seal,'" Pillard wrote.
Justice Department attorney Jacob Christensen, who argued the case in May, acknowledged that the program had produced "concededly unlawful" transfers, the ruling said.
"[T]he Government would readily admit that there were mistakes made, that some information was disclosed not in compliance with the statute," Christensen told the panel, according to the ruling. "What action IRS has since taken to remedy the error, I can only speculate."
"I'm not aware of what, if any, action IRS has done to correct the [error]," the DOJ lawyer admitted.
The agreement that opened the door to those requests was signed in April 2025, after months of resistance inside the IRS, CNN reported. Career officials refused the administration's requests over and over, telling President Donald Trump's political appointees and staff from the Department of Government Efficiency that handing the data to immigration authorities would be illegal.
"[T]here is no clear legal authority right now for this," chief privacy officer Kathleen Walters told the acting commissioner in late February 2025.
"It felt like a hostile takeover," one former IRS employee told CNN. "If we would have imagined some foreign government sending in adversaries to take us over, this is what it would have felt like."
Then-acting IRS Commissioner Doug O'Donnell shut down an early request for the home addresses of 700,000 people that February and retired days later, CNN reported.
By mid-March, the agency's acting general counsel, Bill Paul, had been demoted and replaced by Andrew De Mello, a DOGE ally.
De Mello wrote to top IRS officials on April 2 that they "cannot wait" much longer on the deal because Treasury Secretary Scott Bessent and others "need this finalized and executed immediately," according to an email CNN reviewed.
Walters refused to sign, and other career officials did too, CNN noted. Bessent signed for Treasury, and Noem signed for Homeland Security.
U.S. District Judge Indira Talwani ruled in August that DOGE must turn over its internal communications about the data-sharing deal, along with communications from inside the Social Security Administration, by Sept. 14. Talwani said the government's refusal to produce those records was "another significant gap precluding the court from evaluating Plaintiffs' claims."
Trump invoked the same taxpayer privacy law on his own behalf in January, suing the IRS and the Treasury Department for at least $10 billion over the leak of his tax returns by a former IRS contractor, Tax Notes reported.
He dropped the case on May 18, two days before a deadline to explain why he and the agencies he oversees were "sufficiently adverse," according to Axios.
The same day, the administration announced a $1.776 billion "Anti-Weaponization Fund" drawn from the Treasury account that pays government settlements, according to Axios.
A five-member commission appointed by the attorney general, whose members Trump can remove, has until December 2028 to process claims against that fund, Axios reported.
