Center for Taxpayer Rights v. Internal Revenue Service

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

CENTER FOR TAXPAYER RIGHTS, et al.,

Plaintiffs,

v. Civil Action No. 25-0457 (CKK)

INTERNAL REVENUE SERVICE, et al.,

Defendants.

MEMORANDUM OPINION

(November 21, 2025)

A nonprofit that provides tax advice to low-income Americans, an association of small businesses, and two labor unions (“Plaintiffs”) seek an order staying the implementation of a new policy through which the Internal Revenue Service (“IRS”) has begun sharing certain taxpayer data with Immigration and Customs Enforcement (“ICE”). See Pls.’ Mot., Dkt. No. 30. ICE is not a party to this litigation.

Plaintiffs allege that the IRS has changed its longstanding policy of strictly protecting confidential taxpayer information and, in its place, implemented a new “Data Policy” that prioritizes large-scale, inter-agency sharing of confidential taxpayer information. Pursuant to this new Data Policy, the IRS entered into an April 2025 agreement with ICE to share confidential taxpayer address information and, on August 7, 2025, disclosed to ICE the confidential address information of approximately 47,000 taxpayers. As a basis for its decision to transfer this information to ICE, the IRS relied on a representation from ICE that a single individual at ICE was “personally and directly engaged” in more than one million criminal investigations or proceedings. See 26 U.S.C. 6103(i)(2) (authorizing disclosure of certain information from the IRS to individuals

2

“personally and directly engaged in” a nontax criminal investigation or proceeding, provided that several other conditions are satisfied).

The Federal Defendants oppose Plaintiffs’ request for a stay of the new policy and have moved to dismiss the case. Defendants argue that Plaintiffs lack standing, that the policy they challenge is not reviewable final agency action, that Plaintiffs are unlikely to succeed in showing that the policy is unlawful, that Plaintiffs and their members are not irreparably harmed by the policy, and that the balance of the equities and the public interest do not warrant a stay or other injunctive relief. See Defs.’ Mot., Dkt. No. 26; Defs.’ Opp’n, Dkt. No. 31.

The Court concludes that Plaintiffs have plausibly alleged that the Data Policy is final agency action for which there is no other adequate remedy in a court. See 5 U.S.C. § 704. Based on the data transfer that occurred on August 7, 2025, the Court also concludes that Plaintiffs have established a substantial likelihood that the IRS has taken final, judicially reviewable agency action by adopting and implementing a policy of disclosing the confidential address information of tens of thousands of taxpayers to ICE under Section 6103(i)(2) of the Internal Revenue Code, in reliance on representations from ICE that the addresses are relevant to and will be used for immigration-related criminal investigations and proceedings, even when ICE identifies only a single ICE employee (or a small number of ICE employees) as the employee(s) “personally and directly engaged” in each of the tens of thousands of relevant criminal investigations or proceedings. The Court shall refer to this aspect of the alleged Data Policy as the “Address- Sharing Policy.”

The Court further concludes that the Plaintiffs have shown a substantial likelihood that the IRS’s adoption of the Address-Sharing Policy and the IRS’s subsequent sharing of taxpayer information with ICE were unlawful under the Administrative Procedure Act (“APA”). Plaintiffs

3

have shown that the IRS’s implementation of the Address-Sharing Policy was arbitrary and capricious because the IRS failed to acknowledge and explain its departure from its prior policy of strict confidentiality, failed to consider the reliance interests that were engendered by its prior policy of strict confidentiality, and failed to provide a reasoned explanation for implementing the new Address-Sharing Policy. Furthermore, Plaintiffs have shown that the IRS’s disclosure of confidential taxpayer address information to ICE was contrary to law because it did not comply with certain requirements in Internal Revenue Code Section 6103(i)(2). For similar reasons, the Court concludes that Plaintiffs have plausibly alleged that the broader Data Policy is unlawful under the APA.

The IRS’s unlawful conduct has created a substantial likelihood that Plaintiffs and their members will suffer irreparable harm. The Center for Taxpayer Rights is experiencing a significant decline in interest and engagement with its core activities of providing pro bono services to low-income taxpayers, including immigrant taxpayers—potentially jeopardizing its federal funding—which it has attempted to mitigate by diverting resources to education and outreach. Meanwhile, Plaintiffs’ members face an imminent risk that the confidential address information they have provided to the IRS will be impermissibly used by ICE for civil immigration enforcement. Accordingly, upon consideration of the parties’ submissions, 1 the relevant legal

1 The Court’s consideration has focused on the following documents, including the attachments and exhibits thereto:

• The Plaintiffs’ First Amended Complaint (“Am. Compl.”), Dkt. No. 20;

• The Defendants’ Motion to Dismiss (“Defs.’ Mot.”), Dkt. No. 26;

• The Plaintiffs’ Opposition to the Defendants’ Motion to Dismiss (“Pls.’ Opp’n”), Dkt. No. 27;

• The Defendants’ Reply in Support of the Motion to Dismiss (“Defs.’ Reply”), Dkt. No. 29;

• The Plaintiffs’ Motion for Stay Under 5 U.S.C. § 705 or, in the Alternative, for Preliminary Injunction (“Pls.’

Mem.”), Dkt. No. 30;

• The Memorandum in Support of the Plaintiffs’ Motion (“Pls.’ Mem.”), Dkt. No. 30-1;

• The Defendants’ Opposition to the Plaintiffs’ Motion (“Defs.’ Opp’n”), Dkt. No. 31;

• The Plaintiffs’ Reply in Support of the Motion for Stay Under 5 U.S.C. § 705 or, in the Alternative, for Preliminary Injunction (“Pls.’ Reply”), Dkt. No. 34;

• The Plaintiffs’ Response to September 5 Minute Order (“Pls.’ Resp.”), Dkt. No. 39;

4

authority, and the entire record, the Court concludes that Plaintiffs are entitled to a stay of the Address-Sharing Policy and other appropriate injunctive relief, and that Plaintiffs’ APA claim regarding the broader Data Sharing policy should not be dismissed. However, because the APA affords a meaningful and adequate basis for judicial review of the Data Policy, Plaintiffs’ ultra vires claim for similar relief on non-statutory, equitable grounds cannot succeed and must be dismissed for failure to state a claim. The Court shall therefore GRANT IN PART and DENY IN PART Defendants’ [26] Motion to Dismiss and GRANT Plaintiffs’ [30] Motion for Stay or, in the Alternative, for Preliminary Injunction. The Court shall DISMISS WITHOUT PREJUDICE Count One of Plaintiffs’ [20] Amended Complaint, STAY the Address-Sharing Policy and ORDER other appropriate interim relief as this case proceeds.

I. BACKGROUND

Every year, millions of taxpayers submit sensitive, personal information to the Internal Revenue Service (“IRS”). This case concerns the extent to which the IRS may share that information with other federal agencies.

There was a time when taxpayer information was considered “public record[], the access to which was controlled by the Executive Branch.” 2 But that changed in 1976, when, “in the wake of Watergate and White House efforts to harass those on its ‘enemies list,’” Congress amended Section 6103 of the Internal Revenue Code through the Tax Reform Act of 1976 (the “1976 TRA”) “to protect the privacy of tax return information and to regulate in minute detail the disclosure of this material.” Tax Analysts v. I.R.S., 117 F.3d 607, 611 (D.C. Cir. 1997); Lake v. Rubin, 162 F.3d

• The Defendants’ Response to September 5 Minute Order (“Defs.’ Resp.”), Dkt. No. 40;

• The Administrative Record (“Admin. R.”), Dkt. No. 48.

The Court has also considered the arguments and representations of counsel at the Preliminary Injunction Hearing held on September 5, 2025. See Tr. of Sept. 5, 2025 Mot. Hr’g (“Hr’g Tr.”), Dkt. No. 38. 2 Taxpayer Advoc. Serv., National Taxpayer Advocate: 2003 Annual Report to Congress at 238 (Dec. 31, 2003), https://perma.cc/37AU-WLKP (“Taxpayer Advocate Report”).

5

113, 115 (D.C. Cir. 1998). 3 These amendments established the “general rule” that taxpayer “returns and return information shall be confidential.” 26 U.S.C. § 6103(a) (capitalization modified). As explained in a report from the Senate Finance Committee, Congress decided that taxpayer information “was entitled to essentially the same degree of privacy as those private papers maintained in [the] home.” S. Rep. No. 94-938, 94th Cong., 2d Sess., at 328 (1976). 4 However, Congress also provided exceptions to this general rule through provisions that permit—and sometimes require—the IRS to disclose taxpayer returns and return information to various third parties, including other federal agencies. See 26 U.S.C. § 6103(c)–(o). In the past, the IRS has argued that disclosure under any of these exceptions “must be subjected to strict scrutiny,” as each exception “whittles away at the core promise of the voluntary tax system: If you come forward and file this highly personal information with [the IRS], [the IRS] will hold this information in confidence.” 5 Plaintiffs claim that the IRS cultivated a “Privacy Policy” in response to the 1976 TRA amendments. Pls.’ Mem., Dkt. No. 30-1 at 7. Plaintiffs define the Privacy Policy as “a policy of strictly protecting taxpayer information both to conform with the requirements of the Internal Revenue Code and to further the policy aims of the agency to engender trust in the tax system and encourage the filing of tax returns and the paying of taxes.” Koskinen Decl., Dkt. No. 30-13 ¶ 12. This Privacy Policy was evidenced, Plaintiffs argue, through a “combination of the IRS’s adherence to statutory requirements, compliance with the IRS policy manual, and prioritization and implementation of privacy-protective practices.” Pls.’ Mem., Dkt. No. 30-1 at 7. For instance,

3 See also Taxpayer Advocate Report, supra note 2 at 241 (“The Act effected an important shift of power: determinations regarding disclosure no longer resided in the executive branch. Instead, all such exceptions would be authorized by Congress in the Internal Revenue Code.”). 4 This report was eventually adopted by the House with little revision. See H.R. Conf. Rep. No. 94-1515, 94th Cong., 2d Sess. (1976). 5 Taxpayer Advocate Report, supra note 2 at 245.

6

the IRS has, in the past, conveyed to Congress that “if IRS data is to be provided at all, the IRS should be the last stop—not the first—for information for purposes unrelated to tax administration.” Id. The IRS has also instructed its own personnel that “Congress decided that federal law enforcement officials should not have easier access to information about a taxpayer maintained by the IRS than they would have if they sought to compel the production of that information from the taxpayer themselves.” Id. at 8–9. And the IRS represented this policy to the American public, as seen in one brochure that reads: “The General Rule - Tax Information Is Confidential!” Id. at 8.

Plaintiffs now claim that the IRS has unlawfully replaced its Privacy Policy with a new policy that Plaintiffs refer to as the “Data Policy.” Pls.’ Mem., Dkt. No. 30-1 at 9–10. The Data Policy, according to Plaintiffs, “(1) greatly expands access to and use of taxpayer information within the IRS; (2) consolidates data systems to facilitate broad, not segregated access within the agency; and (3) permits large-scale data-sharing with other agencies, unrelated to tax administration.” Id. In other words, the Data Policy is “a permissive data-sharing policy that prioritizes the consolidation and inter-agency sharing of sensitive taxpayer information in the IRS’s custody.” Id.

The IRS and its co-defendants argue that the Data Policy does not exist. See Defs.’ Opp’n, Dkt. No. 31 at 1. But Plaintiffs argue that the Data Policy “is apparent from recent IRS actions.” Pls.’ Mem., Dkt. No. 30-1 at 10. For instance, the IRS has recently invested in technical infrastructure that will facilitate rapid access to massive amounts of IRS data by hiring a federal contractor to build a “single, unified database of taxpayer information within the IRS” that will “permit automated access to all IRS taxpayer information by IRS employees in one interface.” Id. To initiate this project, leadership at the IRS had to provide the contractor with a modified scope

7

of work and new task orders because the contractor had originally “been working on a contract to aid the IRS is making it more efficient for customer service representatives to access basic information concerning taxpayers that contacted the agency with questions and concerns.” Am. Compl., Dkt. No. 20 ¶¶ 180–86 (explaining this as a “highly irregular procurement process”). Plaintiffs argue that the IRS’s new Data Policy is also evidenced by the IRS’s efforts to consolidate taxpayer data with other data from across the federal government. For example, in April 2025, a whistleblower reported to Congress that the IRS was providing taxpayer information to the Department of Government Efficiency (“DOGE”) for DOGE to include in a master database of information from across the federal government. Pls. Mem., Dkt. No. 30-1 at 10–11. Plaintiffs further argue that the Data Policy is apparent from the IRS’s efforts to facilitate sharing of IRS data with other federal agencies. For instance, DOGE affiliates have asked the IRS to create an “omnibus” agreement with other federal agencies that would allow those agencies to cross- reference a broad swath of IRS data. Pls. Mem., Dkt. No. 30-1 at 10.

Plaintiffs argue that the Data Policy is also evidenced by the IRS’s exclusion of senior leadership who have opposed certain actions taken by the IRS pursuant to the Data Policy. Pls.’ Mem., Dkt. No. 30-1 at 11 (“These leaders include multiple Acting IRS Commissioners, the Chief Risk Officer, the Chief Privacy Officer, the Chief Financial Officer, the Chief Information Officer, the subsequent Chief Information Officer, and approximately 50 senior IRS IT executives”). Evidence surrounding the IRS’s review of three requests for taxpayer information made by ICE between February 2025 and June 2025 provides an example. ICE first requested taxpayer information from the IRS in February 2025, when it requested extensive information—including addresses, SSN’s, relatives, and even IP information—for approximately 700,000 “illegal aliens who ha[d] standing deportation orders.” Admin. R., Dkt. No. 48 at TD_09. Documents from the

8

administrative record suggest that the legality of ICE’s first request was reviewed under the direction of an IRS official whom the Court will refer to as “P.W.” Id. at TD_03. Under P.W.’s direction, the IRS refused to disclose the taxpayer information requested by ICE because it determined that ICE’s request did not meet certain legal requirements. Id. at TD_01–8. ICE made its second request in June 2025, this time requesting taxpayer information for its “full alien population” of over 7 million individuals. Id. at TD_86. ICE’s second request appears to have been reviewed by the IRS’s legal team under the direction of one “A.D.”, rather than P.W. See id. at TD_93. Under A.D.’s direction, the IRS determined that it was “again unable to process” ICE’s request because it was again unlawful. Id. ICE’s third and last-known request for taxpayer information also came in June 2025, this time for address information on 1.2 million taxpayers. Id. at TD_112–3. The administrative record shows that A.D. was again tasked with providing legal approval of ICE’s third request at the time the request was made. See id. at TD_105 (email from IRS official to Treasury official explaining that the IRS had “not shared anything back with ICE per the direction of [A.D.]”). However, shortly after the IRS received ICE’s third request, Treasury officials directed IRS officials to bypass A.D. and obtain legal approval from a different IRS official, “A.M.” Id. at TD_104. As one IRS official put it in an email to A.M., he was “told by [A.D.] to not send anything back [to ICE] until he gave us the green light,” but he “received a call from [a Treasury official] who asked me to get the green light from you.” Id. A.M. provided legal approval for ICE’s third request that same day. Id. at TD_103.

Following A.M.’s legal approval, the IRS disclosed to ICE the last known address of approximately 47,000 taxpayers. Plaintiffs claim that this known instance of information sharing is further evidence of the IRS’s Data Policy.

9

Plaintiffs also claim that the IRS’s disclosure of address information to ICE violated the Internal Revenue Code. As the Court referenced above, the IRS refused to disclose taxpayer information to ICE in February 2025 because ICE’s request for that information did not qualify for an exception to the Internal Revenue Code’s general rule of confidentiality. Shortly thereafter, in April 2025, the IRS and ICE entered into a Memorandum of Understanding (“MOU”). See Dkt. No. 30-6. The MOU between the IRS and ICE “sets forth the agreement of the parties” regarding ICE’s future use of the confidentiality exception found in Internal Revenue Code Section 6103(i)(2) “for the submission of requests for addresses” from the IRS. Id. § 1.e. Internal Revenue Code Section 6103(i)(2) requires the IRS to disclose taxpayer information to federal agencies engaged in a criminal investigation or proceeding on the condition that the requested information be used solely for the relevant criminal investigation or proceeding. 26 U.S.C. § 6103(i)(2). However, as the MOU outlines, a variety of requirements must be met before the IRS can lawfully disclose taxpayer information pursuant to Section 6103(i)(2). For instance, an agency’s request for information must be in writing and include the “name and address of the taxpayer” with respect to whom the requested information relates, the “statutory authority” for the criminal investigation or proceeding, 6 and the “specific reason or reasons” why disclosure is relevant to the criminal investigation or proceeding. Id. § 6103(i)(2)(B). Furthermore, a request can only be made by an agency’s head or Inspector General, and the IRS can only disclose the requested information to “officers and employees of [the requesting] agency who are personally and directly engaged in” the relevant criminal matter. Id. § 6103(i)(2)(A).

6 The MOU provides that the “statutory authority” for ICE’s requests under Section 6103(i)(2) will be “8 U.S.C. § 1253(a)(1) or another specifically designated Federal criminal statute.” MOU, Dkt. No. 31-1 § 1.e. 8 U.S.C. § 1253(a)(1) prohibits failing to depart the U.S. within 90 days of a removal order.

10

ICE’s first request for taxpayer information following the MOU came in mid-June 2025.

Admin. R., Dkt. No. 48 at TD_86. This request—which, again, sought confidential information for ICE’s “full alien population” of over 7 million individuals—failed to meet most of the Section 6103(i)(2) requirements outlined in the MOU. Id. at TD_83–90. When the IRS prompted ICE to provide more information to bring its request into compliance with the MOU, an ICE official represented that ICE was conducting criminal investigations under 8 U.S.C. § 1325 7 but added that “the primary goal” of the request was “to enrich [ICE’s] data” with “the most recent” addresses that the IRS could identify. Id. at TD_83. The IRS ultimately determined that it could not lawfully fulfill ICE’s request under Section 6103(i)(2) because ICE had failed to provide: (i) a written request from the head of ICE; (ii) the “specific reason or reasons” why the requested taxpayer information would be relevant to a criminal investigation or proceeding; (iii) sufficient identity information for the ICE officers or employees “personally and directly engaged” in the relevant criminal matter; and (iv) an attestation that the requested information would only be used for the relevant criminal investigations or proceedings. Id. at TD_93.

ICE submitted its second request following the MOU within a week after the IRS rejected its prior request. Id. at TD_112–3. On June 27, 2025, ICE submitted a letter to the IRS requesting “the last known address of approximately 1.28 million individuals identified by ICE.” Walker Decl., Dkt. No. 31-1 ¶ 6. On August 7, 2025, the IRS responded to ICE’s request by disclosing to ICE the last known addresses for approximately 47,000 individuals. Id. ¶ 7. Plaintiffs argue that the IRS’s August 7 disclosure to ICE was unlawful because ICE’s June 27 request failed to meet several of the requirements necessary for disclosure under Section 6103(i)(2). For example, Plaintiffs argue that the IRS violated Section 6103(i)(2)’s requirement that the IRS only disclose

7 This provision, unlike the provision listed in the MOU, criminalized illegal entry into the United States.

11

taxpayer information to agency personnel who are “personally and directly engaged in” the relevant criminal matter because the IRS accepted ICE’s representation that one individual was personally and directly engaged in approximately 1.2 million criminal investigations or proceedings. See Defs.’ Resp. to Order, Dkt. No. 40 ¶ 2. Plaintiffs also claim that ICE intends to impermissibly use the address information it obtained from the IRS to conduct civil immigration enforcement such as deportation. See Pls.’ Mem., Dkt. No. 30-1. The Court shall discuss these claims and several others in more detail below.

* * * *

Plaintiffs filed their First Amended Complaint against Defendants on May 16, 2025. Am.

Compl., Dkt. No. 20. Plaintiffs’ Amended Complaint attacked the IRS’s Data Policy generally. Id. Plaintiffs claimed that the Data Policy constituted ultra vires agency action and violated the Internal Revenue Code along with the Privacy Act. Id. ¶¶ 216–29. On July 10, 2025, Defendants moved to dismiss Plaintiffs’ Amended Complaint. Defs.’ Mot., Dkt. No. 26. Plaintiffs opposed Defendants’ motion. Pls.’ Opp’n, Dkt. No. 27. And Defendants replied. Defs.’ Reply, Dkt. No. 29.

On August 20, 2025, Plaintiffs filed a motion to stay and preliminarily set aside the IRS’s Data Policy. Pls.’ Mot., Dkt. No. 30; Pls.’ Mem., Dkt. No. 30-1. Plaintiffs’ motion for preliminary relief focuses on the IRS’s Data Policy as it relates to information sharing with ICE, rather than the IRS’s Data Policy generally. Id. Furthermore, Plaintiffs’ motion for preliminary relief does not claim that the IRS’s Data Policy constitutes ultra vires agency action, nor does it claim that the Data Policy violates the Privacy Act. Pls.’ Mem., Dkt. No. 30-1 at 5 n. 5. Rather, Plaintiffs’ motion for preliminary relief is brought “solely on the basis” of Plaintiffs’ claim that Defendants have violated the APA because the IRS’s implementation of the Data Policy with respect to sharing

12

confidential taxpayer address information with ICE was arbitrary and capricious, and the IRS’s sharing of confidential taxpayer address information with ICE violated the Internal Revenue Code. Id. Plaintiffs seek an Order that (i) stays the Data Policy to the extent that the Policy “permits disclosures of IRS data to ICE under [Section] 6103(i)(2)” of the Internal Revenue Code; (ii) prohibits Defendants from transferring to DHS or its component agencies any IRS data relating to taxpayer address information or a taxpayer’s receipt of tax credits or refunds; (iii) requires Defendants to ensure that any information the IRS has disclosed to ICE pursuant to Internal Revenue Code Section 6103(i)(2) is destroyed; and (iv) prohibits Defendants from implementing a policy similar to the Data Policy under a different name. Pls.’ Mot., Dkt. No. 30 at 1–2; Proposed Order, Dkt. No. 30-2. The Defendants opposed Plaintiffs’ motion. Defs.’ Opp’n, Dkt. No. 31. And Plaintiffs replied. Pls.’ Reply, Dkt. No. 34.

On September 5, 2025, the Court held a hearing on Plaintiffs’ motion for preliminary relief.

See Hr’g Tr., Dkt. No. 38. On September 9, after concluding that Plaintiffs had established both a substantial likelihood of Article III standing and a substantial likelihood that at least one aspect of the challenged policy was reviewable, final agency action, the Court ordered the Defendants to produce the administrative record. See Min. Order, September 9, 2025. The Defendants produced the administrative record on October 29, 2025. Admin. R., Dkt. No. 48. Plaintiffs filed objections to the administrative record on November 3, 2025, arguing that two additional documents should be included in the record. Pls.’ Not. of Objections, Dkt. No. 49. Defendants responded to Plaintiffs’ objections on November 10, 2025, by consenting to the inclusion of those two documents in the record. Defs.’ Response to Objections, Dkt. No. 51. Accordingly, the Court has included the two documents identified in Plaintiffs’ November 3 objections in its review of the record.

13

Defendants’ motion to dismiss and Plaintiffs’ motion for preliminary relief are now ripe for decision.

II. LEGAL STANDARD

The Administrative Procedure Act (“APA”) provides for judicial review of “final agency action for which there is no other adequate remedy in a court.” 5 U.S.C. § 704. If final agency action is shown to be arbitrary and capricious or contrary to law, the reviewing court must “set aside” the action. Id. § 706. Section 705 of the APA provides that a reviewing court may, on such conditions as may be required and to the extent necessary to prevent irreparable injury, issue “all necessary and appropriate process to postpone the effective date of an agency action or to preserve status or rights pending conclusion of the review proceedings.” 5 U.S.C. § 705.

Courts in the D.C. Circuit assess motions for interim relief under Section 705 using the same four-part standard that governs requests for preliminary injunctions. Nat’l Council of Nonprofits v. Off. of Mgmt. & Budget, 775 F. Supp. 3d 100, 121 (D.D.C. 2025) (LLA); Nw. Immigrant Rts. Project v. United States Citizenship & Immigr. Servs., 496 F. Supp. 3d 31, 45 (D.D.C. 2020) (RDM); Sierra Club v. Jackson, 833 F. Supp. 2d 11, 30 (D.D.C. 2012) (PLF); see Cuomo v. U.S. Nuclear Regul. Comm’n, 772 F.2d 972, 974 (D.C. Cir. 1985). To obtain a preliminary injunction, a plaintiff must establish (1) that they are “likely to succeed on the merits,” (2) that they are “likely to suffer irreparable harm in the absence of preliminary relief,” (3) that “the balance of equities tips in [their] favor,” and (4) that “an injunction is in the public interest.” Winter v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 20 (2008). When the Government is the opposing party, as it is in this case, the balance-of-equities and public-interest factors “merge,” and courts address those factors together. Nken v. Holder, 556 U.S. 418, 435 (2009).

14

To obtain a preliminary injunction, “the movant has the burden to show that all four Winter factors, taken together, weigh in favor of the injunction.” Abdullah v. Obama, 753 F.3d 193, 197 (D.C. Cir. 2014) (citation modified). Before the Supreme Court announced its decision in Winter, courts in this Circuit applied a “sliding-scale” approach to the preliminary-injunction factors, under which “a strong showing on one factor could make up for a weaker showing on another.” Sherley v. Sebelius, 644 F.3d 388, 392 (D.C. Cir. 2011). In the years since Winter, courts in this Circuit have repeatedly declined to decide “whether the sliding-scale approach remains valid.” See Changji Esquel Textile Co. v. Raimondo, 40 F.4th 716, 726 (D.C. Cir. 2022). However, this Circuit has held variously that a failure to show a substantial likelihood of standing, Food & Water Watch, Inc. v. Vilsack, 808 F.3d 905, 913 (D.C. Cir. 2015), success on the merits, Ark. Dairy Co-op Ass’n v. USDA, 573 F.3d 815, 832 (D.C. Cir. 2009), or irreparable harm, Alpine Sec. Corp. v. Fin. Indus. Regul. Auth., 121 F.4th 1314, 1336–37 (D.C. Cir. 2024), are each independently fatal to a request for injunctive relief.

III. ANALYSIS

Because there is substantial overlap between the issues implicated by Plaintiffs’ motion for preliminary relief and the issues implicated by Defendants’ motion to dismiss, the Court shall resolve both motions here. Plaintiffs’ burden under their motion for preliminary relief is more significant than their burden under Defendants’ motion to dismiss. To succeed on their motion for preliminary relief, Plaintiffs must show a substantial likelihood of standing and show that they are entitled to relief under the four Winter factors mentioned above. See Food & Water Watch, 808 F.3d at 913. For Plaintiffs’ Complaint to survive Defendants’ motion to dismiss, on the other hand, Plaintiffs need only state a plausible claim to standing and a plausible claim to relief. Id.

15

A. Plaintiffs have shown a substantial likelihood of Article III standing The federal judicial power is confined to the resolution of “Cases” and “Controversies.”

U.S. Const. art. III, § 2, cl. 1. “For there to be a case or controversy under Article III, the plaintiff must have a personal stake in the case—in other words, standing.” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021); Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992) (“Though some of its elements express merely prudential considerations that are part of judicial self-government, the core component of standing is an essential and unchanging part of the case-or-controversy requirement of Article III.”).

“A plaintiff must demonstrate standing ‘with the manner and degree of evidence required at the successive stages of the litigation.’” TransUnion, 594 U.S. at 431 (quoting Lujan, 504 U.S. at 561). At the pleading stage, a plaintiff need only “state a plausible claim” to standing. Food & Water Watch, 808 F.3d at 913. Plaintiffs seeking a preliminary injunction, however, face “a significantly more rigorous burden to establish standing.” Swanson Grp. Mfg. LLC v. Jewell, 790 F.3d 235, 240 (D.C. Cir. 2015) (citing Chamber of Commerce v. EPA, 642 F.3d 192, 200 (D.C. Cir. 2011)). A plaintiff seeking a preliminary injunction must show a “substantial likelihood” of standing. Food & Water Watch, 808 F.3d at 913. Moreover, a plaintiff seeking a preliminary injunction cannot rely on past injuries alone to establish standing; they must show that they are either “suffering an ongoing injury” or facing “an immediate threat of injury.” Dearth v. Holder, 641 F.3d 499, 501 (D.C. Cir. 2011).

The Plaintiffs in this case are organizations. When an organization seeks to establish standing, it may do so in two ways. It may show that it has “organizational standing” to sue on its own behalf. See FDA v. All. For Hippocratic Med., 602 U.S. 367, 393 (2024). Or it may demonstrate that it has “associational standing” to sue on behalf of its members. See Hunt v.

16

Washington State Apple Advert. Comm’n, 432 U.S. 333, 343 (1977). Plaintiffs assert both forms of standing.

In determining whether Plaintiffs have established a substantial likelihood of either form of standing, the Court “must be careful not to decide the questions on the merits for or against” the Plaintiffs. Tanner-Brown v. Haaland, 105 F.4th 437, 444 (D.C. Cir. 2024) (citing City of Waukesha v. E.P.A., 320 F.3d 228, 235 (D.C. Cir. 2003) (per curiam)). The Court “must therefore assume that on the merits the Plaintiffs would be successful in their claims.” Id. (capitalization modified).

1. Plaintiffs have shown a substantial likelihood of organizational standing The Center for Taxpayer Rights (“the Center”) is the only Plaintiff to assert organizational standing. See Pls.’ Mem., Dkt. No. 30-1; Pls.’ Opp’n, Dkt. No. 27 at 27; Am. Compl. ¶¶ 189–215.

An organization asserts organizational standing when it seeks to sue on its own behalf for injuries it has sustained. All. for Hippocratic Med., 602 U.S. at 393 (citing Havens Realty Corp. v. Coleman, 455 U.S. 363, 379, n. 19 (1982)). To establish organizational standing, an organization must satisfy the usual standards for Article III standing that apply to individuals: injury in fact, causation, and redressability. Id. at 393–94. Defendants argue that Plaintiffs have failed to show that the Center has suffered an injury in fact. Defs.’ Opp’n, Dkt. No. 31 at 17–20; Defs.’ Mot., Dkt. No. 26-1 at 14–16. Therefore, the key issue in determining whether the Center has organizational standing is whether the Center “has suffered a concrete and demonstrable injury to [its] activities.” People for the Ethical Treatment of Animals v. U.S. Dep’t of Agric., 797 F.3d 1087, 1093 (D.C. Cir. 2015) (citation omitted).

To establish that the Center has suffered a concrete and demonstrable injury to its activities, Plaintiffs must show that the IRS’s Data Policy has “perceptibly impaired [the Center’s] ability to provide . . . services for [its members],” Havens, 455 U.S. at 379, or “directly affected and

17

interfered with [the Center’s] core business activities,” All. for Hippocratic Med., 602 U.S. at 395. Plaintiffs must show that the Center has suffered “far more than simply a setback to [its] abstract social interests.’” All. for Hippocratic Med., 602 U.S. 367, 393–94 (citing Havens, 455 U.S. at 379). To determine whether the Center’s injury “is ‘concrete and demonstrable’ or merely a ‘setback’ to its ‘abstract social interests,’” the Court must ask, first, “whether the [Defendants] action or omission to act ‘injured the [Center’s] interest’” and, second, “whether the [Center] ‘used its resources to counteract that harm.’” People for the Ethical Treatment of Animals, 797 F.3d at 1094 (citing Havens Realty Corp., 455 U.S. at 379; Equal Rights Ctr., 633 F.3d at 1140). The Center, however, “cannot spend its way into standing simply by expending money to gather information and advocate against” the IRS’s Data Policy. All. for Hippocratic Med., 602 U.S. at 394. Therefore, the Center will “not suffer an injury in fact where it ‘expend[s] resources to educate its members and others’ unless doing so subjects the [Center] to ‘operational costs beyond those normally expended.’” Food & Water Watch, 808 F.3d at 920 (quoting Nat’l Taxpayers Union, Inc. v. United States, 68 F.3d 1428, 1434 (D.C. Cir. 1995)).

For the reasons stated below, the Court finds that the Plaintiffs have shown a substantial likelihood that the IRS’s Data Policy has injured the Center’s interests and “subject[ed] the [Center] to ‘operational costs beyond those normally expected.’” Food & Water Watch, 808 F.3d at 920 (quoting Nat’l Taxpayers Union, Inc., 68 F.3d 1428 at 1434). Accordingly, Plaintiffs have established that the Center has organizational standing to bring its motion for preliminary relief.

The Center’s mission “is to advance taxpayer rights, promote trust in the tax system, and increase access to justice in the tax system,” particularly for “the most vulnerable populations, including immigrants, people whose first language is not English, low-income people, and domestic violence survivors.” Pls.’ Mem., Dkt. No. 30-1 at 16 (citing Olson Decl., Dkt. No. 30-8

18

¶ 3–6). The Center pursues this mission through a variety of services and activities. For instance, the Center provides pro bono or nominal fee legal representation to low-income taxpayers through its federally funded Low-Income Taxpayer Clinic (“LITC”). Olson Decl., Dkt. No. 30-8 ¶ 7. To receive federal funding for its LITC, the Center must serve “taxpayers who are low-income or speak English as a second language” and “identify and advocate for issues that impact these taxpayers.” Id. ¶ 8. The Center also operates a nationwide network, known as “LITC Connect,” of other LITCs, attorneys, accountants, and enrolled agents. Id. ¶ 5 (“LITC Connect has approximately 160 individual members and 90 LITC members.”). The Center’s LITC Connect “holds weekly calls with several dozen representatives of its member LITCs, provides training and support, and carries professional liability insurance for the network of professionals that serve LITC members.” Id. ¶ 19. Finally, the Center “holds conferences, workshops, webinars, and other events to educate individuals on issues related to taxpayer rights, including privacy rights, and promoting trust in the tax system.” Id. ¶ 6.

Plaintiffs claim that the IRS’s Data Policy has significantly harmed the Center’s ability to provide services and activities in furtherance of its mission. Pls.’ Mem., Dkt. No. 30-1 at 16. Plaintiffs argue that public reporting on the Data Policy has made taxpayers less willing to come to the Center’s events, to seek its legal guidance, or to engage with the Center’s education and outreach. Id. at 17; Olson Decl., Dkt. No. 3-8 ¶¶ 41–44. Plaintiffs argue that this is especially true for taxpayers who do not speak English as a first language and are more likely to be immigrants, for whom the Center is required to conduct outreach and education as a statutory condition of its LITC’s federal funding. Olson Decl., Dkt. No. 3-8 ¶ 41. To support this claim, Plaintiffs point to the fact that, this year, the Center “has held only a tenth of the events it did compared to last year.” Id. ¶¶ 41–44. And while last year the Center provided representation in 14 cases involving

19

immigrant taxpayers with Individual Taxpayer Identification Numbers (“ITINs”), this year it has only provided representation in one such case. Id. To adapt to this “dramatic decline in interest and engagement,” the Center has been forced to expend nearly 10 percent of its LITC’s operating expenses on additional education and outreach. See Olson Decl., Dkt. No. 30-8 ¶¶ 44–46. But even when this additional outreach is successful and the Center finds itself in a position to represent a taxpayer, Plaintiffs argue that the Center’s LITC “can no longer provide substantive advice about whether or not the taxpayers should or can safely submit information to the IRS” because it “cannot reconcile the IRS’s reported data-sharing conduct with [its] understanding of the laws that should constrain it.” Id. ¶¶ 47–49. Plaintiffs convey that this “has resulted in immediate impairment to [the Center’s] ability to counsel [its] clients.”

Plaintiffs have shown a substantial likelihood that the IRS’s Data Policy has “perceptibly impaired [the Center’s] ability to provide . . . services” for the population it serves. Havens, 455 U.S. at 379. Plaintiffs have introduced evidence showing that the taxpayers the Center is statutorily required to serve are no longer willing to engage with the Center due to the IRS’s Data Policy. This decrease in engagement harms the Center’s ability to provide educational services for the taxpayers it is statutorily required to serve. To address this harm, the Center has been forced to expend resources beyond what it typically expects to expend in an effort to stay in compliance with its requirements for federal funding. This increase in expenditure cannot rightfully be characterized as an attempt by the Center to “spend its way into standing.” All. for Hippocratic Med., 602 U.S. at 394. If the Center were to forgo these additional expenses, then the Center would risk losing its federal funding. See Olson Decl., Dkt. No. 27-1 ¶ 4. The loss of such funding due to unlawful action is a concrete harm.

20

Plaintiffs have also shown that the IRS’s Data Policy has interfered with the Center’s ability to provide its pro bono or nominal fee representation services. This interference closely resembles the injury found sufficient for organizational standing in Havens Realty Corp. v. Coleman, 455 U.S. 363 (1982). The relevant question in Havens was whether a housing counseling organization, HOME, had standing to sue Havens Realty, which owned and operated apartment complexes, for engaging in unlawful “racial steering” by lying to certain racial groups about the availability of rental units. Havens, 455 U.S. at 366-68; see also All. for Hippocratic Med., 602 U.S. at 395. The Supreme Court found that HOME had standing because it showed that Havens Realty’s practice of racial steering “perceptibly impaired HOME’s ability to provide counseling and referral services for low-and moderate-income homeseekers” and required HOME “to devote significant resources to identify and counteract” the racially discriminatory steering practices. Id. at 379. The Court explained that “[s]uch concrete and demonstrable injury to the organization’s activities—with the consequent drain on the organization’s resources—constitutes far more than simply a setback to the organization’s abstract social interests.” Id. Although the Supreme Court “has been careful not to extend the Havens holding beyond its context,” All. for Hippocratic Med., 602 U.S. at 396, the Center’s alleged injuries fall squarely within that context. “Critically,” like HOME, the Center is not only “an issue-advocacy organization,” but it also operates a “counseling service” by representing clients who are low-income taxpayers in their tax disputes. Id. at 395; Am. Compl., Dkt. No. 20 ¶ 194. And like HOME, the Center has shown that its ability to provide these services is perceptibly impaired by the IRS’s Data Policy. See, e.g., Olson Decl., Dkt. No. 30-8 ¶ 51 (“The data sharing policy will drastically erode [the Center’s] pro bono legal services program, which is central to [its] mission and vision to increase access to counsel for low-income individuals, and in particular the ESL community.”); Pls.’ Mem., Dkt. No.

21

30-1 at 16–18, 37; Pls.’ Opp’n, Dkt. No. 27 at 29–30. Accordingly, Plaintiffs have alleged injuries to the Center that are analogous to the injuries the Supreme Court found sufficient for organizational standing in Havens Realty.

Contrary to Defendants’ argument, the connection between the IRS’s Data Policy and the Center’s injuries is not too speculative. Plaintiffs have provided ample public reporting on the IRS’s Data Policy sufficient to infer that taxpayers across America are informed of the IRS’s shift in disclosure policy. See Am. Compl., Dkt. No. 20. Plaintiffs have also introduced evidence showing that the promise of confidentiality is critical to participation in a voluntary tax system. See Olson Decl., Dkt. No. 30-8 ¶ 53 (“It is an axiom of tax administration that taxpayer trust in the system is critical to maintaining and increasing voluntary compliance.”) (providing additional sources); id. ¶ 30 (“These confidentiality protections serve not only taxpayers’ interests; they also strengthen the system of tax administration, which necessarily relies on voluntary compliance.”); Memorandum from Peter J. Wallison, General Counsel, Department of the Treasury, to Secretary Regan, Disclosure to the Selective Service System (May 17, 1982) at 2 (“The costs of IRS disclosure also seem high. . . . A potentially costly and burdensome class action law suit is likely to be filed on behalf of those whose addresses were disclosed, and the publicity generated by the event will inevitably have some effect on the public’s willingness to disclose information voluntarily to the IRS.”). And while the promise of confidentiality is important to every taxpayer, Plaintiffs have submitted evidence showing that it is especially important to the low-income and immigrant taxpayers the Center is statutorily required to serve. See Pls.’ Mem., Dkt. No. 30-1 at 15–16 (explaining that immigrant taxpayers face unique risks related to immigration enforcement and misidentification). Taken together, it is clear why the former National Taxpayer Advocate and the Center’s current Executive Director submitted a declaration stating “that the sudden

22

difficulty the Center and other LITCs have experienced in reaching the population who [they] exist to serve is caused by the IRS’s change in its data policy and shift to more open sharing of sensitive taxpayer information across the federal government.” Olson Decl., Dkt. No. 27-1 ¶¶ 2, 10.

Accordingly, Plaintiffs have shown a substantial likelihood that the Center has suffered and will continue to suffer a concrete injury. Plaintiffs have also shown that this continuing injury is caused by the IRS’s Data Policy. In addition, the Court determines that the Center’s continuing injury would be remedied by a positive judicial outcome, as such an outcome would likely temper the continuing loss of taxpayer trust and allow the Center to start building that trust back without expending an abnormal amount of funds to accomplish their statutorily-approved duty.

* * * *

In sum, Plaintiffs have shown a substantial likelihood that the Center has organizational standing to bring its claims for preliminary relief. Plaintiffs have shown a substantial likelihood that the IRS’s Data Policy has caused taxpayers to become unwilling to engage with the Center, which has forced the Center to dedicate resources and make expenditures beyond its normal operational levels at the risk of losing its federal funding. Plaintiffs have also shown that the IRS’s Data Policy has undermined the Center’s ability to provide legal representation to its LITC clients. Accordingly, the Court concludes that the Center has organizational standing to bring its claims against the Defendants.

2. The Plaintiffs have shown a substantial likelihood of associational standing Plaintiffs also bring this suit on behalf of their members, so they must establish associational standing. Pls.’ Mem., Dkt. No. 30-1 at 39; Pls.’ Opp’n, Dkt. No. 27 at 20. A membership organization has associational standing to bring suit on behalf of its members if it can establish that: “(a) its members would otherwise have standing to sue in their own right; (b) the interests it seeks to protect are germane to the organization’s purpose; and (c) neither the claim

23

asserted nor the relief requested requires the participation of individual members in the lawsuit.” Hunt v. Washington State Apple Advert. Comm’n, 432 U.S. 333, 343 (1977). To satisfy the first element of associational standing—i.e., to show that their members otherwise have standing to sue in their own right—Plaintiffs “must show (i) that [their members] suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” TransUnion, 594 U.S. at 423. Defendants argue that Plaintiffs lack associational standing because their members’ alleged injuries are neither “concrete” nor “actual or imminent.” Defs.’ Opp’n, Dkt. No. 31 at 10– 17; Defs.’ Mot., Dkt. No. 26 at 8–14.

Plaintiffs assert associational standing on the basis of an increased risk of harm to their members. 8 Pls.’ Mem., Dkt. No. 30-1 at 38–9; Pls.’ Opp’n, Dkt. No. 27 at 20. Specifically, Plaintiffs claim that the IRS has unlawfully disclosed their members’ confidential address information to ICE, and that there is an “imminent risk” that their members’ confidential address information will either be publicly disclosed or impermissibly used. Pls.’ Mem., Dkt. No. 30-1 at 39. The D.C. Circuit “has limited its jurisdiction over cases alleging the possibility of increased- risk-of-harm to those where the plaintiff can show ‘both (i) a substantially increased risk of harm and (ii) a substantial probability of harm with that increase taken into account.’” Food & Water

8 On the present record, it is not clear that the Center has “members” in the relevant sense. Although the Center has clients whose interests it “represents in good faith,” it does not appear to be a “voluntary membership organization” in which its clients are members who finance the organization, guide its activities, or select its leadership. See Students for Fair Admissions, Inc. v. President & Fellows of Harvard Coll., 600 U.S. 181, 201 (2023); Viasat, Inc. v. FCC, 47 F.4th 769, 781 (D.C. Cir. 2022). However, because the Court has already concluded that the Center has established a substantial likelihood of organizational standing, and because other Plaintiffs are traditional membership organizations with similarly situated members who assert identical claims and seek the same relief, the Court need not resolve whether the Center also has associational standing. See Am. Anti-Vivisection Soc’y v. United States Dep’t of Agric., 946 F.3d 615, 619–20 (D.C. Cir. 2020). For the same reason, the Court declines to take up the third-party standing argument that the Center briefly asserted as a further alternative basis for standing. See Pls.’ Mot., Dkt. No. 30 at 35 n.58; Pls.’ Opp’n, Dkt. No. 27 at 30–32. When the Court refers to “Plaintiffs’ members” in this section, it refers to the identifiable members of those Plaintiffs that are traditional membership organizations.

24

Watch, 808 F.3d at 914 (quoting Pub. Citizen, Inc. v. Nat’l Highway Traffic Safety Admin., 489 F.3d 1279, 1295 (D.C. Cir. 2007)) (emphasis in original). In this context, the word “substantial” poses “questions of degree” that are “far from fully resolved.” Va. State Corp. Comm’n v. FERC, 468 F.3d 845, 848 (D.C. Cir. 2006). The D.C. Circuit, however, has explained that “the constitutional requirement of imminence . . . necessarily compels a very strict understanding of what increases in risk and overall risk levels can count as ‘substantial.’” Food & Water Watch, 808 F.3d at 915 (quoting Public Citizen I, 489 F.3d at 1296).

“[T]he proper way to analyze an increased-risk-of-harm claim is to consider the ultimate alleged harm . . . as the concrete and particularized injury and then to determine whether the increased risk of such harm makes injury . . . sufficiently ‘imminent’ for standing purposes.” Public Citizen I, 489 F.3d at 1298. Accordingly, the Court shall first consider whether the Plaintiffs’ ultimate alleged harm—the unlawful disclosure or use of confidential tax return information under the Data Policy—is a concrete injury under Article III. See Pls.’ Opp’n, Dkt. No. 27 at 21.

In determining whether an injury is sufficiently “concrete” for Article III standing, the Supreme Court has instructed the federal courts to “ask[] whether plaintiffs have identified a close historical or common-law analogue for their asserted injury.” TransUnion, 594 U.S. at 424 (citing Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016)). The “most obvious” examples of concrete harms “are traditional tangible harms, such as physical harms and monetary harms,” but “[v]arious intangible harms can also be concrete.” TransUnion, 594 U.S. at 425. “Chief among” the concrete intangible harms “are injuries with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts,” including, for example, “reputational harms, disclosure of private information, and intrusion upon seclusion.” Id.

25

Here, Plaintiffs’ members’ ultimate alleged harm is the intangible “harm of improper access and sharing of protected information” stemming from the “unlawful inspection or disclosure of confidential tax return information under the [IRS’s] Data Policy.” Pls.’ Opp’n, Dkt. No. 27 at 21; Pls.’ Mem., Dkt. No. 30-1 at 39. Plaintiffs argue that this harm satisfies the requirements of Article III standing because it has a close historical or common-law analogue in the torts of intrusion upon seclusion and breach of confidence. Id. The Court will start with the tort of intrusion upon seclusion before moving on to breach of confidence.

Traditionally, the tort of intrusion upon seclusion has been “recognized as providing a basis for lawsuits in American courts.” TransUnion, 594 U.S. at 425 (citing Gadelhak v. AT&T Servs., Inc., 950 F.3d 458, 462 (7th Cir. 2020) (Barrett, J.); see also Gadelhak, 950 F.3d at 462 (“The common law has long recognized actions at law against defendants who invaded the private solitude of another by committing the tort of ‘intrusion upon seclusion.’”). At common law, “the essential features of intrusion upon seclusion are that the defendant intentionally intruded ‘upon the solitude or seclusion of another or his private affairs or concerns’ and that such intrusion ‘would be highly offensive to a reasonable person.’” All. for Retired Americans v. Bessent, 770 F. Supp. 3d 79, 102 (D.D.C. 2025) (CKK) (quoting Restatement (Second) of Torts § 652B). Plaintiffs have adequately pled both features.

First, Plaintiffs have adequately pled an intrusion into their members’ “private affairs or concerns.” Restatement (Second) of Torts § 652B. In determining whether an alleged intrusion involves a plaintiff’s “private affairs or concerns,” this Court has explained that “one frequent consideration is whether the plaintiff had a ‘reasonable expectation of privacy’ in the information or thing intruded upon.” All. for Retired Americans, 770 F. Supp. 3d at 102 (collecting cases). Here, Plaintiffs’ members had a reasonable expectation that the privacy of their sensitive

26

information would be protected by “the explicit statutory protections provided by the . . . Internal Revenue Code.” 9 Id. As this Circuit has explained, Internal Revenue Code Section 6103 provides an “assurance of privacy” that is “fundamental to a tax system that relies upon self-reporting.” Nat’l Treasury Emps. Union v. Fed. Lab. Rels. Auth., 791 F.2d 183, 184 (D.C. Cir. 1986). This assurance of privacy reflects the congressional policy that taxpayer information should be “entitled to essentially the same degree of privacy as those private papers maintained in [the] home.” S. Rep. No. 94-938, 94th Cong., 2d Sess., at 328 (1976). Plaintiffs have shown that their members have developed a reasonable expectation of privacy in their taxpayer information based on these statutory protections and public statements made by the IRS pursuant to these statutory protections. See, e.g., Am. Compl., Dkt. No. 20 ¶ 199 (“MSA’s members have understood the information they submit to IRS to be private, barring a discrete list of specific exceptions. Their trust in IRS is engendered by their understanding of the privacy laws the agency is subject to and the agency’s own public commitments to data privacy.”).

In addition to Plaintiffs’ members’ reasonable expectation of privacy, the type of invasion at issue here closely resembles another type of invasion that constitutes an intrusion upon seclusion under D.C. common law. In Wolf v. Regardie, 553 A.2d 1213 (D.C. 1989), the D.C. Court of Appeals explained that “examining a plaintiff’s private bank account” is one of the “types of invasion intrinsic in the tort of intrusion upon seclusion.” 553 A.2d at 1217–18. The alleged invasion at issue here includes “the exact type of private information that might be found through inspection of an individual’s bank account.” All. for Retired Americans, 770 F. Supp. 3d at 103.

9 See also IRS Pub. 4639, Disclosure & Privacy Law Reference Guide, at 1-9 (Oct. 2012 ed.), https://perma.cc/JH2L- QQZP (“Congress recognized that the IRS had more information about citizens than any other federal agency and that other agencies routinely sought access to that information. Congress also understood that citizens reasonably expected the IRS would protect the privacy of the tax information they were required to supply. If the IRS abused that reasonable expectation of privacy, the resulting loss of public confidence could seriously impair the tax system.”).

27

Plaintiffs’ alleged intrusion also includes information that is arguably more sensitive than standard bank account information, including “Social Security numbers; information about individuals’ income and net worth; bank account information; tax liability; [] sensitive information regarding deductions, such as charitable donations, dependents, and medical expenses; [and] whether an individual’s tax return has been or is being investigated.” Am. Compl., Dkt. No. 20 ¶ 13. While Plaintiffs’ members have “opened [their] affairs to some scrutiny” by providing this information to the IRS, there are still some matters that Plaintiffs’ members have “not exhibited to the public gaze,” and there “may still be invasion of privacy when there is intrusion upon these matters.” All. for Retired Americans, 770 F. Supp. 3d at 103. (citing Restatement (Second) of Torts § 652B cmt. c). As this Court explained in Alliance for Retired Americans,

An illustration from the Restatement clarifies the point: A is seeking evidence for a suit against B; B has disclosed his financial information to a bank; A goes to the bank with a forged court order and demands access to B’s bank records; when the bank acquiesces to that demand, “A has invaded B’s privacy.” The fact that B had disclosed his information to the bank does not defeat A’s liability because B still has a privacy interest in those records vis-à-vis A. That disclosure is closely analogous to the scenario Plaintiffs have alleged here: Plaintiffs’ members disclosed their information to Treasury; individuals falsely purporting to have lawful access to that information demanded its disclosure; when Treasury acquiesced to that demand, the individuals invaded Plaintiffs’ members’ privacy.

Id. (citing Restatement (Second) of Torts § 652B cmt. c).

Plaintiffs have also shown that the type of intrusion detailed above “would be highly offensive to a reasonable person.” Restatement (Second) of Torts § 652B. D.C. common law makes clear that “[i]n this age of identity theft and other wrongful conduct through the unauthorized use of electronically-stored data, . . . conduct giving rise to unauthorized viewing of personal information such as a plaintiff’s Social Security number and other identifying information can constitute an intrusion that is highly offensive to any reasonable person.” Randolph v. ING Life Ins. & Annuity Co., 973 A.2d 702, 710 (D.C. 2009). Plaintiffs “allege exactly this kind of

28

unauthorized viewing.” All. for Retired Americans, 770 F. Supp. 3d at 103. Furthermore, this allegedly unauthorized viewing involves personal information that taxpayers provided to the IRS pursuant to a promise that the IRS would prioritize keeping the information confidential. A reasonable taxpayer would likely find it highly offensive to discover that the IRS now intends to share that information permissively because it has replaced its promise of confidentiality with a policy of disclosure.

Defendants claim that Plaintiffs’ alleged injuries to their members are not analogous to the injuries protected by the tort of intrusion upon seclusion. Specifically, Defendants argue that the highly offensive intrusions protected by the tort are “in no way analogous” to an instance of a federal agency “sharing lawfully obtained information, contained in data systems that the agency lawfully maintains, with another agency pursuant to a memorandum of understanding.” Defs.’ Opp’n, Dkt. No. 31 at 14. But “[i]n reviewing the standing question, the court must be careful not to decide the questions on the merits for or against the plaintiff, and must therefore assume that on the merits the plaintiffs would be successful in their claims.” Muir v. Navy Fed. Credit Union, 529 F.3d 1100, 1105 (D.C. Cir. 2008) (citing City of Waukesha v. EPA, 320 F.3d 228, 235 (D.C. Cir. 2003)). Therefore, the correct analogy here is whether it would be highly offensive for a federal agency to share lawfully obtained information through unlawfully maintained data systems pursuant to an illegal information-sharing agreement. As the Court explained above, a reasonable person would find it highly offensive to find that their confidential information has been illegally disclosed because the IRS unlawfully replaced its promise of confidentiality with a policy of disclosure. Moreover, as the D.C. Circuit recently recognized, the extent to which a disclosure would offend a reasonable person “goes to the degree of harm, not the injury’s recognition at common law, and so does not affect the concreteness of the [relevant] injury under Article III.”

29

Pileggi v. Washington Newspaper Publ’g Co., LLC, 146 F.4th 1219, 1229 (D.C. Cir. 2025). Because “drawing lines between degrees of harm implicates policy judgments that fall more naturally in Congress’s wheelhouse,” this Court will not hold that Plaintiffs lack standing based on a subjective judgment about the extent to which a reasonable person would be offended by the alleged conduct. Id.

Accordingly, the ultimate harm facing Plaintiffs’ members is a “concrete” injury under Article III because it has a close relationship to the harm protected by the tort of intrusion upon seclusion.

Plaintiffs also claim that their members’ alleged injuries have a close relationship to another common-law tort: the tort of breach of confidence. Plaintiffs argue that the Internal Revenue Code vests their members with “a concrete interest in submitting information to the IRS in connection with their tax returns without incurring a risk that this information will be shared,” except in accordance with the Code’s “narrow legally permissible exceptions” to the general rule of confidentiality. Pls.’ Opp’n, Dkt. No. 27 at 24. “Where the IRS discloses a taxpayer’s information in violation of these statutory provisions,” Plaintiffs argue, “it causes a concrete injury akin to the common-law tort of breach of confidence.” Id.

Defendants raise two arguments with respect to Plaintiffs’ analogy to the tort of breach of confidence. First, Defendants argue that the tort cannot “serve as a valid analogue under TransUnion’s requirement of a historically grounded cause of action” because it has a “nascent and underdeveloped pedigree.” Defs.’ Reply, Dkt. No. 29 at 7. Second, Defendants argue that, even if the tort has sufficient historical grounding, Plaintiffs’ members’ alleged injury is not sufficiently analogous to the tort. Id. at 8. The Court rejects both of these arguments.

30

In Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059 (D.C. Cir. 2019), the D.C. Circuit treated the tort of breach of confidence as a tort that has “traditionally been regarded as providing a basis for a lawsuit in English or American courts.” 928 F.3d at 1064 (quoting Spokeo, 578 U.S. at 341) (holding that “an increased risk of identity theft” was a concrete injury because it involved “risk of the very harm the breach of confidence tort makes actionable”). Defendants urge the Court to ignore Jeffries because it “predates TransUnion, does not address whether the tort [of breach of confidence] has a sufficient historical origin, and relies, in part, on an Eleventh Circuit panel decision that was later overturned by the Eleventh Circuit sitting en banc.” Defs.’ Opp’n, Dkt. No. 31 at 16 (citing Muransky v. Godiva Chocolatier, Inc., 922 F.3d 1175 (11th Cir.), reh’g en banc granted, opinion vacated, 939 F.3d 1278 (11th Cir. 2019), and on reh’g en banc, 979 F.3d 917 (11th Cir. 2020)). But the Court shall decline to do so. To start, the Court does not ascribe much significance to the fact that Jeffries predates TransUnion, as both cases applied the concrete-harm analysis set forth in Spokeo, Inc. v. Robins, 578 U.S. 330 (2016). Compare Jeffries, 928 F.2d at 1064 (quoting Spokeo, 578 U.S. at 340–41) (“‘In determining whether an intangible harm’ like risk is concrete, ‘both history and the judgment of Congress play important roles.’ The historical analysis focuses on ‘whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.’”) with TransUnion LLC, 594 U.S. at 424–25 (“. . . with respect to the concrete-harm requirement in particular, this Court’s opinion in Spokeo v. Robins indicated that courts should assess whether the alleged injury to the plaintiff has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in American courts.”). The Court does not find Defendants’ remaining arguments sufficient to undermine Jeffries, either. While the D.C. Circuit did not spill much ink on the common-law origins of breach of confidence, Defendants are wrong to say that

31

Jeffries did “not address” the issue: Jeffries explained the need to identify a traditionally recognized harm and then identified the tort of breach of confidence as such a harm. Jeffries, 928 F.2d at 1064–65. And although Jeffries does cite to the Eleventh Circuit’s decision in Muransky that was eventually overturned en banc, those citations relate to the content of the tort of breach of confidence, not the historical validity of the tort. Id. (citing Muransky, 922 F.3d at 1190–91).

Accordingly, the tort of breach of confidence has a sufficient pedigree to serve as an analogous common-law harm for Article III standing. The issue, therefore, is whether Plaintiffs’ alleged harms have a sufficiently close relationship to a breach of confidence. A common law breach of confidence “lies where a person offers private information to a third party in confidence and the third party reveals that information’ to another,” thereby breaching the person’s expectation of privacy. Jeffries, 928 F.3d at 1064 (quoting Muransky, 922 F.3d at 1190–91). The tort is “rooted in the concept that the law should recognize some relationships as confidential” in order to “encourage uninhibited discussions between the parties involved.” Id. (quoting Young v. U.S. Dep’t of Justice, 882 F.2d 633, 640 (2d Cir. 1989)). “The harm in a breach-of-confidence case ‘occurs when the plaintiff’s trust in the breaching party is violated, whether or not the breach has other consequences.’” Id. (quoting Muransky, 922 F.3d at 1190).

The Court concludes that Plaintiffs have shown a substantial likelihood that their members have suffered a harm analogous to the harm protected by the common law tort of breach of confidence. In Jeffries, the D.C. Circuit held that a statutory interest in “avoiding an increased risk of identity theft” was sufficiently connected to the concrete harms protected by the tort of breach of confidence. 928 F.3d at 1064. The statutory interest at issue in Jeffries was rooted in the Fair and Accurate Credit Transactions Act of 2003 (“FACTA”), which prohibited merchants that processed credit card transactions from printing more than the last five digits of the credit card

32

number on the receipt. Id. at 1062. Noting that the harm in a breach-of-confidence case “occurs when the plaintiff’s trust in the breaching party is violated,” the D.C. Circuit explained that “FACTA’s truncation requirement establishes a similar relationship of trust between consumer and merchant, requiring the merchant to safeguard the consumer’s credit or debit card information and thus preventing an increased risk of identity theft.” Id. at 1064–65. Furthermore, FACTA’s truncation requirement protected against “the risk of the very harm the breach of confidence tort makes actionable—an unauthorized disclosure of privileged information to a third party.” Jeffries, 928 F.3d at 1065 (citing Spokeo, Inc., 136 S. Ct. at 1549). The same can be said of the alleged injuries to Plaintiffs’ members. Section 6103 of the Internal Revenue Code establishes a relationship of trust between taxpayers and the IRS because it creates the general rule that the IRS must keep taxpayer information confidential. See 26 U.S.C. § 6103(a). The detailed statutory regime surrounding maintenance of this information and the exceptions to the general rule of confidentiality further establish the IRS’s role as a protector of the confidential information it receives from taxpayers. See id. § 6103(c)–(p). Plaintiffs allege that the IRS has breached this trust by replacing the promise of confidentiality with a policy of permissive disclosure, which has led to the unlawful transfer of taxpayer information in violation of Internal Revenue Code Section 6103(i)(2). Like the statute at issue in Jeffries, Section 6103(i)(2) “protects against the risk of the very harm the breach of confidence tort makes actionable—an unauthorized disclosure of privileged information to a third party.” Jeffries, 928 F.3d at 1065 (citing Spokeo, Inc., 136 S. Ct. at 1549).

Accordingly, because Plaintiffs’ alleged injury mirrors the alleged injury at issue in Jeffries, they have also established a common-law analogue through the tort of breach of confidence.

33

In sum, Plaintiffs have shown a substantial likelihood that their members’ ultimate alleged harm is a “concrete” injury under Article III. Public Citizen I, 489 F.3d at 1298. Therefore, Plaintiffs must now show that the “increased risk of such harm” makes injury “sufficiently ‘imminent’ for standing purposes.” Id. Because Plaintiffs’ intrusion upon seclusion claim and breach of confidence claim both stem from the same series of events, the Court will assess the imminence of Plaintiffs’ alleged harm under both causes of action together.

While the “imminence” of an injury “is concededly a somewhat elastic concept, it cannot be stretched beyond its purpose, which is to ensure that the alleged injury is not too speculative for Article III purposes—that the injury is certainly impending.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 564 n.2 (1992) (internal quotation marks omitted). When injury is based on an increased risk of harm, the “threatened injury must be certainly impending to constitute injury in fact;” “allegations of possible future injury” are not sufficient. Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013) (citing Whitmore v. Arkansas, 495 U.S. 149, 158 (1990)) (citation modified); Food & Water Watch, 808 F.3d at 914 (internal quotation marks omitted) (“An actual or imminent injury is certainly impending and immediate—not remote, speculative, conjectural, or hypothetical.”). “A plaintiff must show a ‘substantial probability of injury’ to establish imminent injury.” Sierra Club v. Jewell, 764 F.3d 1, 7 (D.C. Cir. 2014) (quoting Chamber of Commerce of the U.S. v. EPA, 642 F.3d 192, 200 (D.C. Cir. 2011)).

Defendants claim that the increased risk of harm alleged by Plaintiffs “is too attenuated to support this Court’s jurisdiction” because “it is built on a speculative chain of events that is unlikely to occur.” Defs.’ Reply, Dkt. No. 29 at 2. Defendants argue that the “likelihood that Plaintiffs’ members’ specific address information was included in the IRS’s provision of information to ICE is remote,” and that any claim that Plaintiffs’ members’ addresses may be

34

shared in the future or impermissibly used “is entirely speculative.” Defs.’ Opp’n, Dkt. No. 31 at 12. The Court disagrees.

To start, Plaintiffs have shown a substantial likelihood that their members belong to identifiable groups that have been the focus of ICE’s information requests from the IRS. The Center’s LITC represents immigrant taxpayers. See Pls.’ Mem., Dkt. No. 30-1 at 15. Between February 2025 and June 2025, ICE submitted three requests to the IRS for information on immigrant taxpayers. See Admin. R., Dkt. No. 48 at TD_01–110. One of these requests sought taxpayer information on ICE’s “full alien population” of over 7 million individuals. Id. at TD_86. Furthermore, the Center has encouraged immigrant taxpayers it represents to file for an Individual Taxpayer Identification Number (“ITIN”). Olson Decl., Dkt. No. 30-8 ¶¶ 33–36. Evidence introduced by Plaintiffs and statements made by counsel for Defendants at the September 5 hearing suggest that many of the addresses the IRS provided to ICE on August 7 were provided, in part, because ICE provided the IRS with matching taxpayer identification numbers, which likely include ITINs. See Pls.’ Mem. Ex. 2, Dkt. No. 30-4 (stating that the addresses the IRS provided to ICE on August 7 “were mainly [for] the individuals for whom DHS provided an [ITIN]”); H’rg Tr., Dkt. No. 38 at 29:2–5 (“I can tell you that the number of people with whom the IRS matched using a taxpayer identification number was quite high, most of them around 39,000.”).

In addition, Plaintiffs have shown a substantial likelihood that their members information may be shared in the future. ICE’s first June 2025 request for information on its “full alien population” of over 7 million individuals suggests that ICE’s second June 2025 request for address information relating to 1.2 million immigrant taxpayers—which ‘only’ resulted in address information for around 47,000 individuals—is not the final request ICE intends to make. Admin. R., Dkt. No. 48 at TD_86. The inference is bolstered by evidence submitted by Plaintiffs regarding

35

the Administration’s stated focus on obtaining taxpayer information for immigration enforcement and the corresponding personnel changes at the IRS detailed by the Court elsewhere. See Pls.’ Mem., Dkt. No. 30-1 at 43; supra Section I. Moreover, the Administration’s expressed desire to investigate Earned Income Tax Credits (“EITCs”) and Child Tax Credits (“CTCs”) implicates Plaintiffs’ members who are low-income taxpayers who qualify for EITCs and CTCs. See Am. Compl., Dkt. No. 20 ¶¶ 41–42, 150, 203, 209, 215. Furthermore, although counsel for Defendants stated at the September 5 hearing that the IRS was done processing ICE’s June 27 request for address information, the administrative record suggests that the IRS may be ‘required’ to disclose more information in response to this request as time goes on. See H’rg Tr., Dkt. No. 38 at 11:15. The administrative record shows that the IRS refused to fulfill ICE’s June 27 request with respect to individuals who did not have an order of removal date beyond 90 days at the time of the IRS’s review. Admin. R., Dkt. No. 48 at TD_145. However, as one internal IRS email shows, some of the requests that the IRS deemed invalid because 90-days had not elapsed would become valid once the 90-days had passed. Id. (email between two IRS officials that reads, “Per our discussion yesterday, the final number of matches will change based on the date/time of the run, as it is associated with the Final Order Date.”). If this is true, and if the IRS is operating as if ICE’s June 27 requires the IRS to disclose the requested information, then additional taxpayers are at risk of having their confidential information disclosed to ICE pursuant to ICE’s June 27 request for address information.

Finally, for reasons discussed elsewhere in this Opinion, see infra Section III.C.2., the Court determines that Plaintiffs have also shown a substantial likelihood that their members’ confidential address information will be impermissibly used for civil immigration enforcement.

36

Accordingly, the Plaintiffs have shown that the risk of harm to their members is sufficiently “imminent” for Article III standing. Public Citizen I, 489 F.3d at 1298. Plaintiffs have shown a high likelihood that the IRS disclosed their members’ confidential address information to ICE on August 7. Furthermore, Plaintiffs have shown that there is an imminent risk of the IRS disclosing their members’ confidential address information again in the future, either pursuant to new requests from ICE or pursuant to ICE’s June 27 request. Finally, Plaintiffs have shown that there is an imminent risk that their members’ confidential address information that has already been shared with ICE will be impermissibly used for civil immigration enforcement.

* * * *

Plaintiffs have established associational standing because they have shown that their members are substantially likely to have standing to sue in their own right. Plaintiffs allege a concrete harm to their members that has a close relationship to the harms protected by the common law torts of intrusion upon seclusion and breach of confidence. Furthermore, Plaintiffs have shown that the IRS has either disclosed their members’ confidential address information already or will likely do so in the future. Regarding Plaintiffs’ members who have already had their confidential address information disclosed by the IRS to ICE, Plaintiffs have shown that there is an imminent risk that ICE will impermissibly use this information for civil immigration enforcement.

B. Plaintiffs have shown a substantial likelihood of success on the merits.

To succeed on their motion for preliminary relief, Plaintiffs must establish that they are likely to succeed on the merits. See Winter, 555 U.S. at 20. The merits of Plaintiffs’ motion are governed under the framework of the Administrative Procedure Act (“APA”). See Pls.’ Mem., Dkt. No. 30-1 at 5 n. 3 (explaining that Plaintiffs “move for relief solely on the basis of their APA contrary to law claim concerning the Internal Revenue Code as well as APA arbitrary and capricious claims”). The APA provides that “final agency action for which there is no other

37

adequate remedy in a court [is] subject to judicial review.” 5 U.S.C. § 704. “On such conditions as may be required and to the extent necessary to prevent irreparable injury,” a reviewing court “may issue all necessary and appropriate process to postpone the effective date of an agency action or to preserve status or rights pending conclusion of the review proceedings.” Id. § 705. Furthermore, a reviewing court “shall . . . hold unlawful and set aside agency action” found to be “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.” Id. § 706.

1. Plaintiffs challenge final agency action for which there is no other adequate remedy in a court.

As noted above, the APA subjects to judicial review any “final agency action for which there is no other adequate remedy in a court.” 5 U.S.C. § 704. Therefore, to establish a likelihood of success on the merits, Plaintiffs must first show that their claims arise out of “final agency action” taken by the IRS. Id. If they can make this showing, then Plaintiffs must show that there is “no other adequate remedy in a court” for their claims. Id.

a. Plaintiffs have established a strong likelihood that the IRS’s Address-Sharing Policy is final agency action.

The APA limits judicial review of agency action to actions that are “final.” 5 U.S.C. § 704.

Plaintiffs argue that the IRS has implemented a policy of sharing confidential taxpayer address information with ICE—the Data Policy—that “amounts to a wholesale rewrite of the IRS’s data privacy policy” and thus constitutes final agency action. Pls.’ Mem., Dkt. No. 30-1 at 20. Plaintiffs claim that the IRS’s Data Policy has “abandoned the agency’s prior promise that taxpayer information be kept confidential” in an effort to (1) expand access to and the use of taxpayer information within the IRS; (2) consolidate data systems to facilitate broad, not segregated access within the agency; and (3) permit large-scale data-sharing with ICE unrelated to tax administration. Id. at 10, 20. Defendants dispute the existence of the Data Policy, arguing that “there is no such

38

‘Data Policy.’” Defs.’ Opp’n to PI, Dkt. No. 31 at 21. But Plaintiffs claim the Data Policy is apparent from recent IRS actions. Pls.’ Mem., Dkt. No. 30-1 at 20.

Courts apply a two-prong test to determine whether agency action is “final.” Agency action is “final” if it (1) marks the “consummation” of the agency’s decision-making process (i.e., it is not “of a merely tentative or interlocutory nature”) and (2) constitutes action “by which rights or obligations have been determined, or from which legal consequences will flow.” MediNatura, Inc. v. Food & Drug Admin., 998 F.3d 931, 938 (D.C. Cir. 2021) (quoting Bennett v. Spear, 520 U.S. 154, 178 (1997)). Agency action must satisfy both prongs in order for the action to be final. Id. The D.C. Circuit has explained that this is a “pragmatic and flexible” inquiry. Id. (quoting Rhea Lana, Inc. v. Dep’t of Lab., 824 F.3d 1023, 1027 (D.C. Cir. 2016)).

The Court first considers whether the Plaintiffs have shown that the IRS’s alleged Data Policy with respect to sharing taxpayer address information with ICE marks the “consummation” of the IRS’s decision-making process. This requires the Court to determine whether the Data Policy “is properly attributable to the [IRS] itself and represents the culmination of [the IRS’s] consideration of an issue,” or, instead, is simply the conduct “of a subordinate official, or tentative.” Nat. Res. Def. Council v. Wheeler, 955 F.3d 68, 78 (D.C. Cir. 2020) (quoting Soundboard Ass’n v. Fed. Trade Comm’n, 888 F.3d 1261, 1267 (D.C. Cir. 2018)).

On the present record, the Court determines that at least one aspect of the IRS’s alleged Data Policy marks the consummation of the IRS’s decision-making process: the agency has made a final decision to adopt and implement a policy of disclosing the confidential address information of tens of thousands of taxpayers to ICE under Section 6103(i)(2) of the Internal Revenue Code, in reliance on representations from ICE that the addresses are relevant to and will be used for immigration-related criminal investigations and proceedings, even when ICE identifies only a

39

single ICE employee (or a small number of ICE employees) as the employee(s) “personally and directly engaged” in each of the tens of thousands of relevant criminal investigations or proceedings. See Defs.’ Opp’n, Dkt. No. 31 at 30 (arguing that “it is ICE’s responsibility under the MOU to ensure that the ‘personally and directly engaged’ requirement is satisfied”); Hr’g Tr., Dkt. No. 38 at 85:23–25 (counsel for Defendants explaining that “IRS relied on [ICE’s] attestation that this particular person would be personally and directly involved”). The Court shall refer to this specific aspect of the IRS’s alleged Data Policy as the “Address-Sharing Policy.” Although the IRS has not publicly announced this decision as a new policy, an agency does not have to formally announce a policy in order for that policy to be final agency action. Her Majesty the Queen in Right of Ontario v. U.S. E.P.A., 912 F.2d 1525, 1531 (D.C. Cir. 1990). And “[a]lthough the details of the [IRS’s] disclosure policy are still unclear, the record leaves no doubt the [IRS] has a policy of disclosing confidential information” to ICE in a manner that it has not previously been disclosed before. Venetian Casino Resort, L.L.C. v. E.E.O.C., 530 F.3d 925, 929–30 (D.C. Cir. 2008).

Plaintiffs have shown that the IRS has developed a “single, unified database of taxpayer information within the IRS” that will “permit automated access to all IRS taxpayer information by IRS employees in one interface.” Pls.’ Mem., Dkt. No. 30-1 at 10. This is just one example of the IRS’s implementation of the “technical infrastructure necessary for mass data sharing” of the kind that the IRS undertook when it shared taxpayer address information with ICE on August 7. Id. at 21–22. In addition, Plaintiffs bring factually uncontested claims that the IRS has reached out to other federal agencies to initiate and encourage the sharing of taxpayer information. The IRS manifested its newfound capability and willingness to share confidential taxpayer information by entering into a Memorandum of Understanding (“MOU”) with ICE to share confidential taxpayer

40

address information. See Pls.’ Mem. Ex. 4, Dkt. No. 30-6. This MOU was executed by the Treasury Secretary on behalf of the IRS. Id. Furthermore, the administrative record shows that, pursuant to this MOU, high-level officials in the IRS shepherded ICE through the requirements for information sharing under the Internal Revenue Code. Admin. R., Dkt. No. 48 at TD_01–110.

Plaintiffs’ factually uncontested allegations show that the IRS spent an unknown amount of money developing the capability to conduct mass transfers of taxpayer information; entered into an agreement with ICE to conduct mass transfers of confidential taxpayer address information; and then completed a mass transfer of confidential taxpayer address information to ICE pursuant to this agreement, all while removing high-level individuals who disagreed about the disclosure process. This marks the consummation of the IRS’s decision-making process.

The Court now considers whether the IRS’s new Address-Sharing Policy constitutes agency action “by which rights or obligations have been determined, or from which legal consequences will flow.” MediNatura, Inc., 998 F.3d at 938. The D.C. Circuit has explained that, under this prong, “the finality analysis can look to whether the agency action has a practical effect on regulated parties, even if it has no formal legal force.” Valero Energy Corp. v. Env’t Prot. Agency, 927 F.3d 532, 537 (D.C. Cir. 2019) (emphasis in original).

Plaintiffs have established that legal consequences will flow from the IRS’s new policy of sharing tens of thousands of taxpayers’ address information with ICE for use in immigration- related criminal investigations based on a representation that a single person is “personally and directly engaged” in each of those investigations.

This case is similar to Venetian Casino Resort, L.L.C. v. E.E.O.C., 530 F.3d 925 (D.C. Cir.

2008), in which the D.C. Circuit held that “[a]dopting a policy of permitting employees to disclose confidential information without notice is surely a ‘consummation of the agency’s decisionmaking

41

process,’ and ‘one by which [the submitter’s] rights [and the agency’s] obligations have been determined.’” 530 F.3d at 931. Defendants push back on the analogy to Venetian Casino, arguing that it is not analogous to this case because it “did not deal with disclosure within the federal executive branch to a federal law enforcement agency with statutory rights to the information in question.” Defs.’ Opp’n, Dkt. No. 31 at 23. But this distinction, while relevant, does not cut the many cords that connect this case to the holding in Venetian Casino. To start, Plaintiffs’ members are similarly situated to the plaintiff in Venetian Casino: Plaintiffs’ members voluntarily provided information to a federal agency—the IRS—with the understanding that the agency would keep the information confidential, just like the plaintiff in Venetian Casino. See 530 F.3d at 927 (“To assist the [defendant-agency] with its investigation of the ADEA claims, [plaintiff] supplied the [defendant-agency] with information that [plaintiff] deemed, and identified as, confidential.”). In addition, Plaintiffs’ clients and members and the plaintiff in Venetian Casino both faced potential legal consequences from the agency’s sharing of their confidential information. The disclosure of Plaintiffs’ members’ confidential information is accompanied by—in fact it must be accompanied by—the threat that it will be used in a criminal investigation or prosecution. See 26 U.S.C. § 6103(i)(2). Similarly, the disclosure of the Venetian Casino plaintiff’s confidential information raised the possibility of civil liability. 530 F.3d at 927–29. If the threat that disclosure of information would lead to civil litigation from a private plaintiff is a sufficient “legal consequence” to make an agency action “final,” then a guarantee that disclosed information will be used in a criminal investigation or prosecution must be “final,” too. 10

10 Plaintiffs also allege that a different kind of legal consequence may flow from the sharing of this information: The information could be used—contrary to the Internal Revenue Code—to facilitate “mass deportation” or other civil immigration enforcement actions against Plaintiffs’ members and clients. See Pls.’ Mem. at 41. This possibility reinforces the conclusion that the IRS’s decision to share taxpayer address information with ICE is substantially likely to be final agency action.

42

* * * *

In sum, the Court concludes that Plaintiffs have plausibly alleged that the IRS has adopted a new Data Policy to share confidential taxpayer address information outside the agency, and at least one aspect of this Data Policy—the Address-Sharing Policy—is substantially likely to constitute final agency action. The IRS’s apparent investment in the Data Policy, its MOU with ICE, and the involvement of high-level IRS and Treasury officials all support the conclusion that the IRS’s decision to share taxpayer address information with ICE under the circumstances at issue here is the consummation of the IRS’s decision-making process. Furthermore, the fact that the relevant aspect of the Address-Sharing Policy involves the sharing of information that, by statute, can only be lawfully used in criminal investigations or proceedings shows that legal rights and consequences will flow from the IRS’s decision to share this information. 11 For all these reasons, the Plaintiffs have shown a substantial likelihood that the IRS’s new Address-Sharing Policy is final agency action.

b. The Internal Revenue Code does not provide an adequate alternative remedy.

The APA further restricts judicial review to final agency action “for which there is no other adequate remedy in a court.” 5 U.S.C. § 704 (emphasis added). The “primary thrust” of this restriction “was to codify the exhaustion requirement.” Bowen v. Massachusetts, 487 U.S. 879, 903 (1988). But the restriction “also makes it clear that Congress did not intend the general grant of review in the APA to duplicate existing procedures for review of agency action.” Id. However, the fact that Congress “intended to avoid such duplication should not be construed to defeat the [APA’s] central purpose of providing a broad spectrum of judicial review of agency action.” Id.; see also id. at 904 (quoting Shaughnessy v. Pedreiro, 349 U.S. 48, 51 (1955)) (“A restrictive

11 See also supra note 9.

43

interpretation of § 704 would unquestionably, in the words of Justice Black, ‘run counter to § 10 and § 12 of the Administrative Procedure Act. Their purpose was to remove obstacles to judicial review of agency action under subsequently enacted statutes . . . .’”).

Defendants argue that Plaintiffs are barred from seeking injunctive relief through the APA because the Internal Revenue Code’s “highly reticulated scheme” of civil damages and criminal penalties provides them with an adequate alternative remedy. Defs.’ Opp’n, Dkt. No. 31 at 23–5. Defendants identify the following provisions of the Internal Revenue Code in support of their argument: (i) Section 7431, which authorizes civil damages against the United States for a willful or negligent violation of Section 6103 but “does not authorize injunctive relief,” Defs.’ Opp’n to PI, Dkt. No. 31 at 23–4 (citing 26 U.S.C. § 7431); (ii) Section 7713A, which authorizes damages, a fine, and imprisonment for a United States officer or employee that willfully inspects return information in violation of Section 6103, id. (citing 26 U.S.C. § 7213A); and (iii) Section 7213, which authorizes damages, a fine, and imprisonment for a United States officer or employee that willfully discloses return information in violation of Section 6103, id. (citing 26 U.S.C. § 7213). Defendants conclude that “the civil and criminal remedies discussed above represent the exclusive recourse for taxpayers aggrieved by the unlawful inspection or disclosure of their return information.” Defs.’ Opp’n to PI, Dkt. No. 31 at 24.

The Court finds that the Internal Revenue Code does not bar review of Plaintiffs’ claims under the APA. A fundamental issue with the Defendants argument to the contrary is that, as the Defendants point out, the Internal Revenue Code does not provide the relief Plaintiffs are seeking in this case, and Defendants do not explain how ex post penalties are an adequate alternative to ex ante prohibitions. The Court is “not willing to assume, categorically, that a naked money judgment against the United States will always be an adequate substitute for prospective relief fashioned in

44

the light of the rather complex ongoing relationship between the parties.” Bowen, 487 U.S. at 905. It is clear that the injunctive relief that Plaintiffs seek does not duplicate the relief provided by the Internal Revenue Code. Furthermore, the Internal Revenue Code’s provision of civil damages and criminal penalties does not warrant a finding that the Code prohibits injunctive relief under other statutes. “The mere fact that some acts are made reviewable should not suffice to support an implication of exclusion as to others.” Abbott Lab’ys v. Gardner, 387 U.S. 136, 141 (1967), abrogated on other grounds by Califano v. Sanders, 430 U.S. 99 (1977). “The right to review is too important to be excluded on such slender and indeterminate evidence of legislative intent.” Id. Accordingly, the Court does not consider relief under the Internal Revenue Code to be an adequate alternative to relief under the APA under the circumstances presented here.

c. The Privacy Act also does not provide an adequate alternative remedy.

For similar reasons, the Court is not persuaded by Defendants’ argument that Plaintiffs’

APA challenge to the IRS’s broader Data Policy is foreclosed by the availability of alternative relief under the Privacy Act. 12 See Defs.’ Mot., Dkt. No. 26 at 18–21. Defendants are correct that injunctive relief under the APA “will rarely be appropriate” to remedy an alleged Privacy Act violation because the Privacy Act provides for damages remedies and certain kinds of injunctive relief that are often exclusive of remedies under the APA. See Am. Fed’n of Lab. & Cong. of Indus. Organizations v. Dep’t of Lab., 778 F. Supp. 3d 56, 79–81 (D.D.C. 2025) (JDB). However, here, Plaintiffs have plausibly alleged that Defendants’ actions present the “rare case” in which an APA injunction is necessary to prevent imminent harm that cannot be remedied through the limited forms of injunctive relief available under the Privacy Act. See id. As Plaintiffs correctly note, retrospective damages remedies and narrow opportunities for individualized injunctive relief are

12 Plaintiffs are not seeking preliminary relief on this aspect of their broader APA claim. See Pls.’ Mot., Dkt. No. 30.

45

“inadequate to address a policy of ongoing data sharing at mass scale” of the kind that Plaintiffs allege in their Amended Complaint. Pls.’ Mot., Dkt. No. 30, at 22. Accordingly, Plaintiffs have plausibly alleged that the Privacy Act does not afford an adequate alternative remedy for their injuries arising from Defendants’ alleged violations of the Privacy Act.

* * * *

In sum, the Court finds that Plaintiffs have shown that the IRS has taken final agency action by adopting and implementing the Address-Sharing Policy: a policy of sharing address information for tens of thousands of taxpayers with ICE in response to a representation from ICE that a single ICE employee is (or a small number of ICE employees are) “personally and directly engaged” in investigating each of those taxpayers for committing immigration-related criminal offenses. The Court also finds that Plaintiffs do not have another adequate remedy for the harms allegedly caused by the Address-Sharing Policy. Accordingly, the Court shall determine whether Plaintiffs have established a likelihood that the IRS’s information sharing with ICE was contrary to law and that the IRS acted arbitrarily and capriciously in adopting the Address-Sharing Policy.

The Court’s ruling on this threshold APA issue leads it to shut the door on Plaintiffs’ claim for ultra vires review. See Am. Compl., Dkt. No. 20 ¶¶ 216–23. Ultra vires review of an agency’s compliance with a statutory requirement is unavailable if “a statutory review scheme provides aggrieved persons ‘with a meaningful and adequate opportunity for judicial review.’” Nuclear Regul. Comm’n v. Texas, 605 U.S. 665, 681 (2025) (quoting Board of Governors, FRS v. MCorp Financial, Inc., 502 U.S. 32, 43 (1991)). In part because of that limitation, ultra vires claims of the type at issue here—that is, equitable claims alleging that the Government has acted in violation of a federal statute—are “‘extremely limited’ in scope.” Nat’l Treasury Emps. Union v. Vought, 149 F.4th 762, 791 (D.C. Cir. 2025) (quoting Griffith v. FLRA, 842 F.2d 487, 493 (D.C. Cir.

46

1988)). Because the Court has determined that the APA provides Plaintiffs with a meaningful and adequate opportunity for judicial review of the data-sharing practices that Plaintiffs challenge, the Court shall GRANT Defendants’ [26] Motion to Dismiss with respect to Plaintiffs’ ultra vires claim and DISMISS WITHOUT PREJUDICE Count One of Plaintiffs’ [20] Amended Complaint for failure to state a claim. See Defs.’ Mot., Dkt. No. 26, at 16–18; see also Pls.’ Opp’n, Dkt. No. 27, at 36 (framing Plaintiffs’ ultra vires claim as a challenge to “a change in IRS data sharing practices”). However, because Plaintiffs have established that their challenge under the Internal Revenue Code addresses final agency action that is judicially reviewable under the APA, and because Plaintiffs’ APA claims based on the Privacy Act substantially mirror their claims based on the Internal Revenue Code, the Court shall not dismiss Plaintiffs’ APA claims based on the Internal Revenue Code and the Privacy Act on these grounds.

2. The Address-Sharing Policy is contrary to the Internal Revenue Code.

Under the APA, a reviewing court must “hold unlawful and set aside agency action . . .

found to be . . . not in accordance with law.” 5 U.S.C. § 706(2)(A). “Agency action is obviously ‘not in accordance with law’ if it violates some extant federal statute or regulation.” E. Band of Cherokee Indians v. United States Dep’t of the Interior, 534 F. Supp. 3d 86, 97 (D.D.C. 2021) (JEB) (quoting 5 U.S.C. § 706(2)(A)), appeal dismissed, No. 21-5114, 2022 WL 102544 (D.C. Cir. Jan. 5, 2022). “Courts must exercise their independent judgment in deciding whether an agency has acted within its statutory authority.” Loper Bright Enters. v. Raimondo, 603 U.S. 369, 412 (2024); id. at 395 (explaining that “the role of the reviewing court under the APA is . . . to independently interpret the statute and effectuate the will of Congress subject to constitutional limits”).

Plaintiffs argue that the IRS’s Memorandum of Understanding (“MOU”) with ICE and its August 7 disclosure of return information to ICE are unlawful under Section 6103(i)(2) of the

47

Internal Revenue Code. Dkt. No. 30-1 at 23. Section 6103 of the Internal Revenue Code establishes the “general rule” that taxpayer “returns and return information shall be confidential.” 26 U.S.C. § 6103(a) (capitalization altered). This general rule of confidentiality is rooted in the Tax Reform Act of 1976, which Congress “passed in the wake of Watergate and White House efforts to harass those on its ‘enemies list’ . . . to protect the privacy of tax return information and to regulate in minute detail the disclosure of this material.” Lake v. Rubin, 162 F.3d 113, 115 (D.C. Cir. 1998). But this general rule has its exceptions. See 26 U.S.C. § 6103(c)–(o); Cause of Action v. Internal Revenue Serv., 125 F. Supp. 3d 145, 153 (D.D.C. 2015) (“Subsection (a) sets forth the general proposition that returns and return information shall be confidential, and subsection (b) defines the key terms in the statute. The provisions that follow delineate the exceptions to the confidentiality rule. . .”) (internal citations omitted). The exception at issue here is found in Section 6103(i)(2), which requires the IRS to disclose return information to a requesting federal agency for use in a nontax criminal matter if certain conditions are met. 26 U.S.C. § 6103(i)(2).

The conditions that must be met before the IRS can disclose return information to a federal agency for use in a nontax criminal matter can be separated into two groups: “personnel limitations” and “request requirements.” The personnel limitations are found in Section 6103(i)(2)(A), which provides, in relevant part, that

upon receipt by the Secretary of a request which meets the requirements of subparagraph (B) from the head of any Federal agency or the Inspector General thereof, . . . the Secretary shall disclose return information (other than taxpayer return information) to officers and employees of such agency who are personally and directly engaged in- (i) preparation for any judicial or administrative proceeding [pertaining to the enforcement of a specifically designated Federal criminal statute (not involving tax administration) to which the United States or such agency is or may be a party], (ii) any investigation which may result in such a proceeding, or (iii) any [Federal grand jury proceeding pertaining to enforcement of such a criminal statute to which the United States or such agency is or may be a party], solely for the use of such officers and employees in such preparation, investigation, or grand jury proceeding.

48

26 U.S.C. § 6103(i)(2)(A) (emphasis added). In short, Section 6103(i)(2)(A) shows that, when disclosing taxpayer information to other federal agencies for the purposes of a nontax criminal matter, the IRS must limit its disclosure to officers and employees of the requesting agency who are “personally and directly engaged in” the relevant nontax criminal matter “solely for the use of such officers and employees in such [nontax criminal matter].” Id. The above-referenced “requirements of subparagraph (B)” refer to Section 6103(i)(2)’s request requirements. These are found in Section 6103(i)(2)(B), which requires that, before the IRS can make a disclosure, it must ensure that an agency’s request

is in writing and sets forth- (i) the name and address of the taxpayer with respect to whom the requested return information relates; (ii) the taxable period or periods to which such return information relates; (iii) the statutory authority under which the proceeding or investigation described in subparagraph (A) is being conducted; and (iv) the specific reason or reasons why such disclosure is, or may be, relevant to such proceeding or investigation.

Id. § 6103(i)(2)(B).

Plaintiffs raise a variety of arguments as to why the IRS’s August 7 disclosure of taxpayer address information to ICE was likely unlawful under the personnel limitations and request requirements of Internal Revenue Code Section 6103(i)(2). The Court will address these arguments in turn after providing an overview of the IRS’s August 7 disclosure to ICE.

In April 2025, the IRS entered into a Memorandum of Understanding (“MOU”) with ICE that “set[] forth the agreement of the parties with respect to ICE’s use of the authority in [Internal Revenue Code Section] 6103(i)(2) for the submission of requests for addresses” to the IRS. Mem. of Understanding, Dkt. No. 30-6 ¶ 1.e. On June 27, 2025, the IRS received a Section 6103(i)(2) request from ICE, pursuant to the terms of the MOU, for “the last known address of approximately 1.28 million individuals.” Walker Decl., Dkt. No. 31-1 ¶ 6. In its request, ICE listed one

49

individual—the Assistant Director of the ICE Enforcement and Removal Operations (“ERO”) Field Operations—as the “officer[]” or “employee[]” “personally and directly engaged in” the relevant nontax criminal matter. Defs.’ Response to Court Order, Dkt. No. 40 ¶ 2. The IRS responded to ICE’s request on August 7, 2025, providing ICE with the last known address for approximately 47,000 of the 1.28 million individuals requested by ICE. Walker Decl., Dkt. No. 31-1 ¶ 7. The IRS made this disclosure through its preferred file sharing platform “with the understanding that it would be delivered” to the lone Assistant Director identified by ICE as the individual personally and directly engaged in the relevant criminal matters. Defs.’ Response to Court Order, Dkt. No. 40 ¶ 2. However, “[t]he IRS understands that four ICE employees possessed the necessary permissions to retrieve the [shared information] on [the] Assistant Director[’s] behalf: two ICE Government Contractor Systems Architects; the ICE Homeland Security Investigations (“HSI”) Acting Special Assistant to [the identified] Assistant Director []; and an ICE HSI Criminal Analyst.” Id.

The IRS’s August 7 disclosure to ICE is in tension with the personnel limitations found in Section 6103(i)(2)(A). These personnel limitations require, in relevant part, that the IRS disclose information only to officers and employees of the requesting agency who are “personally and directly engaged in” the relevant criminal matter, “solely for the use of such officers and employees” in the relevant criminal matter. 26 U.S.C. § 6103(i)(2)(A).

The Internal Revenue Code does not define what is means for an officer or employee to be “personally and directly engaged” in a criminal matter. But the Court can delineate the outer bounds of the phrase by looking to its plain meaning and some textual clues. To start, the term “personally” in the 1976 TRA is best read to require that the officers or employees receiving a disclosure from the IRS pursuant to Section 6103(i)(2) be themselves working on the specific

50

criminal matter contained in the agency’s request for disclosure, rather than merely supporting others who are doing so. See Personally, Webster’s New World Dictionary of the American Language (2d ed. 1972) (defining “personally” to mean “without the help of others; in person”); see also Webster’s New International Dictionary of the English Language, Second Edition, Unabridged (“Webster’s Second”) (1959) (defining “personal” to mean “[d]one in person, without the intervention of another; direct from one person to another” and “[c]arried on between individuals directly”); Webster’s Third New International Dictionary of the English Language, Unabridged (“Webster’s Third”) (1968) (same); Shyvers v. Sec.-First Nat. Bank of Los Angeles, 108 F.2d 611, 612 (9th Cir. 1939) (holding that an “absentee landlord” was not “personally engaged” in farming under Section 75 of the Bankruptcy Act). Similarly, the term “directly” is best read to emphasize that the work being done by the officer or employee should not be merely tangential to the work of the matter; in other words, an officer or employee is not “directly” involved in a criminal matter if their only role is to relay taxpayer information to those who are directly working on the matter. See Directly, Webster’s Second (1959) (defining “directly” to mean “[i]n a direct way; without anything intervening; personally”); Directly, Webster’s Third (1968) (defining “directly” to mean “without any intervening agency or instrumentality or determining influence; without any intermediate step” and “in independent action without any sharing of authority or responsibility”); Directly, Black’s Law Dictionary (Rev. 4th ed. 1968) (defining “directly” to mean “[i]n a direct way without anything intervening; not by secondary, but by direct, means”). Finally, the officer or employee must be “engaged” in the criminal matter, which reinforces the conclusion that the relevant individual must be more than a passive, short- term contributor. As the edition of Black’s Law Dictionary that was current at the time of the 1976 TRA’s enactment explains, “engage” denotes “more than a single act or single transaction or an

51

occasional participation.” See Engage, Black’s Law Dictionary (Rev. 4th ed. 1968). To “engage” requires more than to “participate,” which “means simply to take or have a part or share in.” Id.; see also Martinez Matute v. CNN Constr. Inc., 415 F. Supp. 3d 226, 233 (D.D.C. 2019) (RMC) (“For an employee to be ‘engaged in commerce’ under the FLSA, he must be directly participating in the actual movement of persons or things in interstate commerce . . .”) (internal citations omitted).

Accordingly, the Court determines that, under the plain meaning of the phrase, an officer or employee “personally and directly engaged” in a criminal matter under Section 6103(i)(2) is someone working on the substance of the relevant criminal matter who will be able to apply to the criminal matter the information obtained through the IRS’s disclosure.

This plain-meaning interpretation is supported by the surrounding statutory text. For instance, Section 6103(i)(2)(A) mandates that the IRS disclose information “solely for the use” of the “personally and directly engaged” officers and employees who receive the disclosed material. 26 U.S.C. § 6103(i)(2)(A) (emphasis added). In other words, the statute clearly contemplates that the individuals receiving disclosure from the IRS under Section 6103(i)(2) will then use the disclosed information in the relevant criminal matter. Furthermore, the statute’s distinction between the personnel who must submit a request for the requesting agency—the agency’s head or Inspector General—and the personnel who may receive the IRS’s disclosure resulting from that request—the officers or employees personally and directly engaged in the criminal matter—shows that Section 6103(i)(2) does not authorize the IRS to make disclosures to high-level officials whose only duty is to dole out the disclosed information at a later date. Id. To allow for such disclosure would risk the IRS disclosing confidential information to another agency before that agency ever began the criminal investigation or proceeding that must already be underway before the agency

52

can obtain disclosure from the IRS under Section 6103(i)(2). See id. § 6103(i)(2)(B) (providing that the requesting agency must “set[] forth . . . the statutory authority under which the [criminal] proceeding or investigation . . . is being conducted”) (emphasis added).

With this interpretation in mind, the Court finds it unlikely that a single individual could be “personally and directly engaged” in approximately 47,000 criminal matters, let alone 1.28 million of them, as ICE represented to the IRS. See Walker Decl., Dkt. No. 31-1 ¶ 6. Defendants make two arguments to the contrary, both of which are unavailing. First, Defendants argue that an individual “could be ‘personally and directly’ engaged in an investigation that starts with a high-level view of agency data.” Defs.’ Opp’n, Dkt. No. 31 at 30. As counsel for Defendants elaborated at the hearing, “one person may very well be able to determine if 47,000 people are subject to criminal investigation under 8 U.S.C. 1253(a)(1), 13 because it is simply a matter of looking at the removal order date and then the current date to determine if 90 days has passed.” Dkt. No. 38 at 25:8–12. But this argument misses the point. An individual’s ability to take a “high-level view” of data has nothing to do with their ability to be “personally and directly engaged” in the investigation of 47,000 criminal matters. 14 And even if one individual can be personally and directly engaged in 47,000 criminal investigations if those investigations involve only a “calculation of days,” as Defendants suggest, the Court cannot turn a blind eye to the

13 As the Court will explain in more detail below, 8 U.S.C. 1253(a)(1) criminalizes remaining in the United States more than 90-days after a final order of removal. 14 Although not raised by the parties, the Court notes that the regulatory regime under Section 6103(i)(2) provides that “return information . . . disclosed to officers and employees” of a federal agency “may be disclosed by such officers and employees to other persons, . . . but only to the extent necessary in connection” with a nontax criminal investigation or proceeding. 26 C.F.R. § 301.6103(i)-1(b). “Among those persons to whom returns and return information may be disclosed by officers and employees of [a] . . . Federal agency . . . are . . . (i) Other officers and employees of the [agency], such as clerical personnel (for example, secretaries, stenographers, docket and file room clerks, and mail room employees) and supervisory personnel . . .; (ii) Officers and employees of another Federal agency working under the direction and control of such officers and employees of the . . . Federal agency . . .; and (iii) Court reporters.” 26 C.F.R. § 301.6103(i)-1(b)(2)(i)-(iii). These regulations support the interpretation that the initial individuals who receive the disclosure—the individuals who are personally and directly engaged in the criminal matter—must be individuals who are actively working on the relevant criminal matter.

53

disconnect between Defendants’ hypothetical and the facts of the case. H’rg Tr., Dkt. No. 38 at 82:14. ICE’s June 27 letter to the IRS requested only address information; it made no mention of dates. Defs.’ Resp. to Order of Court, Dkt. No. 40. Furthermore, if, as Defendants argue, the relevant “calculation of days” was simply “a matter of looking at the removal order date and then the current date to determine if 90 days has passed,” Dkt. No. 38 at 25:8–12, then there was no need for ICE to request confidential taxpayer information from the IRS. ICE already had the data necessary for this equation: ICE possessed the relevant removal order dates before making its June 27 request to the IRS—as evidenced by the fact that ICE provided those dates to the IRS in its request—and ICE does not have to request confidential taxpayer information to determine the current date. See H’rg Tr., Dkt. No. 38 at 89:20–90:5.

Defendants fall back on the argument that “it is ICE’s responsibility under the MOU to ensure that the ‘personally and directly engaged’ requirement is satisfied, and it is neither unreasonable nor unlawful for the IRS to rely on ICE’s representations in that respect.” Defs.’ Opp’n, Dkt No. 31 at 30 (citing MOU § 6(E)); Hr’g Tr., Dkt. No. 38 at 85:23–25 (counsel for Defendants explaining that “IRS relied on the attestation that this particular person would be personally and directly involved”). But Section 6103 is the IRS’s statute to administer, and the IRS’s conduct must be judged by the statutory standards set out therein. The IRS relied on ICE’s representation that one individual was “personally and directly engaged in” 1.28 million criminal matters. As the Court explained above, Plaintiffs have shown that the single individual identified by ICE could not have been “personally and directly engaged in” 47,000 criminal matters on the facts of this case. Accordingly, because the IRS’s August 7 disclosure to ICE was likely unlawful, it was likely unreasonable, too. While the IRS certainly has discretion in making disclosures under the Internal Revenue Code, that discretion does not extend to violations of the statute. To find

54

otherwise would risk reading the detailed disclosure requirements of Section 6103—requirements that exist to protect the general confidentiality of taxpayer information—out of the statute. Mercy Hosp., Inc. v. Azar, 891 F.3d 1062, 1068 (D.C. Cir. 2018) (quoting Antonin Scalia & Bryan A. Garner, Reading Law: The Interpretation of Legal Texts 176-77 (2012)) (“We presume that Congress did not ‘include words that have no effect,’ and so we generally ‘avoid a reading that renders some words altogether redundant.’”).

In addition to the personnel limitations found in Section 6103(i)(2)(A), the IRS must ensure that an agency’s request “meets” the request requirements of Section 6103(i)(2)(B) before it may disclose return information pursuant to that request. 26 U.S.C. § 6103(i)(2)(A). As a reminder, an agency’s request meets these requirements if

the request is in writing and sets forth- (i) the name and address of the taxpayer with respect to whom the requested return information relates; (ii) the taxable period or periods to which such return information relates; (iii) the statutory authority under which the proceeding or investigation described in subparagraph (A) is being conducted; and (iv) the specific reason or reasons why such disclosure is, or may be, relevant to such proceeding or investigation.

Id. § 6103(i)(2)(B).

Plaintiffs raise a variety of arguments with respect to the request requirements found in Section 6103(i)(2)(B). The Court starts with Plaintiffs’ argument that ICE’s June 27 request was unlawful because it requested only address information. Pls.’ Mem., Dkt. No. 30-1 at 24–26.

Plaintiffs identify two statutory hooks to support their argument that requests for address information alone are unlawful. The first is Section 6103(i)(2)(B)(i), which requires the IRS to ensure that a requesting agency has provided “the name and address of the taxpayer with respect to whom the requested return information relates” before disclosing the requested information. 26 U.S.C. § 6103(i)(2)(B)(i). Clearly, the requesting agency’s provision of an address is more than just a box to be checked, as the address must be the address “of the taxpayer with respect to whom

55

the requested return information relates.” Id. But the statute is ambiguous as to whether an agency must provide the IRS with the current address of the taxpayer. One could reasonably read the statute, as Plaintiffs do, to require that the requesting agency provide a current address, as the statute refers to the address “of” the taxpayer in the present tense. Id.; see also Pls.’ Mem., Dkt. No. 30-1 at 25 (emphasis in original) (arguing that the statute does not permit disclosure when an agency provides “a former address, or a suspected address”). Such a reading would likely make requests for address information alone unlawful because they would involve requests that provide either a former address or a suspected address.

Plaintiffs highlight two internal IRS publications in support of their interpretation that requests for address information only are invalid. First, Plaintiffs highlight Internal Revenue Manual Section 11.3.28.4, which states that “Requests for addresses only are invalid because IRC 6103(i)(2) requires that the requester provide an address.” IRM § 11.3.28.4, Disclosure of Return Information (Other Than Taxpayer Return Information) Pursuant to IRC 6103(i)(2), IRS (April 17, 2025), https://perma.cc/C5WU-ADPX at (5). Plaintiffs also highlight the IRS’s Disclosure and Privacy Law Reference Guide, which provides: “Requests under section 6103(i)(2) seeking only taxpayers’ addresses do not comply with the section. The section contemplates requests for return information in addition to taxpayers’ addresses.” IRS Pub. 4639, Disclosure & Privacy Law Reference Guide, at 5-4 (Oct. 2012 ed.), https://perma.cc/JH2L-QQZP. While these internal publications do not have the force of law, the “interpretations of those responsible for implementing” a statute “‘constitute a body of experience and informed judgment to which courts and litigants may properly resort for guidance’ consistent with the APA.” Loper Bright, 603 U.S. at 394 (quoting Skidmore v. Swift & Co., 323 U.S. 134, 140 (1944)). However, as another court in this District recently noted, like the statutory language at issue, the meaning of these two

56

publications is not entirely clear. Centro de Trabajadores Unidos v. Bessent, No. 25-cv-0677, 2025 WL 1380420, at *6 (D.D.C. May 12, 2025) (DLF) (explaining that both publications may be contemplating a request that does not include an address).

The Court finds the statute’s requirement that a requesting agency provide the “address of the taxpayer” to be genuinely ambiguous as to whether the address provided by the agency must be the current address of the taxpayer. For now, the Court is satisfied with the fact that the best interpretation of the statute requires, at the very least, that the IRS confirm that the address provided by the requesting agency is the “address of the taxpayer,” whether that be the current address or a former address. Cf. Centro de Trabajadores Unidos, 2025 WL 1380420, at *7 (“As long as the agency has a name and an address for a taxpayer, it can request address and name information from the IRS to assist the requesting agency in a criminal investigation or proceeding, and the IRS must comply.”).

On August 7, the IRS disclosed to ICE the address information of thousands of taxpayers without first confirming that ICE provided the “address of the taxpayer” in its request, as required by statute. At the September 5 hearing, counsel for the Defendants explained that, if ICE’s June 27 request to the IRS provided a name and taxpayer identification number for an individual that “matched up” with the name and taxpayer identification number that the IRS had in its system, then the IRS disclosed the last known address for that individual without confirming whether the address ICE provided for that individual matched an address the IRS had in its system. H’rg Tr., Dkt. No. 38 at 28:3–4 (“If the name and the taxpayer identification number matched up and an address was provided, IRS then provided the last known address.”). In other words, only in “instances in which there was no tax identification number provided” did the “IRS look[] to make sure that there was an exact match between the address in the system and the one that ICE

57

provided.” 15 Id. at 31:21–24. Those instances were few and far between. As counsel for the IRS explained, “the number of people with whom the IRS matched using a taxpayer identification number” rather than address confirmation “was quite high,” with the estimated number being “around 39,000” of the 47,000 addresses the IRS provided to ICE on August 7. Id. at 29:2–5. Without confirming that an address provided by ICE matched an address the IRS had in its system, the IRS had no way of knowing that the address provided was the “address of the taxpayer,” as required by Section 6103(i)(2)(B)(i). Accordingly, Plaintiffs have established another reason why the IRS’s August 7 disclosure to ICE was contrary to the Internal Revenue Code.

Plaintiffs’ second argument with respect to the invalidity of requests for address information alone is connected to Section 6103(i)(5), which permits the IRS to disclose return information “to locate fugitives from justice.” 26 U.S.C. § 6103(i)(5) (the “fugitive exception”). This fugitive exception provides that, pursuant to a valid court order, “the return of an individual or return information with respect to such individual shall” be open to “officers and employees of any Federal agency exclusively for use in locating such individual.” Id § 6103(i)(5)(A). Plaintiffs argue that Section 6103(i)(5) is the applicable Section here—which means the IRS acted unlawfully because ICE did not obtain a court order—because statements made by the Trump Administration and the MOU between ICE and the IRS “make clear that locating individuals suspected of violating immigration law, not prosecuting them criminally, is the intent of the disclosures at issue here.” Pls.’ Mem., Dkt. No. 30-1 at 26.

15 Although the Court does not decide whether the Internal Revenue Code requires the requesting agency to provide the current address of the taxpayer in order to receive disclosure, the Court notes that counsel for the IRS represented that, for disclosures made pursuant to an address match, the IRS made a disclosure even when the address provided by ICE did not match the current address in the IRS’s system. See Hearing Transcript 31:24–32:2 (“. . . IRS can have multiple addresses in its system, and so long as the address matched an address in the system at IRS, then it would have provided the last known address of the individual.”).

58

Plaintiffs’ argument regarding the fugitive exception goes hand-in-hand with their argument regarding the invalidity of requests for address information alone under Section 6103(i)(2). Without implicating the latter argument, the Court determines that the fugitive exception found in Section 6103(i)(5) does not provide the only mechanism for using tax records to locate individuals. As another court in this District has noted, the fugitive exception “serves an entirely different purpose than Section 6103(i)(2).” Centro de Trabajadores Unidos, 2025 WL 1380420, at *6. The fact that “the fugitive provision authorizes the IRS to release more extensive tax return information” under the fugitive exception’s “more onerous prerequisites” “does not preclude the IRS from releasing a taxpayer’s name and address to an agency” under Section 6103(i)(2). Id.

Plaintiffs also attack the general sufficiency of the IRS’s determination that ICE’s June 27 request met the request requirements of Section 6103(i)(2)(B). Plaintiffs argue that, instead of engaging in a “meaningful review” of ICE’s request to “ensure compliance” with Section 6103(i)(2)(B), the IRS used “an automated process” to make “automated disclosures” in violation of its “obligations to confirm compliance with Section 6103(i)(2) before transferring data.” Pls. Mem., Dkt. No. 30-1 at 24. Plaintiffs’ claim is supported by an internal IRS presentation titled, “DHS-ICE Data Exchange Overview,” that characterizes the IRS’s data sharing with ICE as an “on demand process to provide last known address information based on the individual’s information request from ICE.” Admin. R., Dkt. No. 48-4 at TD_136.

The Internal Revenue Code does not explain how the IRS must ensure that a request “meets the requirements” of Section 6103(i)(2)(B). But the request must be made in writing and set forth the four categories of information listed in the statute, so there must be some level of review. See 26 U.S.C. § 6103(i)(2). Nothing in the statute suggests that automated processes are an inherently

59

impermissible method of review. Automated processes could be useful, for instance, in confirming that a requesting agency has provided “the taxable period or periods to which [the requested] return information relates,” and they could even be used to shepherd the relevant information from that period should the rest of the requirements be satisfied. Id. § 6103(i)(2)(B)(ii). However, an agency’s request for disclosure must also meet certain requirements that do not appear susceptible to automation. The prime example of such a requirement is found in Section 6103(i)(2)(B)(iv), which requires the IRS to determine whether a request sets forth “the specific reason or reasons why such disclosure is, or may be, relevant to such proceeding or investigation.” Id. § 6103(i)(2)(B)(iv) (emphasis added).

In requiring the IRS to ensure that a request set forth the “specific” reason or reasons why disclosure is “relevant,” Section 6103(i)(2)(B)(iv) confers a responsibility on the IRS to engage in some level of individualized, non-automated review when evaluating agency requests for disclosure of taxpayer information. At the very least, the IRS must determine whether the “reason or reasons” provided by a requesting agency are “specific” (as opposed to “general,” presumably). 16 The Court does not have to define the contours of the term “specific” to conclude that it requires the use of human judgment. However, it appears that, at least with respect to the requirement in Section 6103(i)(2)(B)(iv), the IRS made a non-automated determination that ICE provided a sufficiently “specific reason or reasons” in its June 27 request. See, e.g., H’rg Tr., Dkt. No. 38 at 97:14–18 (explaining why the IRS determined that ICE provided sufficiently “specific” reasons). Accordingly, remaining for the Court to consider is whether the IRS’s determination was unlawful.

16 This provision could also be read to task the IRS with determining whether an agency’s proffered reason or reasons are adequately “relevant,” as well. Given that the Court does not know the details of how the IRS processed ICE’s June 27 request, it does not find it necessary to answer this interpretive question.

60

In its June 27 request to the IRS, ICE represented that it sought the disclosure of address information pursuant to its authority under 8 U.S.C. § 1253(a)(1), which criminalizes staying in the country 90 days past a final order of removal. See Dkt. No. 40-1; see also Dkt. No. 38 at 16:8– 9. ICE further represented that the “specific reason” why disclosure of address information was “relevant to such proceeding or investigation” was that “the requested information may contain address information which is potentially at issue with respect to investigating or proving a violation under 8 U.S.C. § 1253(a)(1).” ICE’s June 27 Request Letter, Dkt. No. 40-1. In other words, ICE represented that an individual’s address information was relevant for the “specific reason” that their address information could “potentially [be] at issue” with respect to an investigation or proceeding involving whether the individual stayed in the country 90 days past a final order of removal. The IRS determined that this “specific reason” was sufficient under the statute. See H’rg Tr., Dkt. No. 38 at 90:1–5 (“So taken together, the specific reason is because [ICE is] investigating for a criminal violation of 8 U.S.C. 1253(a)(1), and with the additional information of the person- specific removal order date, we think that easily satisfies subparagraph ([iv]).”); id. at 95:10–13 (“The specific information is that because they are investigating whether the statute has been violated and the removal order date, that is the specific information provided that satisfies (iv).”).

Again, the IRS’s August 7 disclosure to ICE is in tension with the Internal Revenue Code.

Section 6103(i)(2)(B)(iv) requires the IRS to determine that a requesting agency has provided a “specific reason” that justifies the agency’s entitlement to taxpayer information. 26 U.S.C. § 6103(i)(2)(B)(iv). If Congress thought any reason could be provided, then it would have omitted the term “specific,” as it did elsewhere in Section 6103. See 26 U.S.C. § 6103(k)(12) (providing that qualified tax collection contractors may contact certain taxpayers and disclose to them “the nature, subject, and reason for the contact”); id. § 6103(p)(4)(A) (providing that any federal agency

61

“shall, as a condition for receiving returns or return information,” establish and maintain “a permanent system of standardized records with respect to any request, the reason for such request, and the date of such request”). Given that a requesting agency’s “specific” reason or reasons will inherently relate to the relevance of the information sought, and given that this determination of relevance requires some deference to the judgment of the requesting agency, the Court does not read the specificity requirement of Section 6103(i)(2)(B)(iv) as a burden for the IRS. But it clearly requires more than a cursory consideration of the reason or reasons provided by the agency. ICE’s June 27 request is a generalized one. The “reason” provided by ICE is more circular than specific: ICE told the IRS that the requested address information was relevant to its investigations or proceedings under 8 U.S.C. § 1253(a)(1) because the address information was “potentially at issue with respect to investigating or proving a violation under 8 U.S.C. § 1253(a)(1).” ICE’s June 27 Request Letter, Dkt. No. 40-1. Put in generic terms, an agency represented to the IRS that the “specific reason” why confidential taxpayer information was relevant to an investigation or proceeding under a criminal statute was because the agency was conducting an investigation or proceeding under that criminal statute. Such a request does not comport with the requirement that an agency provide a specific, individualized reason in order to gain access to confidential taxpayer information.

Defendants argue that the above reason given by ICE is sufficiently specific when viewed in combination with the dates of the final orders of removal that ICE included in its June 27 request. See H’rg Tr., Dkt. No. 38 at 90:1–5. But it’s not clear why those dates have any bearing on the specificity of the request. The date of the final order of removal might have been relevant if ICE had requested dated information in its June 27 request. But ICE’s June 27 letter requested the “last known address of [1.28 million] individuals” without any limitations on date. ICE’s June 27

62

Request Letter, Dkt. No. 40-1. The administrative record suggests that the IRS ran ICE’s June 27 request for the taxable period of January 2022 until the present. See Admin. R., Dkt. No. 48-3 at TD_100. But it is not clear whether this date range was chosen by the IRS or ICE. Either way, Section 6103(i)(2) plainly requires that an agency requesting confidential taxpayer information submit a written request that sets forth “the taxable period or periods to which such return information relates.” 26 U.S.C. § 6103(i)(2)(B)(ii). The IRS disclosed confidential taxpayer information to ICE despite ICE’s failure to submit a request that met this requirement. Therefore, the IRS’s disclosure to ICE violated Internal Revenue Code Section 6103(i)(2).

Accordingly, the Court finds that the IRS’s August 7 disclosure of confidential taxpayer address information to ICE violated Internal Revenue Code Section 6103(i)(2)(B)(iv) because ICE’s June 27 request failed to provide a specific reason or reasons why the taxpayer information it requested was relevant to the criminal investigations or proceedings it was conducting. In addition, the IRS’s August 7 disclosure of confidential taxpayer information to ICE violated Internal Revenue Code Section 6103(i)(2)(B)(ii) because ICE’s June 27 request failed to provide “the taxable period or periods” to which its requested taxpayer information related.

* * * *

In sum, Plaintiffs have shown that the IRS committed multiple violations of Internal Revenue Code Section 6103(i)(2) when it disclosed confidential taxpayer address information to ICE on August 7, 2025. The IRS’s disclosure of address information for 47,000 taxpayers to a single individual at ICE violated the requirement in Section 6103(i)(2)(A) that the IRS disclose taxpayer information only “to officers and employees of [a requesting] agency who are personally and directly engaged in” a criminal proceeding or investigation. 26 U.S.C. § 6103(i)(2)(A). Furthermore, the IRS’s August 7 disclosure to ICE violated Section 6103(i)(2)(B)(i) because the

63

IRS disclosed thousands of taxpayers addresses to ICE without first confirming that ICE provided the “address of the taxpayer with respect to whom the requested return information relate[d].” Id. § 6103(i)(2)(B)(i). In addition, the IRS’s August 7 disclosure to ICE violated Section 6103(i)(2)(B)(iv) because the IRS disclosed taxpayer information to ICE even though ICE’s request for disclosure did not adequately set forth the “specific reason or reasons” why taxpayer address information was relevant to a criminal proceeding or criminal investigation under 8 U.S.C. § 1253(a)(1). Id. § 6103(i)(2)(B)(iv). Finally, the IRS’s August 7 disclosure to ICE violated Section 6103(i)(2)(B)(ii) because ICE’s June 27 request failed to provide “the taxable period or periods” to which its requested taxpayer information related. Id. § 6103(i)(2)(B)(ii).

3. The adoption of the Address-Sharing Policy was arbitrary and capricious.

The APA requires a reviewing court to hold unlawful and set aside agency action that is “arbitrary” or “capricious.” 5 U.S.C. § 706(2)(A). The APA’s arbitrary-and-capricious standard requires that agency action be “reasonable and reasonably explained.” Fed. Commc’ns Comm’n v. Prometheus Radio Project, 592 U.S. 414, 423 (2021). Accordingly, courts must ensure that an agency “has acted within a zone of reasonableness and, in particular, has reasonably considered the relevant issues and reasonably explained [its] decision.” Id. An agency changing an existing policy must, at the very least, “display awareness that it is changing position” and “show that there are good reasons for the new policy.” F.C.C. v. Fox Television Stations, Inc., 556 U.S. 502, 515 (2009) (emphasis in original). Agencies may not “depart from a prior policy sub silentio or simply disregard rules that are still on the books.” Id. An agency “acts arbitrarily and capriciously when it abruptly departs from a position it previously held without satisfactorily explaining its reason for doing so.” Wisconsin Valley Improvement v. FERC, 236 F.3d 738, 748 (D.C. Cir. 2001). Accordingly, agency action may be arbitrary or capricious if the agency “entirely fail[s] to consider an important aspect of the problem,” Motor Vehicle Manufacturers Ass’n of the United States, Inc.

64

v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 43 (1983), or if there is an “[u]nexplained inconsistency” in agency policy. Nat’l Cable & Telecommunications Ass’n v. Brand X Internet Servs., 545 U.S. 967, 981 (2005)). Furthermore, an agency’s change in policy is arbitrary and capricious when the agency fails to consider reliance interests engendered by its prior policy. Fox Television, 556 U.S. at 515.

In determining whether agency action is arbitrary and capricious, the Court’s “review must ‘be based on the full administrative record that was before the [agency] at the time [it] made its decision.’” Am. Bioscience, Inc. v. Thompson, 243 F.3d 579, 582 (D.C. Cir. 2001) (quoting Citizens to Pres. Overton Park, Inc. v. Volpe, 401 U.S. 402, 420 (1971)). The Court may also consider other records if they are relevant to “a showing of bad faith or improper behavior,” Oceana, Inc. v. Ross, 920 F.3d 855, 865 (D.C. Cir. 2019), or if further factual development is necessary “to ascertain the contours of the precise policy at issue,” Venetian Casino Resort, L.L.C. v. E.E.O.C., 409 F.3d 359, 367 (D.C. Cir. 2005); Hisp. Affs. Project v. Acosta, 901 F.3d 378, 388 (D.C. Cir. 2018).

Plaintiffs claim that the IRS’s implementation of the Data Policy was arbitrary and capricious because the IRS failed to present a reasoned basis for the Policy, failed to consider key issues implicated by the Policy, and failed to consider the reliance interests engendered by the IRS’s prior policy regarding disclosure of confidential taxpayer information. Pls.’ Mem., Dkt. No. 30-1 at 28–35. The Court finds that Plaintiffs have established a likelihood of success based on all three grounds.

As discussed above, Plaintiffs have shown that the IRS has adopted and implemented a new policy—the Address-Sharing Policy—pertaining to the disclosure of confidential taxpayer information. See supra Section III.B.1.a. The IRS’s new Policy furthers a different set of interests

65

than its prior policy. Whereas the IRS’s prior disclosure policy was rooted in individualized review, segmentation, and limited, last-resort disclosure, the Address-Sharing Policy—like the broader Data Policy that the Plaintiffs allege the IRS has adopted—has shifted the IRS’s focus toward automation, consolidation, and rapid, large-scale disclosure. Pls. Mem., Dkt. No. 30-1 at 7–14. Pursuant to its new Data Policy, the IRS executed a Memorandum of Understanding (“MOU”) with ICE that laid out the ground rules regarding future requests from ICE for confidential taxpayer address information. See Mem. of Understanding, Defs.’ Opp’n Ex. 1, Dkt. No. 31-1. Shortly thereafter, the IRS processed a request from ICE for the last-known addresses of approximately 1.2 million taxpayers in a little over a month, ultimately providing ICE with the last-known addresses of about 47,000 taxpayers. See Walker Decl., Dkt. No. 31-1 ¶¶ 5–8.

The IRS did not provide a “reasoned explanation” for its implementation of the Address-

Sharing Policy. Fox Television, 556 U.S. at 515. In fact, the record before the Court indicates that the IRS did not even display an awareness that it was changing its position. Id. Typically, this would mean that the IRS’s implementation of the new Policy was arbitrary and capricious. But Defendants argue against that conclusion by claiming that, in executing the MOU with ICE and transferring taxpayer address information to ICE, the IRS acted within the “zone of reasonableness.” Defs.’ Opp’n, Dkt. No. 31 at 31 (citing Prometheus Radio Project, 592 U.S. at 423 (explaining that courts must “simply ensure[] that the agency has acted within a zone of reasonableness and, in particular, has reasonably considered the relevant issues and reasonably explained the decision”)).

The Court disagrees with Defendants’ conclusion and framing of the issue. Defendants’

conclusion is premised on the claim that Section 6103(i)(2) required the IRS to make its August 7 disclosure to ICE. See Defs.’ Opp’n, Dkt. No. 31 at 31 (arguing that “it cannot be unreasonable

66

for an agency to do what is required by law”) (emphasis in original). But as the Court has explained elsewhere, Section 6103(i)(2) did not require the IRS’s August 7 disclosure to ICE, it prohibited it. See supra Section III.B.2. Furthermore, Defendants’ framing of the issue eliminates significant portions of the picture. Defendants ignore the fact that the IRS has “historically, as a matter of both law and policy, not shared taxpayers’ information with immigration authorities for the purpose of locating individuals suspected to be present in the country illegally.” Koskinen Decl., Dkt. No. 30-13 ¶ 11. In addition, Defendants fail to address Plaintiffs’ claim that, in April 2025, the same month the IRS entered into the MOU with ICE, the IRS amended its procedures for reviewing Section 6103(i)(2) requests for taxpayer information. Pls.’ Mem., Dkt. No. 30-1 at 30. These amendments converted a process through which Section 6103(i)(2) requests were “undertaken carefully” and “handled on a case-by-case basis strictly in accordance with the law” into a process through which massive requests for confidential taxpayer information could be processed quickly in bulk without much human interaction. Koskinen Decl., Dkt. No. 30-13 ¶ 12; Admin R., Dkt. No. 48 at TD_80–152. Finally, Defendants’ attempt at characterizing the IRS’s information sharing with ICE as business-as-usual is undermined by Plaintiffs’ showings regarding the IRS’s overhaul of its technical infrastructure and belied by the administrative record. For example, about a week before the IRS made its August 7 disclosure to ICE, the IRS’s Chief Privacy Officer sent an email explaining that, because of the “unique circumstances of this data exchange,” it was “unclear if the Commissioner ha[d] been briefed by Chief Counsel or IT” on the status of ICE’s request for taxpayer information. Admin. R., Dkt. No. 48 at TD_131.

In light of the above, Plaintiffs have shown that, through its implementation of the Address-

Sharing Policy, the IRS unreasonably departed from its prior policy sub silentio. Fox Television,

67

556 U.S. at 515. Accordingly, Plaintiffs have shown a likelihood that the IRS acted arbitrarily and capriciously in implementing the Address-Sharing Policy. Id.

Plaintiffs also argue that the IRS failed to consider key issues in adopting the Address-

Sharing Policy. Pls.’ Mem., Dkt. No. 30-1 at 30 (citing Motor Vehicle Mfrs. Ass’n, 463 U.S. at 43 (explaining that it is arbitrary and capricious for an agency to “fail[] to consider an important aspect of the problem”)). Specifically, Plaintiffs argue that the IRS failed to consider (1) the need to protect taxpayers’ privacy, (2) the impact on participation and trust in the tax system, and (3) the harm that could result from disclosures, and in particular mistaken disclosures. Id. On the present record, there is no question that the IRS failed to consider these issues when adopting the Address- Sharing Policy, as the record before the Court indicates that the IRS failed to consider any countervailing issues at all when adopting the new Policy. The Court also finds that these issues are important issues that the IRS likely should have considered when adopting the Address-Sharing Policy. Accordingly, Plaintiffs have provided another reason why the IRS’s implementation of the Address-Sharing Policy was arbitrary and capricious.

Finally, the Court finds that the IRS’s prior policy engendered significant reliance interests that the IRS failed to consider when adopting the Address-Sharing Policy. Fox Television, 556 U.S. at 515. The IRS’s prior focus on the confidentiality of taxpayer information was a “cornerstone of the Center’s ability to (1) effectively counsel [its] clients, and (2) provide education and outreach that encourages participation in the tax system. Olson Decl., Dkt. No. 30- 8 ¶ 32. Furthermore, the Center has, “for years, assured [its] clients who are worried about confidentiality of the stringent protection in place at the IRS with respect to the protection of information.” Id. ¶ 33. Based on these protections, the Center has encouraged undocumented immigrants to file for ITINs, which may now be used to the detriment of those undocumented

68

immigrants under the IRS’s Address-Sharing Policy. Id. ¶ 35. In addition, small business owners represented by MSA have “relied on reassurances by public officials” and “the Tax Code itself” to protect their sensitive information for decades. Phetteplace Decl., Dkt. No. 30-9 ¶¶ 16, 6; Piacsek Decl., Dkt. No. 30-11 ¶ 3. Furthermore, individuals represented by the Plaintiffs have been submitting their sensitive information to the IRS “with the understanding that in doing so, it will be protected by the IRS and used only for limited purposes.” Jane Doe Decl., Dkt. No. 30-10 ¶ 13; Koskinen Decl., Dkt. No. 30-13 ¶ 11. It was arbitrary and capricious for the IRS to ignore these significant reliance interests.

* * * *

In sum, Plaintiffs have shown a substantial likelihood that the IRS’s implementation of the Address-Sharing Policy was both arbitrary and capricious and contrary to law. The IRS failed to acknowledge its change in policy and failed to provide a reasoned explanation for its implementation of the Address-Sharing Policy. Furthermore, in implementing the Address- Sharing Policy, the IRS failed to consider significant reliance interests that were endangered by its prior policy. Finally, Plaintiffs have shown a substantial likelihood that the Address-Sharing Policy is contrary to the requirements of the Internal Revenue Code. Plaintiffs have therefore made an adequate showing of likelihood of success on the merits as to the Address-Sharing Policy to support a preliminary injunction.

For similar reasons, Plaintiffs have also plausibly alleged that the IRS’s broader Data Policy is both arbitrary and capricious and contrary to law and therefore in violation of the APA. Accordingly, the Court shall DENY Defendants’ [26] Motion to Dismiss with respect to Count Two of Plaintiffs’ [20] Amended Complaint, in which Plaintiffs challenge the Data Policy under

69

the APA. Although Plaintiffs have sought a preliminary injunction as to only one aspect of this broad claim, their allegations are sufficient to permit the claim to proceed.

C. Plaintiffs have made a strong showing of a likelihood of irreparable harm.

To obtain a stay of the Address-Sharing Policy, Plaintiffs must make a sufficient showing that the Policy will cause them irreparable harm. The “basis of injunctive relief in the federal courts has always been irreparable harm.” Chaplaincy of Full Gospel Churches v. England, 454 F.3d 290, 297 (D.C. Cir. 2006) (quoting Sampson v. Murray, 415 U.S. 61, 88 (1974)). “A movant’s failure to show any irreparable harm is therefore grounds for refusing to issue a preliminary injunction, even if the other three factors entering the calculus merit such relief.” Id.

The D.C. Circuit “has set a high standard for irreparable injury,” which must be established through a two-step inquiry. Chaplaincy, 454 F.3d at 297. First, in order to establish irreparable harm, a plaintiff must show that they are at risk of an injury that is “both certain and great,” or “actual and not theoretical.” Id. A plaintiff seeking preliminary relief must “demonstrate that irreparable injury is likely in the absence of an injunction.” Winter v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 22 (2008) (emphasis in original). Second, a plaintiff seeking preliminary relief must show that they are likely to suffer an injury that would be “beyond remediation” absent preliminary relief. Chaplaincy, 454 F.3d at 297. Accordingly, the “possibility that adequate compensatory or other corrective relief will be available at a later date, in the ordinary course of litigation weighs heavily against a claim of irreparable harm.” Va. Petroleum Jobbers Ass’n v. FPC, 259 F.2d 921, 925 (D.C. Cir. 1958).

1. Plaintiff Center for Taxpayer Rights has shown a likelihood of irreparable harm to core activities in support of its mission.

Plaintiffs have shown that the Center has suffered a concrete injury due to the IRS’s new Address-Sharing Policy. See supra Section III.A.1. Here, the Court determines that the IRS’s

70

Address-Sharing Policy has caused a “certain and great” injury to the Center’s organizational interests that would be “beyond remediation” absent a stay of the Policy. Chaplaincy, 454 F.3d at 297.

The injury to the Center’s organizational interests caused by the IRS’s Address-Sharing Policy is both “certain and great.” Chaplaincy, 454 F.3d at 297. Plaintiffs have introduced evidence showing that, since public reporting began on the IRS’s Address-Sharing Policy, taxpayers—particularly those whom the Center is statutorily required to engage—have become less willing to come to the Center’s events, to seek its guidance, or to engage with the Center’s education and outreach. See Olson Decl., Dkt. No. 27-1 ¶ 8. As a result, the Center has been forced to expend additional resources to avoid losing its federal funding. Id. ¶¶ 40–46. Plaintiffs have therefore shown that the IRS’s Address-Sharing Policy has caused the Center harm that will continue to occur absent a stay of the Policy. Wisconsin Gas Co., 758 F.2d at 674.

The threatened injury is not a minor harm to the Center. Record evidence makes clear that “it is very difficult to restore” trust in the tax system. Olson Decl., Dkt. No. 30-8 ¶ 53. If the IRS continues to transfer confidential taxpayer information to ICE pursuant to the Address-Sharing Policy, then “trust in the system will further plummet,” creating “insurmountable obstacles” to the Center’s work. Id. The Center’s harm resulting from this loss of trust is irreparable because it is “difficult to replace or measure” and one the Center “should not be expected to suffer.” WPIX, Inc. v. ivi, Inc., 691 F.3d 275, 285 (2d Cir. 2012). The harm to the Center caused by the Address- Sharing Policy is also irreparable because it “threaten[s] the existence” of the Center’s pro bono legal services program and threatens to eliminate the federal funding the Center receives to conduct its representation and engagement. NACM-New England, Inc. v. Nat’l Ass’n of Credit Mgmt., Inc., 927 F.3d 1, 5 (1st Cir. 2019); Olson Decl., Dkt. No. 30-8 ¶ 51. Furthermore, the IRS’s Address-

71

Sharing Policy threatens to erode the goodwill that the Center has cultivated with taxpayers in a way that cannot be adequately measured at a later date, which is “a prime example of intangible, irreparable harm.” S. Glazer’s Distributors of Ohio, LLC v. Great Lakes Brewing Co., 860 F.3d 844, 853 (6th Cir. 2017). Finally, absent a stay, the IRS’s Address-Sharing Policy will continue to “impair” the Center’s “ability to provide representation” to taxpayers, which other courts in this District have found “sufficient to warrant preliminary relief.” Cath. Legal Immigr. Network, Inc. v. Exec. Off. for Immigr. Rev., No. 21-cv-094, 2021 WL 3609986, at *3 (D.D.C. Apr. 4, 2021) (RJL) (collecting cases).

The Center’s injury would also be “beyond remediation” absent a stay. Chaplaincy, 454 F.3d at 297. Without a stay, the Center will continue to lose taxpayer trust, which, as the Court referenced above, cannot be regained easily. See Olson Decl., Dkt. No. 30-8 ¶ 53. But more importantly, the Center’s injury is not one that can be adequately remedied through future awards of damages or other relief. As the Center argues, its “ability to engage [taxpayers] through its counseling and educational efforts are time sensitive” due to the “strict deadlines” the IRS imposes upon taxpayers. Pls.’ Mem., Dkt. No. 30-1 at 37. Once those deadlines pass, “there can be no do over and no redress.” Newby, 838 F.3d at 9 (citing League of Women Voters of N.C. v. North Carolina, 769 F.3d 224, 247 (4th Cir. 2014)). Furthermore, the continuing erosion of taxpayer trust that would occur if the Address-Sharing Policy were not stayed would not be remediated by a judicial ruling at a later date, for, as the IRS has noted in the past, if the IRS abused taxpayers’ reasonable expectation of privacy, the “resulting loss of public confidence could seriously impair the tax system.” Pls.’ Mem., Dkt. No. 30-1 at 38.

Defendants fail to undercut Plaintiffs’ showing of irreparable harm to the Center’s interests.

Defendants’ primary argument is that the Center has not alleged an adequate harm for Article III

72

standing, let alone irreparable harm. Defs.’ Opp’n, Dkt. No. 31 at 34. The Court rejected this argument elsewhere. See supra Section III.A.1. Defendants also argue that Plaintiffs delayed bringing their motion for a preliminary injunction, and that this delay undercuts their claim to irreparable harm. Defs.’ Opp’n, Dkt. No. 31 at 35. But, as Plaintiffs point out, it was reasonable for Plaintiffs to “wait for the facts to ripen before bringing this Motion to the Court.” Pls.’ Reply, Dkt. No. 34 at 20. Furthermore, Plaintiffs did not delay once those facts had ripened. As Plaintiffs explain, the IRS “began its mass disclosure of data to ICE on August 7, it was publicly reported on August 8, and Plaintiffs filed their Motion on August 20.” Id. Defendants also argue that, even if Plaintiffs have suffered irreparable harm, it is too late to remedy that harm. Defs.’ Opp’n, Dkt. No. 31 at 36. But the IRS has the authority to require the return or destruction of taxpayer information that is being improperly maintained or used. See 26 U.S.C. § 6103(p)(4); 26 C.F.R. § 301.6103(p)(7)-1. Furthermore, the Court has the authority to issue prospective relief that prevents future unlawful disclosures of taxpayer information.

* * * *

In sum, Plaintiffs have shown that the Center’s injuries are “certain and great” and are not injuries for which “adequate compensatory or other corrective relief will be available at a later date.” Chaplaincy, 454 F.3d at 297 (quoting Wis. Gas Co., 758 F.2d at 674). Accordingly, Plaintiffs have shown a strong likelihood of irreparable harm to the Center absent a stay.

2. The association Plaintiffs have shown a likelihood of irreparable harm to their members.

As the Court explained above, Plaintiffs have shown that the IRS’s Address-Sharing Policy and August 7 disclosure to ICE presents a future risk of concrete harm analogous to the harm protected by the torts of intrusion upon seclusion and breach of confidence. See supra Section III.A.2. Here, the Court determines that this harm is “both certain and great” because there is an

73

imminent risk that Plaintiffs’ members’ confidential address information will be impermissibly used by ICE for civil immigration enforcement. Chaplaincy of Full Gospel Churches, 454 F.3d at 297. The Court also finds that this harm would be “beyond remediation” absent a stay. Id. Accordingly, Plaintiffs have established that their members face irreparable harm.

Plaintiffs argue that the IRS’s August 7 disclosure of confidential taxpayer information to ICE “is itself an irreparable injury” to their members because “there is an imminent risk of public disclosure or impermissible use” of that information. Pls. Mem., Dkt. No. 30-1 at 39. To assess whether the IRS’s likely unlawful “disclosure of private information amounts to irreparable harm,” the Court considers “(1) the type of information disclosed and (2) the breadth of disclosure and use of the information disclosed.” Am. Fed’n of Lab. & Cong. of Indus. Organizations v. Dep’t of Lab., No. 25-cv-0339, 2025 WL 1783899, at *11 (D.D.C. June 27, 2025) (JDB).

The Court starts with the “type of information disclosed” by the IRS in its August 7 disclosure to ICE. Am. Fed’n of Lab. & Cong. of Indus. Organizations, 2025 WL 1783899, at *11. “The type of information disclosed matters because it determines the risk a movant faces from disclosure: the more sensitive the information, the more its use could further harm the movant.” Id. The type of information at issue here is Plaintiffs’ members’ confidential address information, which the IRS disclosed to ICE on August 7.

Congress has determined that the IRS must keep Plaintiffs’ members’ address information confidential. See 26 U.S.C. § 6103(a). Therefore, at a general level, Congress has decided that the disclosure of this material presents some risk to Plaintiffs’ members. However, the level of risk that Plaintiffs’ members face from the unlawful disclosure of their confidential address information depends on whether the risk stems from future public disclosure of future impermissible use. If the risk stems from future public disclosure, then this type of confidential

74

taxpayer information—address information—does not present the same risk of future harm as other types of confidential taxpayer information. For instance, if Plaintiffs’ members are relying on the threat of future public disclosure, then information such as their Social Security numbers, their income and net worth, and their tax liability would present a higher degree of risk than their address information, which people generally make public in a variety of ways. However, if there is an imminent risk that ICE will impermissibly use Plaintiffs’ members’ confidential taxpayer information for civil immigration enforcement, then the type of information at issue—again, address information—carries more weight. When it comes to harm stemming from impermissible civil immigration enforcement such as deportation, no piece of information presents a greater risk to Plaintiffs’ members’ than address information.

Accordingly, the Court will turn to the risk Plaintiffs’ members’ face from either the future public disclosure or the future impermissible use of their confidential address information. Am. Fed’n of Lab. & Cong. of Indus. Organizations, 2025 WL 1783899, at *11. In general, “courts find disclosure necessitates a preliminary injunction when there is an imminent risk that information privately disclosed or obtained illegally will either be impermissibly used or publicly disclosed.” Id. at *12. Plaintiffs’ argument concerns both public disclosure and impermissible use. Pls. Mem., Dkt. No. 30-1 at 39.

Regarding the risk of public disclosure, the D.C. Circuit has held that “the individual interest in protecting the privacy of [] information sought by the government is significantly less important where the information is collected by the government but not disseminated publicly.” Am. Fed’n of Gov’t Emps., AFL-CIO v. Dep’t of Hous. & Urb. Dev., 118 F.3d 786, 793 (D.C. Cir. 1997). This Court has explained that, while there “is no doubt that public dissemination of sensitive, private information is an irreparable harm,” courts in this District “have consistently

75

‘declined to find irreparable injury’ from the disclosure of private information ‘where the challenged disclosure is not public,’ but instead is to a small number of ‘individuals obligated to keep [the information] confidential.’” All. for Retired Americans v. Bessent, 770 F. Supp. 3d 79, 108 (D.D.C. 2025) (quoting Univ. of Cal. Student Ass’n v. Carter, No. 25-cv-0354 (RDM), 766 F.Supp.3d 114, 121 (D.D.C. Feb. 17, 2025)). Accordingly, the argument that “private disclosure of personal information alone amounts to irreparable harm holds no water in this Circuit.” Am. Fed’n of Lab. & Cong. of Indus. Organizations, 2025 WL 1783899, at *14. Furthermore, if the government has “enacted reasonable devices to secure the confidentiality” of the information that has been disclosed, then courts “cannot, without grounds, assume that the devices will prove insufficient.” Am. Fed’n of Gov’t Emps., AFL-CIO, 118 F.3d at 793.

Plaintiffs have failed to establish irreparable harm on the basis that their members’

confidential address information will be disclosed publicly. The record does not suggest that ICE will disclose Plaintiffs’ members’ address information to the public. Therefore, Plaintiffs have failed to show that their members’ confidential address information will not be secured by the various legal protections that prohibit its public disclosure. Am. Fed’n of Gov’t Emps., AFL-CIO, 118 F.3d at 793. The Internal Revenue Code establishes criminal and civil penalties for federal officers and employees who wrongfully disclose confidential taxpayer information. See 26 U.S.C. § 7431 (providing civil penalties for wrongful disclosure or inspection); Id. § 7213A (providing for dismissal or discharge for wrongful disclosure); Id. § 7213 (providing criminal penalties for wrongful disclosure). Furthermore, the Internal Revenue Code requires that ICE implement a variety of safeguards to protect the confidentiality of Plaintiffs’ members’ address information. Id. § 6103(p)(4). These legal protections raise the presumption that Plaintiffs’ members’ confidential address information will neither be intentionally disclosed to the public by ICE nor

76

accidentally disclosed to the public by ICE. Am. Fed’n of Gov’t Emps., AFL-CIO, 118 F.3d at 793. Because Plaintiffs have failed to introduce evidence to rebut this presumption, they have failed to establish irreparable harm to their members on the basis that their members’ confidential address information is at risk of future public disclosure.

However, Plaintiffs have introduced sufficient evidence to overcome the presumption that these legal protections will guard against the future impermissible use of their members’ confidential address information. Plaintiffs argue that there is an imminent risk that their members’ confidential address information will be impermissibly used by ICE for civil immigration enforcement (e.g., removal), which would be illegal under Internal Revenue Code Section 6103(i)(2) and a violation of the MOU. Pls.’ Mem., Dkt. No. 30-1 at 39; I.N.S. v. Lopez- Mendoza, 468 U.S. 1032, 1038 (1984) (explaining that removal proceedings are civil actions). Defendants characterize Plaintiffs’ claim as pure speculation and argue that the MOU’s “strict limitations on the use of information provided under Section 6103(i)(2)” protect against any impermissible use of Plaintiffs’ members’ address information. Defs.’ Opp’n, Dkt. No. 31 at 12– 3. Defendants further argue that Plaintiffs’ claim should be rejected under the “presumption of regularity,” which “supports the official acts of public officers” and requires that, “in the absence of clear evidence to the contrary, courts presume that [those officers] have properly discharged their official duties.” Am. Fed’n of Gov’t Emps., AFL-CIO, 870 F.2d at 727 (quoting United States v. Chemical Found., 272 U.S. 1, 14–15 (1926)).

After careful consideration of the record and weighing the various arguments of the parties, the Court determines that Plaintiffs have shown that the risk of ICE impermissibly using their members’ address information for civil immigration enforcement “is of such imminence that there is a ‘clear and present’ need for equitable relief to prevent irreparable harm.” Chaplaincy of Full

77

Gospel Churches, 454 F.3d at 297 (citing Wisconsin Gas Co., 758 F.2d at 674). While the Internal Revenue Code and the MOU establish meaningful safeguards to prevent against the misuse of Plaintiffs’ members’ confidential address information, the Defendants and ICE have exhibited “material noncompliance with those safeguards.” Pls.’ Mem., Dkt. No. 30-1 at 41.

At the outset, Plaintiffs have shown that the IRS’s August 7 disclosure to ICE violated many of the safeguards contained in Internal Revenue Code Section 6103(i)(2). See supra Section III.B.2. These violations indicate a strong likelihood that ICE will impermissibly use Plaintiffs’ members’ confidential address information for civil immigration enforcement. For example, the IRS’s August 7 disclosure to ICE violated Internal Revenue Code Section 6103(i)(2) because it relied on ICE’s representation that one individual was “personally and directly engaged in” approximately 1.28 million criminal investigations or proceedings, approximately 47,000 of which the IRS provided taxpayer information for. Id. This is not a formalistic violation. Rather, this violation suggests that ICE was not really conducting the criminal investigations or proceedings that formed the basis of the IRS’s disclosure of confidential taxpayer information to ICE. In addition, the IRS’s August 7 disclosure to ICE likely violated Internal Revenue Code Section 6103(i)(2) because ICE did not provide a “specific reason or reasons” why Plaintiffs’ members’ confidential address information was relevant to the approximately 1.28 million criminal investigations or proceedings ICE claimed it was conducting under 8 U.S.C. § 1253(a)(1), which criminalizes staying in the country 90 days past a final order of removal. See ICE’s Request Letter, Dkt. No. 40-1; Hr’g Tr., Dkt. No. 38 at 16:8–9. The Court has noted that this was not a high bar for ICE to meet. See supra Section III.B.2. ICE’s failure to provide any semblance of a specific reason as to why Plaintiffs’ members’ address information was relevant to the criminal investigations or proceedings it was conducting lends further support to Plaintiffs’ claim that ICE

78

intends to use Plaintiffs’ members’ address information for civil, rather than criminal, enforcement.

In addition to the IRS’s statutory violations, the MOU between the IRS and ICE could be read to suggest that ICE sought taxpayer address information for civil immigration enforcement. The Introduction to the MOU provides that DHS, acting on behalf of ICE, entered into the MOU at the direction of Executive Order (“EO”) No. 14161. MOU, Dkt. No. 31-1 § 1.a. (citing Executive Order (EO) No. 14161, Protecting the United States from Foreign Terrorists and Other National Security and Public Safety Threats, 90 Fed. Reg. 8451 (Jan. 20, 2025)). The MOU provides that EO 14161 directed DHS “to take immediate steps to identify, exclude, or remove aliens illegally present in the United States.” Id. But a directive to “identify, exclude, or remove” appears to be a directive focused on civil enforcement. Id. Accordingly, the MOU itself appears to provide that it was formed to further a directive from the President to “take immediate steps” to further civil immigration enforcement. Id.

Furthermore, the text of EO 14161 strongly suggests that it was implemented to further civil rather than criminal immigration enforcement. The EO is generally focused on “vigilan[ce] during the visa-issuance process” and “ensur[ing] that admitted aliens and aliens otherwise already present in the United States do not bear hostile attitudes toward its citizens, culture, government, institutions, or founding principles, and do not advocate for, aid, or support designated foreign terrorists and other threats to our national security.” 90 Fed. Reg. 8451 § 1(a)–(b). The direction pursuant to which the MOU was purportedly executed appears to come from Section 2 of EO 14161, which is titled, “Enhanced Vetting and Screening Across Agencies.” Id. § 2. Section 2 directs the Secretary of State, in coordination with the Attorney General, the Secretary of Homeland Security, and the Director of National Intelligence, to “re-establish a uniform baseline

79

for screening and vetting standards and procedures” and “identify[] countries throughout the world for which vetting and screening information is so deficient as to warrant a partial or full suspension on the admission of nationals from those countries . . . [and] how many nationals from those countries have entered or have been admitted into the United States on or since January 20, 2021.” Id. § 2(a)–(b). Section 2 further provides that

Whenever information is identified that would support the exclusion or removal of any alien [who is deemed to be a national of a country for which vetting and screening information is so deficient as to warrant a partial or full suspension on the admission of nationals from that country], the Secretary of Homeland Security shall take immediate steps to exclude or remove that alien unless she determines that doing so would inhibit a significant pending investigation or prosecution of the alien for a serious criminal offense or would be contrary to the national security interests of the United States.

Id. § 2(c) (emphasis added). This directive from EO 14161 § 2(c) appears to have been the impetus for the MOU between the IRS and ICE. The primary directive of EO 14161 § 2(c) is that DHS “shall take immediate steps to exclude or remove” an individual determined to be a national of a country with deficient vetting and screening information. Id. This is a civil directive. Furthermore, EO 14161 § 2(c) provides that this primary, civil directive must be pursued in all scenarios where doing so would not “inhibit” a “significant” and “pending” investigation or prosecution for a “serious criminal offense” or be “contrary to the national security interests of the United States.” Id. Limiting this exclusion to civil actions that would “inhibit” a “pending” criminal matter suggests that EO 14161 was not calling for the initiation of new criminal investigations or proceedings. Id. Accordingly, EO 14161 is in tension with the fact that ICE listed only one individual as being “personally and directly engaged in” the approximately 1.2 million criminal investigations or proceedings at issue in its June 27 request, which, as counsel for the Defendants alluded to in the September 5 hearing, suggests that those investigations or proceedings were relatively new. Defs.’ Resp. to Order, Dkt. No. 40; Hr’g Tr., Dkt. No. 38 at

80

25:8–12 (where counsel for Defendants argued that “one person may very well be able to determine if 47,000 people are subject to criminal investigation under 8 U.S.C. 1253(a)(1), because it is simply a matter of looking at the removal order date and then the current date to determine if 90 days has passed”). Furthermore, EO 14161 excludes civil enforcement only for “significant” investigations or prosecutions for “serious” serious criminal offenses, or to protect national security. 90 Fed. Reg. 8451 § 2(c). This suggests that EO 14161 directed DHS to prioritize civil enforcement over all but the most serious criminal matters. One could reasonably question whether the MOU and ICE’s subsequent June 27 request adhered to this presidential priority, as investigations or proceedings under 8 U.S.C. 1253(a)(1) include a wide range of offenses that do not readily assume a comparable importance to issues of national security.

On top of the violations of Section 6103 and the inferences flowing from the MOU and EO 14161, the history of ICE’s requests for taxpayer information contained in the administrative record establishes a genuine concern that ICE may use Plaintiffs’ members’ address information for civil immigration enforcement. The administrative record shows that ICE submitted at least three requests for taxpayer information between February and June 2025. The first request came in late February 2025, when ICE’s Acting Director emailed officials at Treasury and the IRS “a list of approximately 700 thousand criminal illegal aliens who ha[d] standing deportation orders” and requested that the IRS “provide all possible information” for “each alien” on ICE’s list, “including but not limited to: (1) known aliases, (2) known home addresses, (3) known employers’ information, (4) known phone numbers, (5) known relatives, (6) known emails, (7) known Bank Name, (8) known IP information, and (9) SSN or TIN.” Admin. R., Dkt. No. 48-3 at TD_09–10 (“We would like to have this data within two weeks”) (cleaned up). The IRS’s Chief Counsel concluded that disclosure would have been unlawful given their “understanding [] that ICE’s

81

request [did] not relate to a criminal investigation, because removal proceedings are generally civil in nature.” Id. at TD_03–4. Just over a month after ICE’s first request, the MOU was executed. See MOU, Dkt. No. 31-1 (signed on April 7, 2025). ICE’s second request for taxpayer information came in early June 2025. Admin. R., Dkt. No. 48 at TD_86. This time, ICE requested taxpayer information for its “full alien population” of over 7 million individuals. Id. After the IRS prompted ICE to supplement its second request to bring it into compliance with the MOU, ICE represented to the IRS that it was conducting investigations or proceedings for each of these 7 million individuals under 8 U.S.C. § 1325—which criminalizes improper entry into the United States—and that the “primary goal” of the request was to “enrich [ICE’s] data with relevant address data” so that ICE would have “the most recent address that IRS can identify associated with any of the individuals” included in ICE’s request. Id. at TD_84. ICE also identified a single Assistant Director as the officer or employee “personally and directly engaged in” these 7 million investigations or proceedings. Id. The IRS, however, was “again unable to process [ICE’s request] in accordance with the MOU” because ICE failed to rectify several deficiencies, which included the failure to provide an attestation that the requested information would only be used for the relevant criminal proceedings or investigations. Id. at TD_93. The IRS received ICE’s third request—the request that ultimately led to the disclosure of address information for 47,000 individuals at issue in this case—within a week after the IRS denied ICE’s second request. Id. at TD_112. ICE’s third request sought taxpayer information for approximately 1.2 million individuals rather than 7.6 million, and it also represented that ICE was conducting investigations or proceedings under 8 U.S.C. § 1253(a)(1)—which criminalizes remaining in the United States 90 days past a final order of removal—rather than 8 U.S.C. § 1325—which, again, criminalizes improper entry into the United States. Id. at TD_106–16. However, ICE represented that the same

82

Assistant Director was the sole officer or employee “personally and directly engaged in” the relevant criminal matter for both the second and third request. Compare id. at TD_84 (naming the Assistant Director for the second request) with Defs.’ Resp. to Order, Dkt. No. 40 at 1–2 (naming the Assistant Director for the third request).

This recent history of ICE’s requests for taxpayer information provides further evidence in support of Plaintiffs’ claim that there is an imminent risk that their members’ confidential address information will be impermissibly used by ICE for civil immigration enforcement. To start, the administrative record suggests that the IRS denied ICE’s first request for taxpayer information because it understood that ICE wanted to use the information for civil removal proceedings. See Admin. R., Dkt. No. 48 at TD_4 (IRS Chief Counsel concluding that ICE’s request was unlawful “because removal proceedings are generally civil in nature”). Perhaps sensing that ICE needed clarification on the protections afforded to taxpayer information, the IRS entered into an April 2025 MOU with ICE that provided ICE with clear guidelines for submitting future requests under Internal Revenue Code Section 6103(i)(2). MOU, Dkt. No. 31-1. But ICE’s early-June 2025 request for the taxpayer information of over 7 million individuals—which ICE said represented “the full alien population”—failed to fulfill most of the MOU’s requirements, suggesting that ICE was wholly uninterested in abiding by the requirements of the Internal Revenue Code at the time of its second request for taxpayer information. Admin. R., Dkt. No. 48 at TD_83–93. There is reason to believe that ICE held the same indifference toward the requirements of Section 6103(i)(2) when it made the June 27 request for address information at issue in this case. In its June 27 request for the last known address of 1.2 million individuals, ICE represented that each individual was under criminal investigation for a violation of 8 U.S.C. § 1253(a)(1) (remaining 90 days past an order of removal) and that Assistant Director “J.W.” was the lone officer or employee

83

“personally and directly engaged in” each of the 1.2 million investigations. Defs.’ Resp. to Order, Dkt. No. 40 at 1–2. Compare this to ICE’s early-June request for the last known address of 7.6 million individuals, where ICE represented that each individual was under criminal investigation for a violation of 8 U.S.C. § 1325 (improper entry into U.S.) and that Assistant Director “J.W.” was the lone officer or employee “personally and directly engaged in” each of the 7.6 million investigations. Admin. R., Dkt. No. 48 at TD_84. It is unreasonable to think that, in one month, the same Assistant Director could be “personally and directly engaged” in 7.6 million criminal matters under one statute and 1.2 million criminal matters under another. Accordingly, this raises an inference that ICE’s representation that it is conducting criminal investigations under 8 U.S.C. § 1253(a)(1) was pretext.

Plaintiffs finally argue that “the White House’s recent conduct” and statements attributable to the current White House show that there is an imminent risk their members’ data will be impermissibly used for civil immigration enforcement. Pls.’ Mem., Dkt. No. 30-1 at 41. For instance, Plaintiffs allege that in February 2025 the White House pressured the IRS to give DOGE Affiliates broad access to the IRS’s tax systems and datasets. Am. Compl., Dkt. No. 20 ¶ 146. Plaintiffs also cite public reporting suggesting that multiple members of IRS leadership were excluded from the Section 6103(i)(2) review process between February and August 2025 because they pushed back on ICE’s requests for taxpayer information. See, e.g., Pls. Mem., Dkt. No. 30-1 at 42–3 (regarding the “ouster” of the IRS’s then-Commissioner and then-Chief Counsel). As the Court detailed above, the administrative record supports this claim. In addition, Plaintiffs emphasize that, when asked about the IRS’s information sharing with ICE, White House spokesperson Abigail Jackson said that the information sharing was “part of President Trump’s promise to carry out the mass deportation of criminal illegal aliens—the promise that the American

84

people elected him on and he is committed to fulfilling.” Pls.’ Mem. Ex. 3, Dkt. No. 30-5 at 4. Defendants do not contest the underlying facts of these claims. Viewed in conjunction with the rest of the record, Plaintiffs’ factually uncontested allegations regarding the White House’s engagement with the IRS and its stated reasons for that engagement further support Plaintiffs’ claim that there is an imminent risk their members’ address information will be impermissibly used for civil immigration enforcement.

To summarize, the Court finds that Plaintiffs have shown “a ‘clear and present’ need for equitable relief to prevent” the imminent risk that their members’ address information will be impermissibly used for civil immigration enforcement. Chaplaincy of Full Gospel Churches, 454 F.3d at 297 (citing Wisconsin Gas Co., 758 F.2d at 674). The Court makes this determination despite the protections contained in the Internal Revenue Code and the MOU because of the IRS’s violations of the confidentiality protections contained in Section 6103(i)(2); the focus on civil immigration enforcement referenced in the MOU and elaborated on in EO 14161; the history of ICE requesting taxpayer information from the IRS for civil enforcement and ICE’s subsequent indifference toward the requirements of Section 6103(i)(2); and Plaintiffs’ factually uncontested allegations regarding the White House’s engagement with the IRS and its stated reasons for that engagement.

Plaintiffs have also shown that this imminent risk of impermissible use presents injuries that are “beyond remediation” absent a stay. Chaplaincy of Full Gospel Churches, 454 F.3d at 297. As Plaintiffs argue, their members and their members’ families face an “imminent risk of the kinds of immigration detention-and-removal-related harm that other courts have found warranted preliminary injunctions to prevent.” Id. (citing Doe v. Noem, No. 3:25-cv-00023, 2025 WL 1399216, at *11 (W.D. Va. May 14, 2025) (risk of removal to a third country); D.B.U. v. Trump,

85

No. 1:25-cv-01163-CNS, 2025 WL 1304288, at *9 (D. Colo. May 6, 2025) (risk of summary removal without due process); Noem v. Abrego Garcia, No. 24A949, 2025 WL 1077101 (April 10, 2025) (actual summary removal without due process)). Furthermore, Plaintiffs have introduced evidence showing that the risk of immigration detention-and-removal-related harm is heightened by the additional threat of misidentification. See Phetteplace Decl., Dkt. No. 30-9 ¶ 15 (MSA members fear “mistaken immigration enforcement actions based on misidentification” because many “live in communities with immigrants, and some of them have similar or identical names to other people who live near them”); Piacsek Decl., Dkt. No. 30-11 ¶ 9 (same for NFFE members); Olson Decl., Dkt. No. 30-8 ¶ 75 (“From my time as Taxpayer Advocate, . . . I know that government databases often fail to properly or consistently record the names of individuals whose names do not follow Anglo naming conventions.”); Hr’g Tr., Dkt. No. 38 at 42:16–23 (“. . . many times immigrant families not only have . . . certain conventions in their naming systems that would lead to misidentification, but in addition, the families often live together. If a family lived together and a father and a son had identical names and then that son moved and that son is a U.S. citizen and his name was matched, that’s a significant risk of misidentification.”). Finally, Plaintiffs have shown that the imminent risk that their members’ address information will be misused “impedes [their members’] ability to safely participate in the tax system,” which will cause their members to miss filing deadlines and “forfeit rights or money to which they would otherwise have been entitled.” Pls.’ Mem., Dkt. No. 30-1 at 43 (citing Olson Decl., Dkt. No. 30- 8 ¶ 81-89).

* * * *

In sum, Plaintiffs have established that their members face irreparable injury due to the imminent risk that their confidential address information will be impermissibly used by ICE for

86

civil immigration enforcement. While the Internal Revenue Code and MOU prohibit ICE from using Plaintiffs’ members’ confidential address information for civil enforcement, Plaintiffs have introduced evidence that establishes a significant and imminent risk that ICE may not comply with those prohibitions. If this risk were to materialize, then Plaintiffs’ members would face injuries, including deportation from the United States, that would be beyond remediation at a later date. Accordingly, Plaintiffs have shown that their members face irreparable harm.

D. The balance of the equities and the public interest favor granting a stay of the agency action.

Finally, to obtain preliminary relief, Plaintiffs must show that “the balance of equities tips in [their] favor” and that “an injunction is in the public interest.” Winter, 555 U.S. at 20. Because the Government is the opposing party in this case, these two factors “merge” together. Nken, 556 U.S. at 435. In analyzing these factors, the Court “must carefully balance the equities by weighing the harm to the moving party and the public if there is no injunction against the harm to the government and the public if there is.” Hanson v. D.C., 120 F.4th 223, 246 (D.C. Cir. 2024), cert. denied, 145 S. Ct. 2778 (2025). The Court finds that the balance of equities and the public interest weigh in favor of granting preliminary relief.

1. Harm to Plaintiffs and the public if a preliminary injunction does not issue.

To start, Plaintiffs’ “extremely high likelihood of success on the merits is a strong indicator that a preliminary injunction would serve the public interest.” Newby, 838 F.3d at 12. “There is generally no public interest in the perpetuation of unlawful agency action.” Id. “To the contrary, there is a substantial public interest ‘in having governmental agencies abide by the federal laws that govern their existence and operations.’” Id. (quoting Washington v. Reno, 35 F.3d 1093, 1103 (6th Cir. 1994)). Plaintiffs have shown that the IRS’s August 7 disclosure of confidential taxpayer information to ICE violated Internal Revenue Code Section 6103(i)(2). Furthermore, Plaintiffs

87

have shown that the IRS’s implementation of the Address-Sharing Policy was arbitrary and capricious. Accordingly, this factor weighs in favor of granting preliminary relief.

In addition, Plaintiffs and their members would likely face substantial, irreparable harm absent preliminary relief. For example, Plaintiffs have introduced evidence showing that the Center’s pro bono representation clinic is losing clients because the IRS’s alleged Data Policy, including the Address-Sharing Policy and information sharing with ICE, has caused “trust in the tax system [to] plummet.” Olson Decl., Dkt. No. 30-8 ¶ 53. Plaintiffs have also established a sufficiently likely risk that their members’ confidential address information will be impermissibly used for civil immigration enforcement. See supra Section III.C.2. If this risk were to materialize, then Plaintiffs’ members would be subject to grave harm, including, but not limited to, illegal removal from the United States. Furthermore, Plaintiffs have shown that the risk of this harm has led many of Plaintiffs’ members to forgo filing for tax benefits to which they are entitled. These harms weigh in favor of preliminary relief.

The public is harmed as well by the Defendants’ likely unlawful conduct. As the D.C.

Circuit has explained, “[t]he assurance of privacy secured by § 6103 is fundamental to a tax system that relies upon self-reporting.” Nat’l Treasury Emps. Union v. Fed. Lab. Rels. Auth., 791 F.2d 183, 184 (D.C. Cir. 1986). Self-reporting is based on voluntary compliance, and it is “an axiom of tax administration that taxpayer trust in the system is critical to maintaining and increasing voluntary compliance.” Olson Decl., Dkt. No. 30-8 ¶ 53. Plaintiffs’ evidence regarding the drop off in participation among immigrant taxpayers due to the IRS’s new Data Policy shows this principle in action. But it also reveals a way in which the IRS’s new Data Policy could harm the American public. Plaintiffs have introduced evidence showing that “undocumented immigrants contribute significant revenue to the federal tax system—$59.4 billion in 2022 alone.” Pls.’ Mem.,

88

Dkt. No. 30-1 at 31. However, due to a drop-off in compliance stemming from the Data Policy, the IRS “is expected to lose $12 billion in revenue this year, and more than $313 billion over the next decade.” Id. at 31–2. This is a significant loss of revenue. Accordingly, while Plaintiffs and their members face particular immediate harm from the IRS’s Address-Sharing Policy, the American public in general faces long-term harm from their government losing a substantial amount of revenue.

2. Harm to Defendants and the public if a preliminary injunction does issue.

Defendants argue that the Court should not issue preliminary relief because it would disrupt the status quo. Defs.’ Opp’n, Dkt. No. 31 at 36. While courts “must be ‘institutionally wary of granting relief that disrupts, rather than preserves, the status quo,’” the IRS’s recent policy and practice of sharing taxpayer information with ICE is not the status quo. Hanson, 120 F.4th at 247 (quoting Singh v. Berger, 56 F.4th 88, 95 (D.C. Cir. 2022)). The status quo is “the last uncontested status which preceded the pending controversy.” Huisha-Huisha v. Mayorkas, 27 F.4th 718, 733 (D.C. Cir. 2022) (quoting District 50, United Mine Workers of America v. International Union, United Mine Workers of America, 412 F.2d 165, 168 (D.C. Cir. 1969)) (emphasis in original). “The traditional goal of a preliminary injunction is to preserve that status quo.” Id. (emphasis in original). Accordingly, this factor does not weigh in favor of the Defendants.

Defendants also argue that a preliminary injunction would harm its interest in effectuating the law because it would prohibit information sharing “that is required by [Internal Revenue Code] Section 6103(i)(2).” Defs.’ Opp’n, Dkt. No. 31 at 36–7 (emphasis in original) (adding that harm is “particularly acute” because Section 6103(i)(2) aids law enforcement). But the IRS is only required to share information under Section 6103(i)(2) when an agency’s request “meets the requirements” of the statute. 26 U.S.C. § 6103(i)(2)(A). Plaintiffs have shown that ICE’s request to the IRS failed to meet those requirements. See supra Section III.B.2. This would be the third

89

known request submitted by ICE in approximately eight months that failed to meet the requirements of Section 6103(i)(2). See Admin. R., Dkt. No. 48. A temporary prohibition on information sharing between the IRS and DHS and its component agencies would not only be warranted given the circumstances, but it would not interfere with the lawful use of Section 6103(i)(2) between the IRS and other agencies.

Finally, Defendants argue that “principles of comity and judicial efficiency weigh against the exercise of equitable relief” because “the D.C. Circuit will soon decide the same issue” in Centro de Trabajadores Unidos v. Bessent, No. 25-cv-0677, 2025 WL 1380420 (D.D.C. May 12, 2025) (DLF), appeal docketed, No. 25-5851 (D.C. Cir. May 21, 2025). Defs.’ Opp’n, Dkt. No. 31 at 37. But there are fundamental differences between the issues presented in this case and the findings made in Centro.

In Centro, the district court found that the text of the MOU between the IRS and ICE was unlikely to constitute a facial violation of Internal Revenue Code Section 6103(i)(2). Centro, 2025 WL 1380420 at *5–8. Here, however, the Court has determined that the IRS’s actual information sharing with ICE on August 7—which occurred approximately three months after the Centro opinion was issued—was likely unlawful under Section 6103(i)(2). In other words, the court in Centro analyzed the MOU on its face, while this Court has analyzed the MOU as it was applied. The court in Centro also found that the MOU on its own did not “constitute[] a reviewable change in agency action under the APA,” and therefore the plaintiffs could “not show[] a substantial likelihood of success on their claim that the IRS acted arbitrarily and capriciously by reaching an agreement with DHS.” Centro, 2025 WL 1380420 at *8. Here, on the other hand, the Court has determined that the IRS’s broader Address-Sharing Policy—of which the MOU is just a part— along with the IRS’s completed information sharing with ICE, constitute final agency action that

90

was arbitrary and capricious. In other words, the court in Centro analyzed agency action by referencing the MOU alone, while the Court here analyzed agency action by referring to a sequence of conduct engaged in by the IRS, including the final transfer of taxpayer information. Ultimately, the record in this case—which, unlike Centro, includes the benefit of the administrative record— presents materially different issues from the “limited record” in Centro. Centro, 2025 WL 1380420 at *2; see also id. at *8 (“At its core, this case presents a narrow legal issue: Does the Memorandum of Understanding between the IRS and DHS violate the Internal Revenue Code?”). Accordingly, the ongoing appeal in Centro does not warrant a refusal to provide relief to Plaintiffs.

* * * *

In sum, the Court finds that the balance of equities and the public interest weigh in favor of issuing preliminary relief. Preliminary relief will vindicate the public interest because Plaintiffs have shown that the IRS’s Address-Sharing Policy and information sharing with ICE is unlawful. Furthermore, Plaintiffs, their members, and the American public would face significant harm if preliminary relief was not granted. Finally, preliminary relief will not unduly burden Defendants’ countervailing interest in vigorous enforcement of criminal statutes because Defendants will retain the ability to request information from the IRS in strict compliance with the requirements of Section 6103(i)(2).

E. The appropriate equitable remedy is a stay that enjoins further unlawful data transfers, accompanied by requirements to notify the Court of planned future transfers and to notify ICE of the Court’s holdings.

The Court determines that Plaintiffs are entitled to preliminary relief from the IRS’s Address-Sharing Policy. Crafting the appropriate preliminary relief from this Policy “is an exercise of discretion and judgment, often dependent as much on the equities of a given case as the substance of the legal issues it presents.” Trump v. Int’l Refugee Assistance Project, 582 U.S. 571, 579 (2017). The purpose of preliminary relief “is not to conclusively determine the rights of

91

the parties, but to balance the equities as the litigation moves forward.” Id. (citing University of Tex. v. Camenisch, 451 U.S. 390, 395 (1981)). Therefore, courts must limit preliminary relief to the wrongful conduct causing the movant’s harm and ensure that such relief is no more burdensome to the non-moving party than necessary to provide complete redress. Gill v. Whitford, 585 U.S. 48, 68 (2018); Califano v. Yamasaki, 442 U.S. 682, 702 (1979). Furthermore, complete relief “is not a guarantee” but rather “the maximum a court can provide.” Trump v. CASA, Inc., 606 U.S. 831, 854 (2025). A court “need not grant the total relief sought by the applicant but may mold its decree to meet the exigencies of the particular case.” Int’l Refugee Assistance Project., 582 U.S. at 579 (quoting 11A C. Wright, A. Miller, & M. Kane, Federal Practice and Procedure § 2947 (3d ed. 2013)).

In this case, Plaintiffs have requested that the Court stay the implementation of the IRS’s alleged new Data Policy. See Pls.’ Proposed Order, Dkt. No. 30-2. For the reasons the Court has already explained, the Court shall grant this relief in part, staying the aspects of the alleged Data Policy that the Court has described as the IRS’s “Address-Sharing Policy.” Plaintiffs have also requested that the Court not only order the IRS to halt all sharing of taxpayer address information with DHS and its component agencies pursuant to Section 6103(i)(2), but also “inform ICE” that it “must destroy, or seek and facilitate the destruction of” the information that the IRS has already shared with it under that provision. Id. The Court shall not grant this relief in full, but instead shall substitute similar remedies that are better tailored to addressing the precise illegalities and irreparable injuries that Plaintiffs have established. See CASA, 606 U.S. at 854 (directing lower courts to “determine whether a narrower injunction” than the injunction a party sought would be “appropriate” under the circumstances).

92

At the threshold, the Court notes that it cannot order ICE or DHS to take any particular action with respect to the information received from the IRS on August 7, 2025, because neither ICE nor DHS is a party to this case. “[T]he Court is ‘powerless to issue an injunction against’ non-parties.” Hamilton v. Transportation Sec. Admin., 240 F. Supp. 3d 203, 205 (D.D.C. 2016) (EGS) (quoting Citizens Alert Regarding the Env’t v. E.P.A., 259 F. Supp. 2d 9, 17 (D.D.C. 2003) (ESH), aff’d, 102 F. App’x 167 (D.C. Cir. 2004)). Accordingly, the Court focuses its consideration on the remedies available among the parties to this case.

Upon careful consideration of the parties’ submissions, the Court concludes that the best way to “balance the equities as the litigation moves forward” is not to enjoin all data transfers from the IRS to DHS under Section 6103(i)(2), but rather to enjoin only unlawful transfers and require advance notification to the Court and the Plaintiffs of any transfers that the IRS believes are lawful and consistent with the relevant statute. See Int’l Refugee Assistance Project., 582 U.S. at 579.

Similarly, the Court concludes that the “exigencies of the particular case” do not demand an order directing the IRS to seek destruction of all copies of information that it transferred to ICE more than three months ago. See Int’l Refugee Assistance Project., 582 U.S. at 579 (quoting Wright, Miller, & Kane, supra § 2947). However, the circumstances do warrant an order directing the Secretary of the Treasury or his designee to convey to ICE the Secretary’s own expectation that ICE will handle that information consistent with the Court’s holdings and the safeguards that Congress established in the Internal Revenue Code. See 26 U.S.C. § 6103(p)(4).

* * * *

93

IV. CONCLUSION

The Court determines that Plaintiffs have plausibly alleged that the IRS has taken final agency action by changing its policy of strictly protecting confidential taxpayer information and, in its place, implementing a new Data Policy that prioritizes large-scale inter-agency sharing of confidential taxpayer information. Plaintiffs have also shown a substantial likelihood that at least one specific aspect of the Data Policy—the Address-Sharing Policy—is final agency action. Pursuant to the Data Policy, including the Address-Sharing Policy, the IRS entered into an agreement with ICE to share confidential taxpayer address information and, on August 7, 2025, disclosed address information for approximately 47,000 taxpayers to ICE.

Plaintiffs have shown a substantial likelihood that both the IRS’s implementation of the Address-Sharing Policy and its subsequent sharing of taxpayer information with ICE were unlawful under the APA. Plaintiffs have shown that the IRS’s implementation of the Address- Sharing Policy was arbitrary and capricious because the IRS failed to recognize that it was departing from its prior policy of strict confidentiality, failed to consider the reliance interests that were engendered by its prior policy of strict confidentiality, and failed to provide a reasoned explanation for the new Policy. Furthermore, Plaintiffs have shown that the IRS’s disclosure of confidential taxpayer address information to ICE was contrary to law because it violated several provisions of Internal Revenue Code Section 6103(i)(2). For similar reasons, Plaintiffs have plausibly alleged that the IRS’s broader Data Policy is unlawful under the APA.

The IRS’s unlawful conduct has created a substantial likelihood that Plaintiffs and their members will suffer irreparable harm. The Center for Taxpayer Rights is experiencing a significant decline in interest and engagement with its core activities of providing pro bono services to low-income taxpayers, including immigrant taxpayers—potentially jeopardizing its federal funding—which it has attempted to mitigate by diverting resources to education and

94

outreach. Plaintiffs' members, meanwhile, face an imminent risk that their confidential address information will be impermissibly used by ICE for civil immigration enforcement.

For the foregoing reasons, the Court shall GRANT IN PART and DENY IN PART Defendants' [26] Motion to Dismiss and GRANT Plaintiffs' [30] Motion for Stay or, in the' Alternative, for a Preliminary Injunction. An appropriate Order accompanies this Memorandum Opinion.

Dated: November 21, 2025

COLLEEN KOLLAR-KOTEL y United States District Judge