Center for Taxpayer Rights v. IRS

Opinion

United States Court of Appeals FOR THE DISTRICT OF COLUMBIA CIRCUIT

Argued May 12, 2026 Decided September 8, 2026

No. 26-5006

CENTER FOR TAXPAYER RIGHTS, ET AL., APPELLEES

v.

INTERNAL REVENUE SERVICE, ET AL., APPELLANTS

Appeal from the United States District Court for the District of Columbia (No. 1:25-cv-00457)

Jacob E. Christensen, Attorney, U.S. Department of Justice, argued the cause for appellants. With him on the briefs were Brett A. Shumate, Assistant Attorney General, Eric D. McArthur, Deputy Assistant Attorney General, and August E. Flentje, Attorney.

Christopher J. Hajec and Matt A. Crapo were on the brief for amicus curiae Federation for American Immigration Reform in support of appellants.

Madeline Gitomer argued the cause for appellees. With her on the brief were Simon C. Brewer, Daniel A. McGrath, Steven Y. Bressler, and Robin F. Thurston.

Jeffrey S. Gutman was on the brief for amici curiae Lawyers Defending American Democracy, Inc. in support of appellees.

Andrew Weiner was on the brief for amici curiae 115 Members of Congress in support of appellees.

Before: MILLETT, PILLARD and WILKINS, Circuit Judges.

Opinion for the Court filed by Circuit Judge PILLARD.

PILLARD, Circuit Judge:

After the Watergate scandal exposed executive branch abuses of U.S. taxpayers’ information to harass the Administration’s enemies, Congress enacted a prohibition against the Internal Revenue Service (IRS) sharing tax return information with any other federal agency unless the requesting agency meets stringent conditions. In response to requests from Immigration and Customs Enforcement (ICE), in the summer of 2025, the IRS developed a specialized procedure for disclosing return information. The procedure failed to ensure that ICE’s requests complied with statutory requirements. The IRS nonetheless began using the procedure to disclose tens of thousands of records.

Several groups sued. The IRS had turned over more than 47,000 records by the time the district court stayed the IRS from using the new procedure and preliminarily enjoined further disclosures without notice to the court. We affirm.

3

I.

A.

“Every year, millions of taxpayers submit sensitive, personal information” to the IRS in the course of filing their tax returns. Ctr. for Taxpayer Rts. v. Internal Revenue Serv., 815 F. Supp. 3d 1, 20 (D.D.C. 2025). As a result, “the IRS probably has more information about more people than any other agency in this country,” and “almost every other agency that has a need for information about U.S. citizens, therefore, logically seeks it from the IRS.” S. Rep. No. 94-938, at 316-17 (1976). “Recognizing the value and sensitivity of tax information,” Congress enacted 26 U.S.C. § 6103 to “regulate in minute detail [its] disclosure.” Centro de Trabajadores Unidos v. Bessent, 167 F.4th 1218, 1224-25 (D.C. Cir. 2026) (modification in original) (quoting Lake v. Rubin, 162 F.3d 113, 115 (D.C. Cir. 1998)). In section 6103, Congress dictated that taxpayers’ “[r]eturns and return information [are] confidential,” and no federal employee “shall disclose any return or return information obtained by him in any manner”— even within the executive branch—unless a provision of Title 26 of the U.S. Code expressly authorizes disclosure. 26 U.S.C. § 6103(a).

As relevant to this case, section 6103(i)(2) authorizes the IRS to disclose “return information” to other federal agencies for use in specified non-tax criminal investigations. Id. § 6103(i)(2). (No statute authorizes the IRS to disclose “return information” for non-tax civil investigations without the taxpayer’s consent, or to disclose “taxpayer return information” for any purpose, compare 26 U.S.C. § 6103(b)(2) with id. § 6103(b)(3)). The “head of any Federal agency” can request return information from the IRS for three purposes: preparing for a judicial or administrative proceeding

4

“pertaining to the enforcement of a specifically designated Federal criminal statute,” undertaking an “investigation which may result in such a proceeding,” or proceeding before a grand jury. Id. § 6103(i)(1)(A), (i)(2)(A). To submit such an information request, the agency head must send a written message to the Secretary of the Treasury identifying (i) “the name and address of the taxpayer,” (ii) “the taxable period” of the information requested, (iii) “the statutory authority” for the proceeding or investigation, and (iv) “the specific reason or reasons why such disclosure is, or may be, relevant to such proceeding or investigation.” Id. § 6103(i)(2)(B)(i)-(iv). If the agency head submits a compliant request, then the Secretary of the Treasury “shall disclose” the requested information “to officers and employees of such agency who are personally and directly engaged in” the qualifying investigation, “solely for the use of such officers and employees in [that] proceeding.” Id. § 6103(i)(2)(A).

“The assurance of privacy secured by § 6103 is fundamental to a tax system that relies upon self-reporting.” Nat’l Treasury Emps. Union v. Fed. Lab. Rels. Auth., 791 F.2d 183, 184 (D.C. Cir. 1986). Underscoring the importance of confidentiality, Congress has imposed civil and criminal penalties on federal employees who “willfully . . . disclose” return information in violation of section 6103. 26 U.S.C. § 7213(a)(1). As the IRS has explained, “[t]here is no provision in the United States Code that authorizes the disclosure or redisclosure of returns or return information for enforcement of immigration laws.” Disclosures of Return Information Reflected on Returns to Officers and Employees of the Department of Commerce, Including the Bureau of the Census, for Certain Statistical Purposes and Related Activities, 89 Fed. Reg. 93172, 93174 (Nov. 26, 2024) (codified at 26 C.F.R. § 301).

5

B.

Until 2025, the IRS had interpreted section 6103(i)(2) “to prohibit disclosure of a taxpayer’s address when no other information is requested.” Centro de Trabajadores Unidos, 167 F.4th at 1226. That spring, however, “news reports emerged that [the Department of Homeland Security] had asked IRS to disclose addresses of some undocumented taxpayers.” Id. It came to light that the Department of Homeland Security had entered into a Memorandum of Understanding (MOU) with the IRS “to establish the procedures and requirements for” ICE to submit putatively “valid I[nternal] R[evenue] C[ode] § 6103(i)(2) requests for addresses of persons subject to criminal investigation under 8 U.S.C. § 1253(a)(1)”—a statute that, among other things, criminalizes willfully remaining in the United States beyond a 90-day grace period after a final order of removal has been issued. DHS-ICE MOU 2 (App. 359).

With the MOU in place, ICE Acting Director Todd Lyons sent a written request to the IRS seeking “the last known address” for 1.28 million undocumented individuals. Lyons Letter 1-2 (June 27, 2025) (App. 326-27); Romo Decl. ¶ 4, Ctr. for Taxpayer Rts., 815 F. Supp. 3d 1 (D.D.C. 2025) (No. 25- 0457), Dkt. No. 66-1. Director Lyons’s letter announced that ICE sought that information from the IRS because it “may contain address information which is potentially at issue with respect to investigating . . . a violation under 8 U.S.C. § 1253(a)(1).” Lyons Letter 1 (App. 326). On July 1, the IRS gave its employees the “green light” to begin processing ICE’s 1.28 million requests. “Letter from ICE” Emails 1-2 (App. 440-41).

In response to ICE’s interest in return information regarding more than a million individuals, the IRS developed a

6

protocol, the Data-Exchange Procedure, for responding to ICE’s requests. See DHS-ICE Data Exchange Overview 1-4 (App. 462-65). The record in this case includes IRS documents laying out the step-by-step mechanics of the Procedure. Id.

The Data-Exchange Procedure begins with the IRS running a “[p]reprocessing task” that checks to ensure that several fields of a data request from ICE are not blank. DHS- ICE Data Exchange Overview 1 (App. 462). Of particular relevance here, that check ensures the fields for first and last name, taxable period, final removal-order date, address, and ICE point of contact—indicating “the identity of the officer(s) and/or employe(es) [sic] who are personally and directly engaged in the criminal proceeding or criminal investigation” concerning that taxpayer, Lyons Letter 1 (App. 326)—are “not [] empty,” DHS-ICE Data Exchange Overview 1 (App. 462).

Importantly, while section 6103(i)(2) and the MOU require the requesting agency to provide the “address of the taxpayer,” 26 U.S.C. § 6103(i)(2)(B)(i); DHS-ICE MOU 3 (App. 360), the Data-Exchange Procedure merely checks whether ICE supplied five or nine digits—any random five or nine digits—in the address field within its request, DHS-ICE Data Exchange Overview 1 (App. 462); Romo Decl. ¶¶ 6, 13. To trigger IRS disclosure of tax return information under the Data-Exchange Procedure, the five- or nine-digit number need not even be an actual zip code, nor does ICE need to have provided any other information, such as a street name, unit number, city, or state. DHS-ICE Data Exchange Overview 1 (App. 462); Romo Decl. ¶ 13. And, although section 6103(i)(2) permits the IRS to disclose information only to “officers and employees of [the requesting] agency who are personally and directly engaged in” a qualifying criminal investigation or proceeding, 26 U.S.C. § 6103(i)(2)(A), the Data-Exchange Procedure requires no more than that the ICE

7

point of contact field “not be empty[,]” DHS-ICE Data Exchange Overview 1 (App. 462). It thus fails to ensure that the field contains a name, let alone the name of an ICE employee responsible for a particular criminal investigation.

The Data-Exchange Procedure includes two methods for the IRS to use after the preprocessing check to cull and provide data to ICE.

First, the IRS checks whether ICE provided a Tax Identification Number (TIN)—either a Social Security Number (SSN) or an Individual Taxpayer Identification Number (ITIN)—for the request. If ICE provided a TIN, the IRS runs a search for that number in its internal database. DHS-ICE Data Exchange Overview 1-2 (App. 462-63); Romo Decl. ¶ 8(a). If it finds the TIN in its records, the IRS then provides ICE with its most recent address information corresponding to the requested TIN, without regard to whether ICE supplied an address in its request. See DHS-ICE Data Exchange Overview 1-3 (App. 462-64); Romo Decl. ¶ 13 (confirming that the IRS “provided last known addresses to ICE in instances in which the ICE-supplied address field . . . was either incomplete or insufficiently populated”).

Second, if the ICE request lacks a TIN, the IRS uses the name and address information provided by ICE to run a search of its records for an individual whose name and past or present address match the information provided by ICE. DHS-ICE Data Exchange Overview 1-2 (App. 462-63). (The second method, unlike the first, returns a result only if ICE supplies a complete, matching address in its request.) Finally, the IRS compiles the outputs of both methods and supplies the results to ICE. DHS-ICE Data Exchange Overview 3 (App. 464).

Using the Data-Exchange Procedure, IRS has so far identified and disclosed 47,289 records to ICE. Romo Decl.

8

¶ 10. More than 90% of the records were produced via the TIN-matching method, id., meaning that the IRS never confirmed whether the ICE request contained information plausibly reflecting “the name and address of the taxpayer,” 26 U.S.C. § 6103(i)(2)(B)(i).

C.

Plaintiffs—the Center for Taxpayer Rights (the Center), Main Street Alliance, and two labor unions—filed suit against the IRS and a host of federal officials. Plaintiffs claimed that the IRS unlawfully adopted a new policy governing disclosure of return information to ICE, and they sought to “stay the implementation” of that new policy. Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 18, 71. The IRS denied having adopted any new policy. Id. at 40.

The district court made a factual finding that, “‘[a]lthough the details of the [IRS’s] disclosure policy are still unclear, the record leaves no doubt the [IRS] has a policy of disclosing confidential information’ to ICE in a manner that it has not previously been disclosed.” Id. at 40-41 (modifications in original) (quoting Venetian Casino Resort, L.L.C. v. Equal Emp. Opportunity Comm’n, 530 F.3d 925, 929-30 (D.C. Cir. 2008)). The district court concluded that plaintiffs were likely to succeed in demonstrating that the new policy is unlawful, id. at 45-58; that the new policy threatens to irreparably injure plaintiffs, id. at 58-68; and that the equities support preliminarily relief against the new policy and its further implementation, id. at 68-72. The court entered an order staying the policy under 5 U.S.C. § 705, preliminarily enjoining defendants from disclosing taxpayer information “except in strict compliance with the requirements of” section 6103(i)(2), and requiring defendants to inform the court before responding to any future request from the Department of

9

Homeland Security for taxpayer information. Order of Nov. 21, 2025 (App. 1828-29).

The IRS appealed. After the district court transmitted the record to this court, the IRS filed in district court a supplemental declaration by its Chief Risk and Control Officer (the Romo Declaration) explaining that the IRS had “determined that it provided last known addresses to ICE in instances in which” ICE’s request contained address information for noncitizens that was “either incomplete or insufficient[]”—i.e. that the IRS had provided information in response to ICE requests that apparently did not meet statutory preconditions to disclosure. Romo Decl. ¶¶ 1, 11-14. Plaintiffs moved in this court for a limited remand so the district court could supplement the record on appeal with the Romo Declaration and consider the appropriateness of additional discovery. Dkt. No. 2161752 at 1-2. A motions panel of our court referred that motion to the merits panel. Dkt. No. 2166493 at 1.

II.

A plaintiff seeking preliminary relief “must establish [1] that he is likely to succeed on the merits, [2] that he is likely to suffer irreparable harm in the absence of preliminary relief, [3] that the balance of equities tips in his favor, and [4] that an injunction is in the public interest.” Winter v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 20 (2008). On appeal, we review for abuse of discretion the district court’s decision to order preliminary relief, “although we review the court’s underlying legal conclusions de novo and factual findings for clear error.” Atlas Air, Inc. v. Int’l Bhd. of Teamsters, 928 F.3d 1102, 1112 (D.C. Cir. 2019).

Pursuant to Federal Rule of Appellate Procedure 10(e)(2), and based on the parties’ agreement, Oral Arg. Tr. 5:5-14, 49:3-

10

11, we accept the proffered Romo Declaration as a supplement to the record on appeal. We accordingly dismiss as moot plaintiffs’ motion for a limited remand.

III.

Because plaintiffs establish that they are likely to succeed on the merits and the remaining equitable factors support preliminary relief, we affirm the district court’s order.

A.

We begin with standing. At least one plaintiff, the Center for Taxpayer Rights, is likely to succeed in establishing standing.

Organizations “have standing ‘to sue on their own behalf for injuries they have sustained’” so long as they “satisfy the usual standards for injury in fact, causation, and redressability.” Food & Drug Admin. v. All. for Hippocratic Med., 602 U.S. 367, 393-94 (2024) (quoting Havens Realty Corp. v. Coleman, 455 U.S. 363, 379 n. 19 (1982)). “To demonstrate injury in fact, an organization must allege a ‘concrete and demonstrable injury to the organization’s activities’ that is ‘more than simply a setback to the organization’s abstract social interests.’” Am. Anti-Vivisection Soc’y v. U.S. Dep’t of Agric., 946 F.3d 615, 618 (D.C. Cir. 2020) (quoting Havens Realty, 455 U.S. at 379). And causation is shown where new activities, not previously part of the organization’s “normal annual expenditures,” “became necessary” in response to the injury, causing a “drain on the organization’s resources.” Id. at 619 (quoting Havens Realty, 455 U.S. at 379). The Center has made those showings.

The Center has identified several ways in which the Data-

Exchange Procedure harms its interests, which include

11

“advancing taxpayer rights,” “promoting trust in the tax system,” and “increasing access to justice in the tax system.” Olson Decl. ¶ 3 (App. 168); see Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 28. The Center’s Executive Director attests that reporting on “IRS’s new policy” has made many immigrant taxpayers “less willing to come to the Center’s events, to seek its guidance, or to engage with the Center’s education and outreach.” Olson Decl. ¶ 41 (App. 178). And the Center’s pro bono tax clinic has seen a “drastic” reduction of cases involving taxpayers who lack social security numbers because potential clients “fear . . . having their current status or location shared with [the Department of Homeland Security]/ICE.” Id. ¶¶ 42, 44 (App. 179).

The IRS responds that the Center’s injury is not cognizable because it “depends upon the independent choices of third parties” who have “chosen to engage less with the Center.” IRS Br. 26. But an injury may be premised “on the predictable effect of Government action on the decisions of third parties.” Dep’t of Com. v. New York, 588 U.S. 752, 768 (2019) (reasoning that a citizenship question on the Census will predictably depress Census participation rates in immigrant communities). The district court reasonably found that many taxpayers “are no longer willing to engage with the Center due to the IRS’s” new policy and that the policy “has interfered with the Center’s ability to provide its pro bono or nominal fee representation services.” Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 29.

The Center has also established that it is “divert[ing] and redirect[ing] its limited resources to counteract and offset” the effects of the IRS’s policy. People for the Ethical Treatment of Animals (PETA) v. U.S. Dep’t of Agric., 797 F.3d 1087, 1095 (D.C. Cir. 2015). The Center’s Executive Director attests that the Center has increased staffing “to focus on education and

12

outreach in light of the reduced trust in the tax system engendered by the IRS’s policy change” and has reallocated “nearly 10 percent” of the tax clinic’s operating expenses to increase client outreach. Olson Decl. ¶¶ 45-46 (App. 179-80); see Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 29. That is sufficient to demonstrate the Center’s likely standing. See, e.g., Am. Anti-Vivisection Soc’y, 946 F.3d at 619.

The IRS insists that the Center may not “spend its way into standing.” IRS Br. 24 (quoting All. for Hippocratic Med., 602 U.S. at 394). It is true that an organization may not establish standing simply by spending money “opposing those policies” that it “dislike[s].” All. for Hippocratic Med., 602 U.S. at 395. But where, as here, a government action “directly affect[s] and interfere[s] with” an organization’s “core business activities,” and the organization “diverted its resources” to continue pursuing those activities, such concrete harm to the organization’s activities supports standing to sue. Id. (discussing Havens Realty, 455 U.S. at 379); cf. Pierce v. Soc’y of Sisters, 268 U.S. 510, 533 (1925) (private school could challenge compulsory public-school attendance law based on its “business . . . being destroyed and its property depreciated [and] parents and guardians . . . refusing to make contracts for the future instruction of their sons”).

Because we hold that the Center has made a “‘clear showing’ that [it] is ‘likely’ to establish each element of standing,” Murthy v. Missouri, 603 U.S. 43, 58 (2024) (quoting Winter, 555 U.S. at 22), we need not address whether any other plaintiff is likely to demonstrate standing.

B.

Next, the IRS argues that the Data-Exchange Procedure is not subject to APA review because it is not final agency action.

13

IRS Br. 36 (citing 5 U.S.C. § 704). We conclude that plaintiffs are likely to succeed in showing that the IRS took final action.

An action is “final” under the APA if (1) it “mark[s] the consummation of the agency’s decisionmaking process” and (2) “rights or obligations have been determined” by it or “legal consequences will flow” from it. U.S. Army Corps of Eng’rs v. Hawkes Co., 578 U.S. 590, 597 (2016) (quoting Bennett v. Spear, 520 U.S. 154, 177-78 (1997)).

According to the IRS, the agency’s “only practice” is to follow the terms of the MOU, which, in turn, merely require the agency “to comply with § 6103(i)(2)’s disclosure requirements.” IRS Br. 38. Further, the IRS contends, the administrative record lacks an “agency statement pertaining to” the Data-Exchange Procedure. Id. Lastly, the IRS argues that following the MOU does not cause plaintiffs “direct and appreciable legal consequences.” Id. at 39 (quoting Hawkes, 578 U.S. at 598).

None of those arguments holds up. The administrative record amply documents the existence of the Data-Exchange Procedure—an IRS policy for acting on taxpayer-information requests under the MOU. That concededly statutorily deficient process gives binding direction to IRS officials responding to ICE requests. We accordingly hold that the Data-Exchange Procedure is final agency action reviewable under the APA.

1.

Considerable evidence in the administrative record shows that the Data-Exchange Procedure marks the consummation and implementation of the IRS’s decision-making process on how it discloses taxpayer information to ICE under the MOU.

14

First, the Data-Exchange Procedure is laid out in a final, written document in the administrative record that prescribes the steps of the process that IRS officials will follow to implement the MOU and have already used to respond to requests for information on at least 1.28 million taxpayers. DHS-ICE Data Exchange Overview 1-4 (App. 462-65). There is nothing “tentative or interlocutory” about it. Bennett, 520 U.S. at 178. The IRS also published multiple illustrated flowcharts in a Guidance Document for use by agency officials that further explain the Procedure. DHS-ICE Data Exchange Guidance Document 1-5 (App. 473-77).

The Data-Exchange Procedure begins when the “IRS receives [an] input file from DHS” via the specified software system. DHS-ICE Data Exchange Overview 1 (App. 462). The Procedure then details a “[p]reprocessing task” followed by either a “[TIN]-Based Lookup” or “Name & Address-Based Processing.” DHS-ICE Data Exchange Overview 1-2 (App. 462-63); see Romo Decl. ¶ 8(a) (confirming that TINs, including but not limited to SSNs and ITINs, were used to match records). Two data sheets are formulated: one that is used for an internal review and check of results, and the second prepared for release to ICE. DHS-ICE Data Exchange Overview 3 (App. 464). After the internal review, a final data sheet is released to ICE. DHS-ICE Data Exchange Overview 3 (App. 464). Both IRS files are then “stored in a secure archival location.” DHS-ICE Data Exchange Overview 3 (App. 464).

The agency has not only finalized the process but has also used it to make disclosures. Ms. Romo has attested that this Data-Exchange Procedure was used to process at least 1.28 million ICE requests in August 2025. Romo Decl. ¶ 6 (citing the Data-Exchange Procedure as the one used “to ensure compliance with Section 6103 of the Tax Code and the MOU”

15

once the IRS is in “receipt of ICE’s letter and Datafile”); id. ¶ 8 (citing the same and confirming that the IRS matched records using either the taxpayer’s TIN or “[a]ddress [m]atching”); id. ¶ 10 (describing request volume).

Use of the Data-Exchange Procedure by IRS personnel is not optional. The Treasury’s Deputy General Counsel gave the go-ahead to the IRS to “begin processing and sharing information back to ICE.” “Letter from ICE” Emails 5 (App. 444); see also “Letter from ICE” 1 (App. 440) (email from IRS Deputy Chief Counsel directing IRS to “begin processing the request . . . and sharing information back to ICE”). The Procedure effectuates that command by prescribing what “will” happen upon receipt of an ICE request for taxpayer information. DHS-ICE Data Exchange Overview 1-3 (App. 462-64); see also “DHS Notes for Briefing” Email 1 (App. 472) (noting that by following the Data-Exchange Procedure “script,” “IRS will share matches, unmatched, and rejects . . . to ICE”). The IRS’s lawyers describe the Procedure as “IRS’s computerized process for validating ICE requests.” IRS Reply Br. 12. They further “confirm that IRS followed that process when responding to ICE’s request in August 2025,” id. See Biden v. Texas, 597 U.S. 785, 795, 807-09 & n.7 (2022) (holding that an informal four-page memorandum issued by the Secretary of the Department of Homeland Security announcing the termination of the Migrant Protection Protocols was final agency action when it created “employee[] obligations” to implement the termination).

The Data-Exchange Procedure was not formally noticed or published, but that is not a prerequisite for final agency action. See Her Majesty the Queen in Right of Ontario v. EPA, 912 F.2d 1525, 1531 (D.C. Cir. 1990) (“[T]he absence of a formal statement of the agency’s position, as here, is not dispositive: An agency may not, for example, avoid judicial review ‘merely

16

by choosing the form of a letter to express its definitive position on a general question of statutory interpretation.’” (quoting Ciba-Geigy Corp. v. EPA, 801 F.2d 430, 438 n.9 (D.C. Cir. 1986))); Barrick Goldstrike Mines Inc. v. Browner, 215 F.3d 45, 48 (D.C. Cir. 2000) (“[W]e [have] rejected the proposition that if an agency labels its action an ‘informal’ guideline it may thereby escape judicial review under the APA.”).

The IRS argues that the agency’s “only practice in this respect, consistent with the MOU, is to comply with § 6103(i)(2)’s disclosure requirements . . . as the statute requires.” IRS Br. 38; Oral Arg. Tr. 16:23-25 (arguing that the Data-Exchange Procedure is not final agency action because it “simply reflects the agency’s views of what it is allowed to do under the law”).

There are two fatal flaws in that argument. First, the Romo Declaration—which the IRS itself filed with the district court—refutes the contention that there is some other procedure in place for processing ICE information requests that hews to the requirements and limitations of section 6103. The Declaration confirms that the IRS employed the Data- Exchange Procedure in responding to at least 1.28 million individual requests for information about listed taxpayers. Romo Decl. ¶¶ 10, 13; see Excerpts of ICE Requests 1-6 (App. 434-39). And the Romo Declaration candidly acknowledges that the Procedure operated as laid out in the Overview and accompanying illustrated guidance by “provid[ing] last known addresses to ICE” even when the address field “was either incomplete or insufficiently populated.” Romo Decl. ¶ 13. The policy thereby requires official action in direct violation of section 6103(i)(2) and the MOU. 26 U.S.C. § 6103(i)(2)(B)(i); DHS-ICE MOU 2 (App. 359) (MOU commitment that IRS will “return to ICE any requests not meeting the requirements necessary for disclosure pursuant to IRC § 6103(i)(2)”).

17

Second, the record contradicts the IRS’s argument that the Data-Exchange Procedure is just a statement of the agency’s view of what the law means. The enumerated steps of the Procedure demonstrate that it is the actual, on-the-ground policy. The IRS has used it to produce 47,289 individual records for ICE, Romo Decl. ¶¶ 10, 12, largely through a process that failed to ensure compliance with the statute and the MOU, see id. ¶¶ 10, 13 (for 90.3% of the matches IRS produced to ICE, the Data-Exchange Procedure failed to check whether ICE provided a valid address); Oral Arg. Tr. 9:1-3 (acknowledging that the implementation of the Data-Exchange Procedure resulted in “concededly unlawful” transfers); id. at 9:10-11 (same); see also Section III.D, infra. When an agency implements a policy choice, putting it into motion in a way that leads to concrete results and prescribes consequences, it takes final agency action. See Biden, 597 U.S. at 809-10 (holding that “an ‘agency statement . . . designed to implement, interpret, or prescribe law or policy’” is reviewable (modification in original) (quoting 5 U.S.C. § 551(4)); Lujan v. Nat’l Wildlife Fed’n, 497 U.S. 871, 890 n.2 (1990) (explaining that when an agency “appl[ies] some particular measure across the board to all” affected persons, that action “can of course be challenged under the APA”).

The Data-Exchange Procedure is the type of “operative agency action[],” Biden, 597 U.S. at 810, that qualifies as final because it makes concrete the agency’s policy decision to allow disclosures of confidential taxpayer information on specified terms. Diverging significantly from the requirements of section 6103(i)(2), the Procedure requires the IRS to return taxpayer data to ICE even when ICE fails to provide the taxpayer’s address as required by law and the MOU. As long as ICE offers any random five or nine digits in the “address” field of its request, the Data-Exchange Procedure validates the request and generates the taxpayer’s information to provide to

18

ICE. DHS-ICE Data Exchange Overview 1-2 (App. 462-63) (only requiring that ICE-provided address field “not be empty” and “contain zip code”); Romo Decl. ¶¶ 6, 13 (acknowledging that the Data-Exchange Procedure accepted any five- or nine- digit number as a “proxy” for a zip code and did not require the provision of any other address information); Oral Arg. Tr. 24:23-24 (“[T]he thinking was . . . that [the number] would serve as an accurate proxy.”); see also Ctr. for Taxpayer Rts. v. Internal Revenue Serv., No. 25-cv-457, 2026 WL 551105, at *3 (D.D.C. Feb. 26, 2026) (“A zip code is not an address, and a zip code proxy, as the IRS would define it, might as well be a set of random numbers. For instance, ICE could have submitted a request with an ‘address’ like, ‘Don’t Care 12345,’ or, ‘00000,’ and still received a taxpayer’s address through the IRS’s TIN Matching process.”). The IRS’s operative policy to provide information on those terms flies in the face of the statutory command that the IRS share return information only when the requesting agency provides “the name and address of the taxpayer with respect to whom the requested return information relates.” 26 U.S.C. § 6103(i)(2)(A), (B)(i) (emphasis added).

Presumably that is why counsel for IRS candidly conceded that the Data-Exchange Procedure does not comply with the requirements of section 6103(i)(2) or the MOU. See Oral Arg. Tr. 15:17-19 (“With respect to the extent [the Data-Exchange Procedure] doesn’t require an address, it’s an error in implementing the policy [as previously laid out in the MOU].”); id. at 28:11-13 (“[T]he Government would readily admit that there were mistakes made[,] that some information was disclosed not in compliance with the statute.”). While the MOU merely tracked the language and bounds of section 6103(i)(2), see Centro de Trabajadores Unidos, 167 F.4th at 1236, the Data-Exchange Procedure veers off that course. Such an “unannounced departure in practice from a written

19

[policy]” is reviewable final agency action. Hisp. Affs. Project v. Acosta, 901 F.3d 378, 387 (D.C. Cir. 2018); Immigr. Nat’y Serv. v. Yueh-Shaio Yang, 519 U.S. 26, 32 (1996) (an agency’s “irrational departure from [a] policy (as opposed to an avowed alteration of it) could constitute action . . . within the meaning of the [APA]”).

The Data-Exchange Procedure also represents a dramatic change in agency policy from individualized review of records submitted under section 6103(i)(2) to a mass, automated review of millions of records at the press of a button. Before April 17, 2025, the IRS’s Internal Revenue Manual provided detailed instructions for IRS “Disclosure Managers” to process individual records requested under section 6103(i)(2). IRM 11.3.28.2 (July 23, 2018). That process included contacting the requesting official assigned to the individual criminal case (“usually the Assistant United States Attorney”) to “[i]nquire” about the relevant court date and to “[d]iscuss alternative” disclosure options that would be less intrusive on confidentiality, such as “offering a transcript in lieu of a return.” Id. Further, the “Disclosure caseworker” was required to “review all releases of documents” to make sure that only material covered by section 6103(i)(2) was released to the U.S. Attorney’s Office. Id.

That is a far cry from the current Data-Exchange Procedure, which automates the review of millions of records without any individual review or any other means of ensuring compliance with the legal prerequisites to releasing each individual taxpayer’s information. See DHS-ICE Data Exchange Overview 1-4 (App. 462-65). Such a substantial and material change in policy is yet another indication that the Procedure is final agency action. See Nat’l Env’t Dev. Ass’n’s Clean Air Project v. EPA, 752 F.3d 999, 1007 (D.C. Cir. 2014) (“If an agency action announces a binding change in

20

its . . . policy which immediately affects the rights and obligations of regulated parties, then the action is likely final and subject to review.”).

Finally, the record shows that the Data-Exchange Procedure will be applied on an ongoing basis. The IRS’s illustrated guidance document explaining the Data-Exchange Procedure calls it an “[o]n demand process,” underscoring that it can and will be used whenever ICE sends data requests to the IRS going forward. DHS-ICE Data Exchange Guidance Document 1 (App. 473). And a few pages later, that document includes a list of “Discussion points,” including “volume & frequency of the data we are expecting.” DHS-ICE Data Exchange Guidance Document 4-5 (App. 476-77). The fact that the IRS was having either internal discussions or strategic planning sessions with ICE discussing the “volume” and “frequency” of expected incoming requests further demonstrates that the Data-Exchange Procedure was designed for continued use.

Importantly, the IRS has indicated that the Data-Exchange Procedure remains operational with, at best, the possibility of unknown adjustments. See Oral Arg. Tr. 46:17-20 (IRS Counsel: “What action IRS has since taken to remedy the error, I can only speculate. I’m not aware of what, if any, action IRS has done to correct the [error].”); id. at 47:14-16 (IRS Counsel: “As far as changing the computer process, I can only speculate what’s happened.”); id. at 48:19-20 (IRS Counsel: “I’m not aware of what action IRS has taken” to fix the Data-Exchange Procedure). In any event, “[t]he mere possibility that an agency might reconsider [its action] in light of ‘informal discussion’ and invited contentions of inaccuracy [from regulated parties] does not suffice to make an otherwise final agency action nonfinal.” Sackett v. EPA, 566 U.S. 120, 127 (2012).

21

For those reasons, the IRS’s formal Data-Exchange Procedure, as written and implemented, constitutes the consummation of the agency’s decision making on how it will share—and has shared—confidential taxpayer information with ICE.

2.

The Data-Exchange Procedure is also an agency action “by which ‘rights or obligations have been determined.’” Bennett, 520 U.S. at 178 (quoting Port of Boston Marine Terminal Ass’n v. Rederiaktiebolaget Transatlantic, 400 U.S. 62, 71 (1970)).

An agency action carries “direct and appreciable legal consequences” sufficient to render it final when it imposes new restrictions or obligations on government officials. Id. For example, the Court in Bennett held that the Secretary of the Interior took final action when he issued an opinion that “authoriz[ed another agency] to take [an] endangered species if (but only if) it complies with the prescribed conditions.” Id. The Secretary’s opinion “alter[ed] the legal regime to which the [other] agency is subject,” and accordingly was final agency action. Id.

Applying that precedent, we have held that EPA guidance was final when it “altered the legal regime by resolving” a question about states’ obligations under the Clean Air Act. See Nat. Res. Def. Council v. EPA, 643 F.3d 311, 320 (D.C. Cir. 2011). Before the guidance, EPA regional directors “retained discretion” to reject certain state proposals “solely for failing to comply with” the statute, without considering whether a state’s alternative, “not less stringent” program satisfied the statute. Id. at 319. The guidance removed that discretion, directing that states’ alternatives be considered, thereby “bind[ing] EPA regional directors and thus qualif[ying] as final

22

agency action.” Id. at 320 (citing Bennett, 520 U.S. at 177-78). By the same token, in Center for Auto Safety v. National Highway Traffic Safety Administration, we concluded that the agency’s guidelines did not determine rights or obligations, and thus were not final agency action, because the agency “has not commanded, required, ordered, or dictated” that “officials in [the National Highway Traffic Safety Administration’s] Office of Defects Investigation are bound to apply the guidelines”— nor did any evidence indicate that the agency had so bound itself. 452 F.3d 798, 808-09 (D.C. Cir. 2006).

The Data-Exchange Procedure is final because it binds IRS officials. It “alter[s] the legal regime” to which the IRS’s processing of ICE return-information requests “is subject.” Bennett, 520 U.S. at 178. Specifically, the Procedure sets out the conditions under which IRS employees are required to transfer confidential taxpayer data to ICE. See DHS-ICE Data Exchange Overview 1-4 (App. 462-65). And it removes IRS employees’ discretion to reject a request for failure to meet certain statutory requirements. From July to August 2025, the IRS developed the Data-Exchange Procedure and then started using it in determining whether to respond to ICE requests concerning 1.28 million taxpayers. See IRS Correspondence Emails and Teams Meetings (App. 456-61, 468-71, 78); Romo Decl. ¶ 10.

Finally, the Data-Exchange Procedure reduces noncitizens’ privacy rights in their tax returns. By providing a distinct, automated pathway for ICE to request noncitizens’ information, the Data-Exchange Procedure deprives noncitizens of the protections that section 6103 guarantees to all taxpayers.

23

* * *

Because the Data-Exchange Procedure marks the consummation of the IRS’s decision to turn over confidential taxpayer information to ICE, and because legal consequences flow from it, the Data-Exchange Procedure is final agency action that is reviewable under the APA.

C.

The IRS contends that the Internal Revenue Code implicitly precludes APA review because the Code expressly provides for civil damages for certain failures to comply with section 6103 and even authorizes criminal charges for willful violations. See IRS Br. 42 (asserting that APA claims are precluded by the Code’s “comprehensive remedial scheme for violations of 26 U.S.C. § 6103”). The APA supplies a cause of action for plaintiffs to challenge “final agency action for which there is no other adequate remedy in a court.” 5 U.S.C. § 704. If another statute creates a “special and adequate review procedure” for particular agency actions, that alternative scheme “oust[s] a district court of its normal jurisdiction under the APA.” Bowen v. Massachusetts, 487 U.S. 879, 904 (1988). But a statute that provides only “doubtful and limited relief” has no such effect, so cannot be read to displace the APA by implication. Id. at 901.

The provisions that the IRS identifies in the Internal Revenue Code offer only “doubtful and limited” relief, inadequate to remedy the harm plaintiffs here claim. Id. The Code provides no mechanism to review, set aside, or enjoin IRS policies implementing section 6103. It provides a claim against the United States only for actual damages if “any officer or employee of the United States knowingly, or by reason of negligence, inspects or discloses any return or return information . . . in violation of . . . section 6103,” and punitive

24

damages for willful disclosures or disclosures due to gross negligence. 26 U.S.C. § 7431(a)(1), (c)(1)(B)(ii). It also authorizes the United States to press a felony charge against any “officer or employee of the United States” who “willfully . . . disclose[s]” return information in violation of section 6103. Id. § 7213(a)(1). But neither of the Internal Revenue Code consequences that the IRS identifies holds the agency itself accountable for unlawful official actions or “would provide plaintiffs anything like the relief they seek,” Humane Soc’y of the U.S. v. Vilsack, 797 F.3d 4, 11 (D.C. Cir. 2015), so neither precludes application of the APA.

No other evidence indicates that Congress sought to exempt the IRS from ordinary APA review. “When considering whether an alternative remedy is ‘adequate’ and therefore preclusive of APA review, we look for ‘clear and convincing evidence’ of ‘legislative intent’ to create a special, alternative remedy and thereby bar APA review.” Citizens for Resp. & Ethics in Washington (CREW) v. U.S. Dep’t of Just., 846 F.3d 1235, 1244 (D.C. Cir. 2017) (quoting Garcia v. Vilsack, 563 F.3d 519, 523 (D.C. Cir. 2009)). We decline to conclude that Congress, by attaching criminal and civil consequences to individual employees’ violations of section 6103, meant to bar APA review of IRS policies implementing the section. If anything, the criminal and civil penalties in the Code underscore Congress’s seriousness about the confidentiality of taxpayer information. They do not substitute for APA review of IRS policies. See Tierney v. Schweiker, 718 F.2d 449, 457 (D.C. Cir. 1983) (“The availability of a $1,000 damage remedy after the information is released fails to protect [taxpayers’] right to confidentiality.”). Given that plaintiffs here can access no statutory remedy “of the same genre” as APA review, they may bring suit under the APA. El Rio Santa Cruz Neighborhood Health Ctr., Inc. v. U.S. Dep’t of Health and Hum. Servs., 396 F.3d 1265, 1275 (D.C. Cir. 2005)

25

(quoting Women’s Equity Action League v. Cavazos, 906 F.2d 742, 751 (D.C. Cir. 1990)).

D.

Having dispensed with threshold issues, we turn to the merits. The Center is likely to succeed in demonstrating that the Data-Exchange Procedure is contrary to law. 5 U.S.C. § 706(2)(A).

The Data-Exchange Procedure indisputably contravenes the requirements of section 6103. Most egregiously, section 6103(i)(2) expressly requires a requesting agency to provide the “address of the taxpayer” whose information the agency seeks, 26 U.S.C. § 6103(i)(2)(B)(i), but the Data-Exchange Procedure does not require ICE to submit any address of the taxpayer in its request for information about that taxpayer, DHS-ICE Data Exchange Overview 1 (App. 462). The Procedure requires only that the IRS provide some five- or nine-digit number in the address field. See Romo Decl. ¶ 13.

Under the Data-Exchange Procedure, the IRS has produced individual taxpayer records—including last known addresses—in response to ICE requests listing an address as “Unknown Address,” “Failed to Provide,” or “NA NA.” Id. IRS also produced records in response to ICE requests providing a partial address lacking critical information, such as “a street name or street number.” Id. Those IRS disclosures establish that the Data-Exchange Procedure contravenes section 6103(i)(2), as counsel for IRS acknowledged at oral argument. Oral Arg. Tr. 8:19-9:3, 9:10-11.

Next, the Data-Exchange Procedure fails to implement the statutory requirement that the IRS disclose responsive information about a taxpayer only to individuals “personally and directly engaged” in the qualifying criminal proceeding or

26

investigation concerning that taxpayer. 26 U.S.C. § 6103(i)(2)(A). The Data-Exchange Procedure calls for ICE’s taxpayer-information requests to include a “point of contact field” indicating “the identity of the officer(s) and/or employe(es) [sic] who are personally and directly engaged in the criminal proceeding or criminal investigation” concerning that taxpayer. Lyons Letter 1 (App. 326); see DHS-ICE Data Exchange Overview 1, 4 (App. 462, 465) (requiring each ICE request to contain an “ICE-POC” field). But the Procedure validates a request so long as the ICE point of contact field is “not [] empty.” DHS-ICE Data Exchange Overview 1 (App. 462). The Procedure thus requires the IRS to respond to a request even if ICE lists the point of contact as “Unknown” or “TBD.” It entirely fails to ensure that ICE lists a federal employee, let alone one “personally and directly engaged” in a qualifying investigation of a particular taxpayer.

That failure has serious consequences. When ICE requested information on 1.28 million taxpayers in the summer of 2025, ICE identified the same person as the point of contact for every single request. Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 46. The district court found it facially implausible “that a single individual could be ‘personally and directly engaged’ in approximately 47,000 criminal matters” against taxpayers whose information the IRS supplied, “let alone 1.28 million of them” against all the taxpayers whose information ICE sought. Id. at 48. Citing ICE’s early-June 2025 requests for information on “the full alien population” of more than 7 million people that ICE asserted had improperly entered the United States, and its requests later that month for information on more than 1 million people whom ICE asserted had stayed more than 90 days after a removal order, the district court found it “unreasonable to think that, in one month, the same Assistant Director could be ‘personally and directly engaged’ in 7.6 million criminal matters under one statute and 1.2 million

27

criminal matters under another.” Id. at 66. Assessing those assertions together with the government’s acknowledgement that ICE sought the information to support the White House’s mass deportation agenda, the district court concluded that the record “raises an inference that ICE’s representation that it is conducting criminal investigations under 8 U.S.C. § 1253(a)(1) was pretext.” Id. at 66-67.

The IRS advances one theory of how a single ICE officer might oversee so many investigations: It asserts that an officer can easily screen the IRS disclosures to determine “whether and how many of [the 1.28 million targeted individuals] are present in the United States at times after issuance of the removal order in violation of the criminal statute.” IRS Br. 55 (emphasis added). But that theory is a nonstarter. The lone ICE officer who purportedly handles the mass investigation cannot simply compare the date of the final order to the date of the IRS’s last known address. Under the Data-Exchange Procedure, IRS does not disclose a date for the address information it supplies to ICE. It provides only the “IRS last known address.” DHS-ICE Data Exchange Overview 3 (App. 464); see Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 49, 54. The Procedure thus likely caused IRS to violate section 6103(i)(2)(A) and systematically will cause IRS to continue to ignore that statutory requirement.

Plaintiffs identify still more ways in which the IRS’s disclosures under the Data-Exchange Procedure were likely illegal. For one, plaintiffs explain that the IRS failed to require ICE to provide a “specific reason” why the requested return information “is or may be relevant to [a qualifying] proceeding or investigation,” as the statute demands. Appellees’ Br. 45-46 (quoting 26 U.S.C. § 6103(i)(2)(B)(iv)). The IRS accepted a cover letter accompanying a batch of 1.28 million requests from ICE that merely stated that “the reason why each

28

requested disclosure is[] or may be[] relevant to such proceeding or investigation is that the requested information may contain address information which is potentially at issue with respect to investigating or proving a violation under 8 U.S.C. § 1253(a)(1).” Lyons Letter 1 (App. 326). It beggars belief to call that vague, unbounded reasoning “specific.” See Specific (2a), Merriam-Webster, https://www.merriamwebster .com/dictionary/specific [https://perma.cc/BS86- MSLZ] (“restricted to a particular individual [or] situation”). The plain text of the statute requires, at a minimum, that the requesting agency offer a theory of the relevance of the requested information to the qualifying proceeding or investigation. ICE instead offered a reason “more circular than specific,” Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 54, and the IRS flouted its own statutory obligation when it accepted that facially non-specific “reason” as sufficient to enable it to provide information pursuant to ICE’s requests.

It remains unclear whether the IRS’s failure to demand a specific reason is a one-time result of the IRS’s approval of Director Lyons’s June 27, 2025, cover letter or a persistent feature of the Data-Exchange Procedure. See “Letter from ICE” Emails 1 (App. 440) (IRS determination that the Lyons Letter “satisfies the written request provisions in the MOU and meets the requirements of the statute”). We need not resolve that question at this preliminary stage: The Procedure continues to govern the IRS’s response to ICE requests and clearly violates section 6103(i)(2) in at least two other ways already discussed, so plaintiffs have established that they are likely to succeed on the merits of their APA challenge.

The IRS is now on notice twice over regarding the legal inadequacies of its summer 2025 disclosures. The government and its personnel face steep civil and criminal consequences for willful disclosure of information in violation of section 6103.

29

26 U.S.C. §§ 7213(a)(1), 7431(c)(1). As this court has already cautioned, “we expect that, going forward, [the] IRS will adhere to the representations made before this court regarding the address requirement,” and we stress that the same applies to the other requirements of section 6103. Centro de Trabajadores Unidos, 167 F.4th at 1232.

E.

Turning to the remainder of the Winter factors, we conclude that the district court acted within its sound discretion when it issued preliminary relief.

Plaintiffs have demonstrated “a likelihood of irreparable injury.” League of Women Voters v. Newby, 838 F.3d 1, 8-9 (D.C. Cir. 2016) (citing Winter, 555 U.S. at 22). A threatened injury is irreparable if it is “‘certain and great,’ ‘actual and not theoretical,’” and “beyond remediation” at a later date. Id. at 7-8 (quoting Chaplaincy of Full Gospel Churches v. England, 454 F.3d 290, 297 (D.C. Cir. 2006)). An organization faces irreparable harm when it sues to challenge “new obstacles [that] unquestionably make it more difficult for the [organization] to accomplish [its] primary mission” in circumstances where “there can be no do over and no redress.” Id. at 9 (quoting League of Women Voters of N.C. v. North Carolina, 769 F.3d 224, 247 (4th Cir. 2014)). For example, we have held that a voter education and mobilization organization suffers irreparable harm when state law hinders its ability to register voters in the run-up to an election deadline. See id. at 8-9.

As binding law defines it, the injury the Center claims is irreparable. The Center carries out its mission by representing low-income taxpayers in tax proceedings with strict deadlines. See Olson Decl. ¶¶ 83-89 (App. 189-92); Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 59. Just as there are no do-overs for

30

voters entitled to participate in elections, there are none for the Center’s taxpayer-clients who face IRS deadlines. If the Center fails to engage a potential client in time, it may permanently lose the opportunity to help that person obtain relief. The district court found that the Center has provided sufficient evidence, at this stage of the litigation, to show that the Data- Exchange Procedure hinders its ability to provide timesensitive services. Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 59. In addition, the district court found that the Data-Exchange Procedure created a serious threat to the Center’s work. Id. at 59-60; see Olson Decl. ¶ 52 (App. 182) (“We cannot fulfill our mission if we cannot reach the communities we serve . . . . An extended period of mass data sharing with ICE is very likely to permanently obstruct the Center’s ability to accomplish its mission.”). And the IRS has identified no reason to think that the district court clearly erred in either assessment.

The remaining preliminary injunction factors—the balance of equities and the public interest—“merge when the Government is the opposing party.” Nken v. Holder, 556 U.S. 418, 435 (2009). “[T]here is a substantial public interest in having governmental agencies abide by the federal laws that govern their existence and operations.” Newby, 838 F.3d at 12 (quoting Washington v. Reno, 35 F.3d 1093, 1103 (6th Cir. 1994)). In contrast, “[t]here is generally no public interest in the perpetuation of unlawful agency action.” Id. Plaintiffs thus have the better of the balance, as they seek to prevent the IRS from making unlawful disclosures.

The IRS asserts that the district court’s order “impedes and delays federal law enforcement by improperly restricting the information that ICE is entitled to receive from IRS under § 6103(i)(2) for use in criminal investigations.” IRS Br. 66. But that’s a gripe with Congress, not the court. As we have explained, the Data-Exchange Procedure is likely contrary to

31

law. See Section III.D, supra. The government has no legitimate interest in conducting criminal investigations in violation of the statute. The IRS also asserts that the preliminary injunction is “highly unusual and harmful” because it requires the IRS to provide the district court with “prior notice of criminal investigatory activity.” IRS Br. 66. That argument is weak sauce where the district court has permitted the IRS to file any necessary notifications “under seal,” thereby shielding any criminal investigative activity from disclosure. Order of Nov. 21, 2025 (App. 1828-29). Importantly, the district court’s advance notice requirement reasonably balances the government’s interest in making lawful disclosures with the plaintiffs’ interest in preventing unlawful disclosures that, if made, would likely be difficult or impossible to remedy. See Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 71-72.

F.

Finally, the IRS contends that the district court erred by entering relief that extended beyond the parties, pointing to Trump v. CASA, Inc., 606 U.S. 831 (2025). IRS Br. 67-68. But “CASA does not control the scope of relief available under” 5 U.S.C. § 705. Make the Rd. N.Y. v. Noem, No. 25-5320, 2025 WL 3563313, at *34 (D.C. Cir. Nov. 22, 2025) (Statement of Millett and Childs, JJ.); cf. CASA, 606 U.S. at 847 n.10 (“Nothing we say today resolves the distinct question whether the Administrative Procedure Act authorizes federal courts to vacate federal agency action.”). Section 705 is one of the two provisions supporting the district court’s remedial order, and it allows a district court to preliminarily “postpone the effective date of an agency action” when “necessary to prevent irreparable injury.” 5 U.S.C. § 705. As a textual matter, stays entered under section 705 “operate on the legal source of authority for an agency to act at all” so “do not simply insulate

32

certain parties from enforcement measures.” Make the Rd., 2025 WL 3563313, at *35 (Statement of Millett and Childs, JJ.).

What is more, the IRS fails to explain how the district court could have crafted narrower relief capable of redressing plaintiffs’ irreparable injuries. The Center’s injuries, in particular, stem from the very existence of the Data-Exchange Procedure, which undermines the Center’s ability to reach and represent clients. The Center does not fear that the IRS will unlawfully disclose its own information; rather, it suffers because the Procedure eviscerates the statutory privacy rights on which its clients depend when they access the Center’s services. There is no way to redress the Center’s injury without “incidentally” benefitting the nonparties whose information might otherwise be disclosed. See CASA, 606 U.S. at 851-52. The district court thus acted within its sound discretion when it preliminarily enjoined the IRS from using the Data-Exchange Procedure.

IV.

For the foregoing reasons, we affirm the district court’s order of November 1, 2025, staying the Data-Exchange Procedure under section 705 and preliminarily enjoining further disclosures without notice to the court.

So ordered.