Center for Taxpayer Rights v. IRS

United States Court of Appeals FOR THE DISTRICT OF COLUMBIA CIRCUIT Argued May 12, 2026 Decided September 8, 2026 No. 26-5006 CENTER FOR TAXPAYER RIGHTS, ET AL., APPELLEES v. INTERNAL REVENUE SERVICE, ET AL., APPELLANTS Appeal from the United States District Court for the District of Columbia (No. 1:25-cv-00457) Jacob E. Christensen, Attorney, U.S. Department of Justice, argued the cause for appellants. With him on the briefs were Brett A. Shumate, Assistant Attorney General, Eric D. McArthur, Deputy Assistant Attorney General, and August E. Flentje, Attorney. Christopher J. Hajec and Matt A. Crapo were on the brief for amicus curiae Federation for American Immigration Reform in support of appellants.  2 Madeline Gitomer argued the cause for appellees. With her on the brief were Simon C. Brewer, Daniel A. McGrath, Steven Y. Bressler, and Robin F. Thurston. Jeffrey S. Gutman was on the brief for amici curiae Lawyers Defending American Democracy, Inc. in support of appellees. Andrew Weiner was on the brief for amici curiae 115 Members of Congress in support of appellees. Before: MILLETT, PILLARD and WILKINS, Circuit Judges. Opinion for the Court filed by Circuit Judge PILLARD. PILLARD, Circuit Judge: After the Watergate scandal exposed executive branch abuses of U.S. taxpayers’ information to harass the Administration’s enemies, Congress enacted a prohibition against the Internal Revenue Service (IRS) sharing tax return information with any other federal agency unless the requesting agency meets stringent conditions. In response to requests from Immigration and Customs Enforcement (ICE), in the summer of 2025, the IRS developed a specialized procedure for disclosing return information. The procedure failed to ensure that ICE’s requests complied with statutory requirements. The IRS nonetheless began using the procedure to disclose tens of thousands of records. Several groups sued. The IRS had turned over more than 47,000 records by the time the district court stayed the IRS from using the new procedure and preliminarily enjoined further disclosures without notice to the court. We affirm.  3 I. A. “Every year, millions of taxpayers submit sensitive, personal information” to the IRS in the course of filing their tax returns. Ctr. for Taxpayer Rts. v. Internal Revenue Serv., 815 F. Supp. 3d 1, 20 (D.D.C. 2025). As a result, “the IRS probably has more information about more people than any other agency in this country,” and “almost every other agency that has a need for information about U.S. citizens, therefore, logically seeks it from the IRS.” S. Rep. No. 94-938, at 316-17 (1976). “Recognizing the value and sensitivity of tax information,” Congress enacted 26 U.S.C. § 6103 to “regulate in minute detail [its] disclosure.” Centro de Trabajadores Unidos v. Bessent, 167 F.4th 1218, 1224-25 (D.C. Cir. 2026) (modification in original) (quoting Lake v. Rubin, 162 F.3d 113, 115 (D.C. Cir. 1998)). In section 6103, Congress dictated that taxpayers’ “[r]eturns and return information [are] confidential,” and no federal employee “shall disclose any return or return information obtained by him in any manner”— even within the executive branch—unless a provision of Title 26 of the U.S. Code expressly authorizes disclosure. 26 U.S.C. § 6103(a). As relevant to this case, section 6103(i)(2) authorizes the IRS to disclose “return information” to other federal agencies for use in specified non-tax criminal investigations. Id. § 6103(i)(2). (No statute authorizes the IRS to disclose “return information” for non-tax civil investigations without the taxpayer’s consent, or to disclose “taxpayer return information” for any purpose, compare 26 U.S.C. § 6103(b)(2) with id. § 6103(b)(3)). The “head of any Federal agency” can request return information from the IRS for three purposes: preparing for a judicial or administrative proceeding  4 “pertaining to the enforcement of a specifically designated Federal criminal statute,” undertaking an “investigation which may result in such a proceeding,” or proceeding before a grand jury. Id. § 6103(i)(1)(A), (i)(2)(A). To submit such an information request, the agency head must send a written message to the Secretary of the Treasury identifying (i) “the name and address of the taxpayer,” (ii) “the taxable period” of the information requested, (iii) “the statutory authority” for the proceeding or investigation, and (iv) “the specific reason or reasons why such disclosure is, or may be, relevant to such proceeding or investigation.” Id. § 6103(i)(2)(B)(i)-(iv). If the agency head submits a compliant request, then the Secretary of the Treasury “shall disclose” the requested information “to officers and employees of such agency who are personally and directly engaged in” the qualifying investigation, “solely for the use of such officers and employees in [that] proceeding.” Id. § 6103(i)(2)(A). “The assurance of privacy secured by § 6103 is fundamental to a tax system that relies upon self-reporting.” Nat’l Treasury Emps. Union v. Fed. Lab. Rels. Auth., 791 F.2d 183, 184 (D.C. Cir. 1986). Underscoring the importance of confidentiality, Congress has imposed civil and criminal penalties on federal employees who “willfully . . . disclose” return information in violation of section 6103. 26 U.S.C. § 7213(a)(1). As the IRS has explained, “[t]here is no provision in the United States Code that authorizes the disclosure or redisclosure of returns or return information for enforcement of immigration laws.” Disclosures of Return Information Reflected on Returns to Officers and Employees of the Department of Commerce, Including the Bureau of the Census, for Certain Statistical Purposes and Related Activities, 89 Fed. Reg. 93172, 93174 (Nov. 26, 2024) (codified at 26 C.F.R. § 301).  5 B. Until 2025, the IRS had interpreted section 6103(i)(2) “to prohibit disclosure of a taxpayer’s address when no other information is requested.” Centro de Trabajadores Unidos, 167 F.4th at 1226. That spring, however, “news reports emerged that [the Department of Homeland Security] had asked IRS to disclose addresses of some undocumented taxpayers.” Id. It came to light that the Department of Homeland Security had entered into a Memorandum of Understanding (MOU) with the IRS “to establish the procedures and requirements for” ICE to submit putatively “valid I[nternal] R[evenue] C[ode] § 6103(i)(2) requests for addresses of persons subject to criminal investigation under 8 U.S.C. § 1253(a)(1)”—a statute that, among other things, criminalizes willfully remaining in the United States beyond a 90-day grace period after a final order of removal has been issued. DHS-ICE MOU 2 (App. 359). With the MOU in place, ICE Acting Director Todd Lyons sent a written request to the IRS seeking “the last known address” for 1.28 million undocumented individuals. Lyons Letter 1-2 (June 27, 2025) (App. 326-27); Romo Decl. ¶ 4, Ctr. for Taxpayer Rts., 815 F. Supp. 3d 1 (D.D.C. 2025) (No. 25- 0457), Dkt. No. 66-1. Director Lyons’s letter announced that ICE sought that information from the IRS because it “may contain address information which is potentially at issue with respect to investigating . . . a violation under 8 U.S.C. § 1253(a)(1).” Lyons Letter 1 (App. 326). On July 1, the IRS gave its employees the “green light” to begin processing ICE’s 1.28 million requests. “Letter from ICE” Emails 1-2 (App. 440-41). In response to ICE’s interest in return information regarding more than a million individuals, the IRS developed a  6 protocol, the Data-Exchange Procedure, for responding to ICE’s requests. See DHS-ICE Data Exchange Overview 1-4 (App. 462-65). The record in this case includes IRS documents laying out the step-by-step mechanics of the Procedure. Id. The Data-Exchange Procedure begins with the IRS running a “[p]reprocessing task” that checks to ensure that several fields of a data request from ICE are not blank. DHS- ICE Data Exchange Overview 1 (App. 462). Of particular relevance here, that check ensures the fields for first and last name, taxable period, final removal-order date, address, and ICE point of contact—indicating “the identity of the officer(s) and/or employe(es) [sic] who are personally and directly engaged in the criminal proceeding or criminal investigation” concerning that taxpayer, Lyons Letter 1 (App. 326)—are “not [] empty,” DHS-ICE Data Exchange Overview 1 (App. 462). Importantly, while section 6103(i)(2) and the MOU require the requesting agency to provide the “address of the taxpayer,” 26 U.S.C. § 6103(i)(2)(B)(i); DHS-ICE MOU 3 (App. 360), the Data-Exchange Procedure merely checks whether ICE supplied five or nine digits—any random five or nine digits—in the address field within its request, DHS-ICE Data Exchange Overview 1 (App. 462); Romo Decl. ¶¶ 6, 13. To trigger IRS disclosure of tax return information under the Data-Exchange Procedure, the five- or nine-digit number need not even be an actual zip code, nor does ICE need to have provided any other information, such as a street name, unit number, city, or state. DHS-ICE Data Exchange Overview 1 (App. 462); Romo Decl. ¶ 13. And, although section 6103(i)(2) permits the IRS to disclose information only to “officers and employees of [the requesting] agency who are personally and directly engaged in” a qualifying criminal investigation or proceeding, 26 U.S.C. § 6103(i)(2)(A), the Data-Exchange Procedure requires no more than that the ICE  7 point of contact field “not be empty[,]” DHS-ICE Data Exchange Overview 1 (App. 462). It thus fails to ensure that the field contains a name, let alone the name of an ICE employee responsible for a particular criminal investigation. The Data-Exchange Procedure includes two methods for the IRS to use after the preprocessing check to cull and provide data to ICE. First, the IRS checks whether ICE provided a Tax Identification Number (TIN)—either a Social Security Number (SSN) or an Individual Taxpayer Identification Number (ITIN)—for the request. If ICE provided a TIN, the IRS runs a search for that number in its internal database. DHS-ICE Data Exchange Overview 1-2 (App. 462-63); Romo Decl. ¶ 8(a). If it finds the TIN in its records, the IRS then provides ICE with its most recent address information corresponding to the requested TIN, without regard to whether ICE supplied an address in its request. See DHS-ICE Data Exchange Overview 1-3 (App. 462-64); Romo Decl. ¶ 13 (confirming that the IRS “provided last known addresses to ICE in instances in which the ICE-supplied address field . . . was either incomplete or insufficiently populated”). Second, if the ICE request lacks a TIN, the IRS uses the name and address information provided by ICE to run a search of its records for an individual whose name and past or present address match the information provided by ICE. DHS-ICE Data Exchange Overview 1-2 (App. 462-63). (The second method, unlike the first, returns a result only if ICE supplies a complete, matching address in its request.) Finally, the IRS compiles the outputs of both methods and supplies the results to ICE. DHS-ICE Data Exchange Overview 3 (App. 464). Using the Data-Exchange Procedure, IRS has so far identified and disclosed 47,289 records to ICE. Romo Decl.  8 ¶ 10. More than 90% of the records were produced via the TIN-matching method, id., meaning that the IRS never confirmed whether the ICE request contained information plausibly reflecting “the name and address of the taxpayer,” 26 U.S.C. § 6103(i)(2)(B)(i). C. Plaintiffs—the Center for Taxpayer Rights (the Center), Main Street Alliance, and two labor unions—filed suit against the IRS and a host of federal officials. Plaintiffs claimed that the IRS unlawfully adopted a new policy governing disclosure of return information to ICE, and they sought to “stay the implementation” of that new policy. Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 18, 71. The IRS denied having adopted any new policy. Id. at 40. The district court made a factual finding that, “‘[a]lthough the details of the [IRS’s] disclosure policy are still unclear, the record leaves no doubt the [IRS] has a policy of disclosing confidential information’ to ICE in a manner that it has not previously been disclosed.” Id. at 40-41 (modifications in original) (quoting Venetian Casino Resort, L.L.C. v. Equal Emp. Opportunity Comm’n, 530 F.3d 925, 929-30 (D.C. Cir. 2008)). The district court concluded that plaintiffs were likely to succeed in demonstrating that the new policy is unlawful, id. at 45-58; that the new policy threatens to irreparably injure plaintiffs, id. at 58-68; and that the equities support preliminarily relief against the new policy and its further implementation, id. at 68-72. The court entered an order staying the policy under 5 U.S.C. § 705, preliminarily enjoining defendants from disclosing taxpayer information “except in strict compliance with the requirements of” section 6103(i)(2), and requiring defendants to inform the court before responding to any future request from the Department of  9 Homeland Security for taxpayer information. Order of Nov. 21, 2025 (App. 1828-29). The IRS appealed. After the district court transmitted the record to this court, the IRS filed in district court a supplemental declaration by its Chief Risk and Control Officer (the Romo Declaration) explaining that the IRS had “determined that it provided last known addresses to ICE in instances in which” ICE’s request contained address information for noncitizens that was “either incomplete or insufficient[]”—i.e. that the IRS had provided information in response to ICE requests that apparently did not meet statutory preconditions to disclosure. Romo Decl. ¶¶ 1, 11-14. Plaintiffs moved in this court for a limited remand so the district court could supplement the record on appeal with the Romo Declaration and consider the appropriateness of additional discovery. Dkt. No. 2161752 at 1-2. A motions panel of our court referred that motion to the merits panel. Dkt. No. 2166493 at 1. II. A plaintiff seeking preliminary relief “must establish [1] that he is likely to succeed on the merits, [2] that he is likely to suffer irreparable harm in the absence of preliminary relief, [3] that the balance of equities tips in his favor, and [4] that an injunction is in the public interest.” Winter v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 20 (2008). On appeal, we review for abuse of discretion the district court’s decision to order preliminary relief, “although we review the court’s underlying legal conclusions de novo and factual findings for clear error.” Atlas Air, Inc. v. Int’l Bhd. of Teamsters, 928 F.3d 1102, 1112 (D.C. Cir. 2019). Pursuant to Federal Rule of Appellate Procedure 10(e)(2), and based on the parties’ agreement, Oral Arg. Tr. 5:5-14, 49:3-  10 11, we accept the proffered Romo Declaration as a supplement to the record on appeal. We accordingly dismiss as moot plaintiffs’ motion for a limited remand. III. Because plaintiffs establish that they are likely to succeed on the merits and the remaining equitable factors support preliminary relief, we affirm the district court’s order. A. We begin with standing. At least one plaintiff, the Center for Taxpayer Rights, is likely to succeed in establishing standing. Organizations “have standing ‘to sue on their own behalf for injuries they have sustained’” so long as they “satisfy the usual standards for injury in fact, causation, and redressability.” Food & Drug Admin. v. All. for Hippocratic Med., 602 U.S. 367, 393-94 (2024) (quoting Havens Realty Corp. v. Coleman, 455 U.S. 363, 379 n. 19 (1982)). “To demonstrate injury in fact, an organization must allege a ‘concrete and demonstrable injury to the organization’s activities’ that is ‘more than simply a setback to the organization’s abstract social interests.’” Am. Anti-Vivisection Soc’y v. U.S. Dep’t of Agric., 946 F.3d 615, 618 (D.C. Cir. 2020) (quoting Havens Realty, 455 U.S. at 379). And causation is shown where new activities, not previously part of the organization’s “normal annual expenditures,” “became necessary” in response to the injury, causing a “drain on the organization’s resources.” Id. at 619 (quoting Havens Realty, 455 U.S. at 379). The Center has made those showings. The Center has identified several ways in which the Data- Exchange Procedure harms its interests, which include  11 “advancing taxpayer rights,” “promoting trust in the tax system,” and “increasing access to justice in the tax system.” Olson Decl. ¶ 3 (App. 168); see Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 28. The Center’s Executive Director attests that reporting on “IRS’s new policy” has made many immigrant taxpayers “less willing to come to the Center’s events, to seek its guidance, or to engage with the Center’s education and outreach.” Olson Decl. ¶ 41 (App. 178). And the Center’s pro bono tax clinic has seen a “drastic” reduction of cases involving taxpayers who lack social security numbers because potential clients “fear . . . having their current status or location shared with [the Department of Homeland Security]/ICE.” Id. ¶¶ 42, 44 (App. 179). The IRS responds that the Center’s injury is not cognizable because it “depends upon the independent choices of third parties” who have “chosen to engage less with the Center.” IRS Br. 26. But an injury may be premised “on the predictable effect of Government action on the decisions of third parties.” Dep’t of Com. v. New York, 588 U.S. 752, 768 (2019) (reasoning that a citizenship question on the Census will predictably depress Census participation rates in immigrant communities). The district court reasonably found that many taxpayers “are no longer willing to engage with the Center due to the IRS’s” new policy and that the policy “has interfered with the Center’s ability to provide its pro bono or nominal fee representation services.” Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 29. The Center has also established that it is “divert[ing] and redirect[ing] its limited resources to counteract and offset” the effects of the IRS’s policy. People for the Ethical Treatment of Animals (PETA) v. U.S. Dep’t of Agric., 797 F.3d 1087, 1095 (D.C. Cir. 2015). The Center’s Executive Director attests that the Center has increased staffing “to focus on education and  12 outreach in light of the reduced trust in the tax system engendered by the IRS’s policy change” and has reallocated “nearly 10 percent” of the tax clinic’s operating expenses to increase client outreach. Olson Decl. ¶¶ 45-46 (App. 179-80); see Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 29. That is sufficient to demonstrate the Center’s likely standing. See, e.g., Am. Anti-Vivisection Soc’y, 946 F.3d at 619. The IRS insists that the Center may not “spend its way into standing.” IRS Br. 24 (quoting All. for Hippocratic Med., 602 U.S. at 394). It is true that an organization may not establish standing simply by spending money “opposing those policies” that it “dislike[s].” All. for Hippocratic Med., 602 U.S. at 395. But where, as here, a government action “directly affect[s] and interfere[s] with” an organization’s “core business activities,” and the organization “diverted its resources” to continue pursuing those activities, such concrete harm to the organization’s activities supports standing to sue. Id. (discussing Havens Realty, 455 U.S. at 379); cf. Pierce v. Soc’y of Sisters, 268 U.S. 510, 533 (1925) (private school could challenge compulsory public-school attendance law based on its “business . . . being destroyed and its property depreciated [and] parents and guardians . . . refusing to make contracts for the future instruction of their sons”). Because we hold that the Center has made a “‘clear showing’ that [it] is ‘likely’ to establish each element of standing,” Murthy v. Missouri, 603 U.S. 43, 58 (2024) (quoting Winter, 555 U.S. at 22), we need not address whether any other plaintiff is likely to demonstrate standing. B. Next, the IRS argues that the Data-Exchange Procedure is not subject to APA review because it is not final agency action.  13 IRS Br. 36 (citing 5 U.S.C. § 704). We conclude that plaintiffs are likely to succeed in showing that the IRS took final action. An action is “final” under the APA if (1) it “mark[s] the consummation of the agency’s decisionmaking process” and (2) “rights or obligations have been determined” by it or “legal consequences will flow” from it. U.S. Army Corps of Eng’rs v. Hawkes Co., 578 U.S. 590, 597 (2016) (quoting Bennett v. Spear, 520 U.S. 154, 177-78 (1997)). According to the IRS, the agency’s “only practice” is to follow the terms of the MOU, which, in turn, merely require the agency “to comply with § 6103(i)(2)’s disclosure requirements.” IRS Br. 38. Further, the IRS contends, the administrative record lacks an “agency statement pertaining to” the Data-Exchange Procedure. Id. Lastly, the IRS argues that following the MOU does not cause plaintiffs “direct and appreciable legal consequences.” Id. at 39 (quoting Hawkes, 578 U.S. at 598). None of those arguments holds up. The administrative record amply documents the existence of the Data-Exchange Procedure—an IRS policy for acting on taxpayer-information requests under the MOU. That concededly statutorily deficient process gives binding direction to IRS officials responding to ICE requests. We accordingly hold that the Data-Exchange Procedure is final agency action reviewable under the APA. 1. Considerable evidence in the administrative record shows that the Data-Exchange Procedure marks the consummation and implementation of the IRS’s decision-making process on how it discloses taxpayer information to ICE under the MOU.  14 First, the Data-Exchange Procedure is laid out in a final, written document in the administrative record that prescribes the steps of the process that IRS officials will follow to implement the MOU and have already used to respond to requests for information on at least 1.28 million taxpayers. DHS-ICE Data Exchange Overview 1-4 (App. 462-65). There is nothing “tentative or interlocutory” about it. Bennett, 520 U.S. at 178. The IRS also published multiple illustrated flow- charts in a Guidance Document for use by agency officials that further explain the Procedure. DHS-ICE Data Exchange Guidance Document 1-5 (App. 473-77). The Data-Exchange Procedure begins when the “IRS receives [an] input file from DHS” via the specified software system. DHS-ICE Data Exchange Overview 1 (App. 462). The Procedure then details a “[p]reprocessing task” followed by either a “[TIN]-Based Lookup” or “Name & Address-Based Processing.” DHS-ICE Data Exchange Overview 1-2 (App. 462-63); see Romo Decl. ¶ 8(a) (confirming that TINs, including but not limited to SSNs and ITINs, were used to match records). Two data sheets are formulated: one that is used for an internal review and check of results, and the second prepared for release to ICE. DHS-ICE Data Exchange Overview 3 (App. 464). After the internal review, a final data sheet is released to ICE. DHS-ICE Data Exchange Overview 3 (App. 464). Both IRS files are then “stored in a secure archival location.” DHS-ICE Data Exchange Overview 3 (App. 464). The agency has not only finalized the process but has also used it to make disclosures. Ms. Romo has attested that this Data-Exchange Procedure was used to process at least 1.28 million ICE requests in August 2025. Romo Decl. ¶ 6 (citing the Data-Exchange Procedure as the one used “to ensure compliance with Section 6103 of the Tax Code and the MOU”  15 once the IRS is in “receipt of ICE’s letter and Datafile”); id. ¶ 8 (citing the same and confirming that the IRS matched records using either the taxpayer’s TIN or “[a]ddress [m]atching”); id. ¶ 10 (describing request volume). Use of the Data-Exchange Procedure by IRS personnel is not optional. The Treasury’s Deputy General Counsel gave the go-ahead to the IRS to “begin processing and sharing information back to ICE.” “Letter from ICE” Emails 5 (App. 444); see also “Letter from ICE” 1 (App. 440) (email from IRS Deputy Chief Counsel directing IRS to “begin processing the request . . . and sharing information back to ICE”). The Procedure effectuates that command by prescribing what “will” happen upon receipt of an ICE request for taxpayer information. DHS-ICE Data Exchange Overview 1-3 (App. 462-64); see also “DHS Notes for Briefing” Email 1 (App. 472) (noting that by following the Data-Exchange Procedure “script,” “IRS will share matches, unmatched, and rejects . . . to ICE”). The IRS’s lawyers describe the Procedure as “IRS’s computerized process for validating ICE requests.” IRS Reply Br. 12. They further “confirm that IRS followed that process when responding to ICE’s request in August 2025,” id. See Biden v. Texas, 597 U.S. 785, 795, 807-09 & n.7 (2022) (holding that an informal four-page memorandum issued by the Secretary of the Department of Homeland Security announcing the termination of the Migrant Protection Protocols was final agency action when it created “employee[] obligations” to implement the termination). The Data-Exchange Procedure was not formally noticed or published, but that is not a prerequisite for final agency action. See Her Majesty the Queen in Right of Ontario v. EPA, 912 F.2d 1525, 1531 (D.C. Cir. 1990) (“[T]he absence of a formal statement of the agency’s position, as here, is not dispositive: An agency may not, for example, avoid judicial review ‘merely  16 by choosing the form of a letter to express its definitive position on a general question of statutory interpretation.’” (quoting Ciba-Geigy Corp. v. EPA, 801 F.2d 430, 438 n.9 (D.C. Cir. 1986))); Barrick Goldstrike Mines Inc. v. Browner, 215 F.3d 45, 48 (D.C. Cir. 2000) (“[W]e [have] rejected the proposition that if an agency labels its action an ‘informal’ guideline it may thereby escape judicial review under the APA.”). The IRS argues that the agency’s “only practice in this respect, consistent with the MOU, is to comply with § 6103(i)(2)’s disclosure requirements . . . as the statute requires.” IRS Br. 38; Oral Arg. Tr. 16:23-25 (arguing that the Data-Exchange Procedure is not final agency action because it “simply reflects the agency’s views of what it is allowed to do under the law”). There are two fatal flaws in that argument. First, the Romo Declaration—which the IRS itself filed with the district court—refutes the contention that there is some other procedure in place for processing ICE information requests that hews to the requirements and limitations of section 6103. The Declaration confirms that the IRS employed the Data- Exchange Procedure in responding to at least 1.28 million individual requests for information about listed taxpayers. Romo Decl. ¶¶ 10, 13; see Excerpts of ICE Requests 1-6 (App. 434-39). And the Romo Declaration candidly acknowledges that the Procedure operated as laid out in the Overview and accompanying illustrated guidance by “provid[ing] last known addresses to ICE” even when the address field “was either incomplete or insufficiently populated.” Romo Decl. ¶ 13. The policy thereby requires official action in direct violation of section 6103(i)(2) and the MOU. 26 U.S.C. § 6103(i)(2)(B)(i); DHS-ICE MOU 2 (App. 359) (MOU commitment that IRS will “return to ICE any requests not meeting the requirements necessary for disclosure pursuant to IRC § 6103(i)(2)”).  17 Second, the record contradicts the IRS’s argument that the Data-Exchange Procedure is just a statement of the agency’s view of what the law means. The enumerated steps of the Procedure demonstrate that it is the actual, on-the-ground policy. The IRS has used it to produce 47,289 individual records for ICE, Romo Decl. ¶¶ 10, 12, largely through a process that failed to ensure compliance with the statute and the MOU, see id. ¶¶ 10, 13 (for 90.3% of the matches IRS produced to ICE, the Data-Exchange Procedure failed to check whether ICE provided a valid address); Oral Arg. Tr. 9:1-3 (acknowledging that the implementation of the Data-Exchange Procedure resulted in “concededly unlawful” transfers); id. at 9:10-11 (same); see also Section III.D, infra. When an agency implements a policy choice, putting it into motion in a way that leads to concrete results and prescribes consequences, it takes final agency action. See Biden, 597 U.S. at 809-10 (holding that “an ‘agency statement . . . designed to implement, interpret, or prescribe law or policy’” is reviewable (modification in original) (quoting 5 U.S.C. § 551(4)); Lujan v. Nat’l Wildlife Fed’n, 497 U.S. 871, 890 n.2 (1990) (explaining that when an agency “appl[ies] some particular measure across the board to all” affected persons, that action “can of course be challenged under the APA”). The Data-Exchange Procedure is the type of “operative agency action[],” Biden, 597 U.S. at 810, that qualifies as final because it makes concrete the agency’s policy decision to allow disclosures of confidential taxpayer information on specified terms. Diverging significantly from the requirements of section 6103(i)(2), the Procedure requires the IRS to return taxpayer data to ICE even when ICE fails to provide the taxpayer’s address as required by law and the MOU. As long as ICE offers any random five or nine digits in the “address” field of its request, the Data-Exchange Procedure validates the request and generates the taxpayer’s information to provide to  18 ICE. DHS-ICE Data Exchange Overview 1-2 (App. 462-63) (only requiring that ICE-provided address field “not be empty” and “contain zip code”); Romo Decl. ¶¶ 6, 13 (acknowledging that the Data-Exchange Procedure accepted any five- or nine- digit number as a “proxy” for a zip code and did not require the provision of any other address information); Oral Arg. Tr. 24:23-24 (“[T]he thinking was . . . that [the number] would serve as an accurate proxy.”); see also Ctr. for Taxpayer Rts. v. Internal Revenue Serv., No. 25-cv-457, 2026 WL 551105, at *3 (D.D.C. Feb. 26, 2026) (“A zip code is not an address, and a zip code proxy, as the IRS would define it, might as well be a set of random numbers. For instance, ICE could have submitted a request with an ‘address’ like, ‘Don’t Care 12345,’ or, ‘00000,’ and still received a taxpayer’s address through the IRS’s TIN Matching process.”). The IRS’s operative policy to provide information on those terms flies in the face of the statutory command that the IRS share return information only when the requesting agency provides “the name and address of the taxpayer with respect to whom the requested return information relates.” 26 U.S.C. § 6103(i)(2)(A), (B)(i) (emphasis added). Presumably that is why counsel for IRS candidly conceded that the Data-Exchange Procedure does not comply with the requirements of section 6103(i)(2) or the MOU. See Oral Arg. Tr. 15:17-19 (“With respect to the extent [the Data-Exchange Procedure] doesn’t require an address, it’s an error in implementing the policy [as previously laid out in the MOU].”); id. at 28:11-13 (“[T]he Government would readily admit that there were mistakes made[,] that some information was disclosed not in compliance with the statute.”). While the MOU merely tracked the language and bounds of section 6103(i)(2), see Centro de Trabajadores Unidos, 167 F.4th at 1236, the Data-Exchange Procedure veers off that course. Such an “unannounced departure in practice from a written  19 [policy]” is reviewable final agency action. Hisp. Affs. Project v. Acosta, 901 F.3d 378, 387 (D.C. Cir. 2018); Immigr. Nat’y Serv. v. Yueh-Shaio Yang, 519 U.S. 26, 32 (1996) (an agency’s “irrational departure from [a] policy (as opposed to an avowed alteration of it) could constitute action . . . within the meaning of the [APA]”). The Data-Exchange Procedure also represents a dramatic change in agency policy from individualized review of records submitted under section 6103(i)(2) to a mass, automated review of millions of records at the press of a button. Before April 17, 2025, the IRS’s Internal Revenue Manual provided detailed instructions for IRS “Disclosure Managers” to process individual records requested under section 6103(i)(2). IRM 11.3.28.2 (July 23, 2018). That process included contacting the requesting official assigned to the individual criminal case (“usually the Assistant United States Attorney”) to “[i]nquire” about the relevant court date and to “[d]iscuss alternative” disclosure options that would be less intrusive on confidentiality, such as “offering a transcript in lieu of a return.” Id. Further, the “Disclosure caseworker” was required to “review all releases of documents” to make sure that only material covered by section 6103(i)(2) was released to the U.S. Attorney’s Office. Id. That is a far cry from the current Data-Exchange Procedure, which automates the review of millions of records without any individual review or any other means of ensuring compliance with the legal prerequisites to releasing each individual taxpayer’s information. See DHS-ICE Data Exchange Overview 1-4 (App. 462-65). Such a substantial and material change in policy is yet another indication that the Procedure is final agency action. See Nat’l Env’t Dev. Ass’n’s Clean Air Project v. EPA, 752 F.3d 999, 1007 (D.C. Cir. 2014) (“If an agency action announces a binding change in  20 its . . . policy which immediately affects the rights and obligations of regulated parties, then the action is likely final and subject to review.”). Finally, the record shows that the Data-Exchange Procedure will be applied on an ongoing basis. The IRS’s illustrated guidance document explaining the Data-Exchange Procedure calls it an “[o]n demand process,” underscoring that it can and will be used whenever ICE sends data requests to the IRS going forward. DHS-ICE Data Exchange Guidance Document 1 (App. 473). And a few pages later, that document includes a list of “Discussion points,” including “volume & frequency of the data we are expecting.” DHS-ICE Data Exchange Guidance Document 4-5 (App. 476-77). The fact that the IRS was having either internal discussions or strategic planning sessions with ICE discussing the “volume” and “frequency” of expected incoming requests further demonstrates that the Data-Exchange Procedure was designed for continued use. Importantly, the IRS has indicated that the Data-Exchange Procedure remains operational with, at best, the possibility of unknown adjustments. See Oral Arg. Tr. 46:17-20 (IRS Counsel: “What action IRS has since taken to remedy the error, I can only speculate. I’m not aware of what, if any, action IRS has done to correct the [error].”); id. at 47:14-16 (IRS Counsel: “As far as changing the computer process, I can only speculate what’s happened.”); id. at 48:19-20 (IRS Counsel: “I’m not aware of what action IRS has taken” to fix the Data-Exchange Procedure). In any event, “[t]he mere possibility that an agency might reconsider [its action] in light of ‘informal discussion’ and invited contentions of inaccuracy [from regulated parties] does not suffice to make an otherwise final agency action nonfinal.” Sackett v. EPA, 566 U.S. 120, 127 (2012).  21 For those reasons, the IRS’s formal Data-Exchange Procedure, as written and implemented, constitutes the consummation of the agency’s decision making on how it will share—and has shared—confidential taxpayer information with ICE. 2. The Data-Exchange Procedure is also an agency action “by which ‘rights or obligations have been determined.’” Bennett, 520 U.S. at 178 (quoting Port of Boston Marine Terminal Ass’n v. Rederiaktiebolaget Transatlantic, 400 U.S. 62, 71 (1970)). An agency action carries “direct and appreciable legal consequences” sufficient to render it final when it imposes new restrictions or obligations on government officials. Id. For example, the Court in Bennett held that the Secretary of the Interior took final action when he issued an opinion that “authoriz[ed another agency] to take [an] endangered species if (but only if) it complies with the prescribed conditions.” Id. The Secretary’s opinion “alter[ed] the legal regime to which the [other] agency is subject,” and accordingly was final agency action. Id. Applying that precedent, we have held that EPA guidance was final when it “altered the legal regime by resolving” a question about states’ obligations under the Clean Air Act. See Nat. Res. Def. Council v. EPA, 643 F.3d 311, 320 (D.C. Cir. 2011). Before the guidance, EPA regional directors “retained discretion” to reject certain state proposals “solely for failing to comply with” the statute, without considering whether a state’s alternative, “not less stringent” program satisfied the statute. Id. at 319. The guidance removed that discretion, directing that states’ alternatives be considered, thereby “bind[ing] EPA regional directors and thus qualif[ying] as final  22 agency action.” Id. at 320 (citing Bennett, 520 U.S. at 177-78). By the same token, in Center for Auto Safety v. National Highway Traffic Safety Administration, we concluded that the agency’s guidelines did not determine rights or obligations, and thus were not final agency action, because the agency “has not commanded, required, ordered, or dictated” that “officials in [the National Highway Traffic Safety Administration’s] Office of Defects Investigation are bound to apply the guidelines”— nor did any evidence indicate that the agency had so bound itself. 452 F.3d 798, 808-09 (D.C. Cir. 2006). The Data-Exchange Procedure is final because it binds IRS officials. It “alter[s] the legal regime” to which the IRS’s processing of ICE return-information requests “is subject.” Bennett, 520 U.S. at 178. Specifically, the Procedure sets out the conditions under which IRS employees are required to transfer confidential taxpayer data to ICE. See DHS-ICE Data Exchange Overview 1-4 (App. 462-65). And it removes IRS employees’ discretion to reject a request for failure to meet certain statutory requirements. From July to August 2025, the IRS developed the Data-Exchange Procedure and then started using it in determining whether to respond to ICE requests concerning 1.28 million taxpayers. See IRS Correspondence Emails and Teams Meetings (App. 456-61, 468-71, 78); Romo Decl. ¶ 10. Finally, the Data-Exchange Procedure reduces noncitizens’ privacy rights in their tax returns. By providing a distinct, automated pathway for ICE to request noncitizens’ information, the Data-Exchange Pro