Why ICE Got 47,289 IRS Addresses From 1.28 Million Requests—and Why the Process Violated Tax-Privacy Law

ICE did not receive only 47,289 IRS records because a court approved 47,289 people and rejected the other 1.23 million. Nor does the enormous gap mean the remaining people had never filed taxes.

The IRS’s own automated screening and matching system produced the difference.

According to a later Treasury Inspector General for Tax Administration audit, Immigration and Customs Enforcement submitted 1,277,464 request records. The IRS rejected 25,253 before matching, could not match 1,204,922 to IRS records under its automated rules, and disclosed 47,289 last-known-address records. Those disclosures represented approximately 46,965 individual people.

What the IRS sent is also narrower than the phrase “tax records” often implies. TIGTA says the IRS provided its last-known address for successful matches and no other tax information through this exchange. ICE did not receive 47,289 complete tax returns, income histories or lists of deductions. Addresses are nevertheless protected “return information” under federal tax-confidentiality law.

The legal problem was not simply that a few records contained bad addresses. On September 8, 2026, the U.S. Court of Appeals for the D.C. Circuit unanimously affirmed preliminary relief against the IRS procedure, saying the system “indisputably contravenes” important requirements of 26 U.S.C. §6103. Among other defects, it did not reliably verify that ICE had supplied the taxpayer address required by law or that the person receiving the IRS information was actually “personally and directly engaged” in the qualifying criminal investigation.

That ruling remains in a preliminary-injunction posture. It does not mean every possible IRS disclosure to ICE is illegal. In fact, the same appeals court had held in February that a properly documented request for a genuine non-tax criminal investigation can qualify for the statutory exception. The September case was about what happened when the government actually implemented the program.

What happened to the other 1.23 million requests?

The cleanest accounting comes from TIGTA’s June 2026 audit:

The 47,289 disclosed records corresponded to approximately 46,965 individuals, according to TIGTA, meaning “request records” and unique people are not perfectly interchangeable in the government’s data.

The main explanation for the dramatic reduction is therefore straightforward: about 94% of ICE’s submitted records did not produce an IRS match under the system’s automated criteria.

But “did not match” should not be read as “the IRS had no information on that person.”

TIGTA found that the system demanded highly specific matches while ICE’s underlying data were not consistently formatted. Small differences in names and addresses could cause records that potentially referred to the same person to fail the match. TIGTA identified the problem but did not calculate how many of the 1,204,922 nonmatches were false negatives. It would therefore be unsupported to claim that those people had not filed federal taxes, lacked ITINs or were absent from IRS databases.

What exactly did the IRS give ICE?

For the successful matches, the IRS returned its last-known address.

That distinction matters because shorthand descriptions such as “IRS gave ICE tax returns” substantially overstate the evidence. TIGTA says IRS officials reported that no other tax information was shared in this exchange.

Federal law still treats a taxpayer’s identity information, including an address, as highly protected. Section 6103 establishes the general rule that returns and return information are confidential, while creating tightly defined exceptions.

One of those exceptions, §6103(i)(2), allows certain information to be supplied for qualifying non-tax federal criminal investigations. But the statute imposes conditions. A qualifying written request must identify the taxpayer, identify the relevant taxable period, state the statutory authority for the investigation and provide a specific reason the information may be relevant. Disclosure is also limited to officers or employees personally and directly engaged in the investigation.

The case therefore was never simply about whether law enforcement can ever receive a taxpayer address. The question was whether the government’s mass-processing system actually enforced the conditions Congress attached to that exception.

How the IRS matching system worked

The IRS built two principal routes for processing ICE’s batch.

The first was TIN matching. If ICE supplied a taxpayer identification number and the IRS matched it to its records, the IRS could return the corresponding last-known address. The D.C. Circuit explained that a TIN in this procedure could be a Social Security number or an Individual Taxpayer Identification Number, or ITIN.

The second was name-and-address matching. If ICE did not provide a usable TIN, the system attempted to match the name and address ICE supplied to IRS records.

Of the 47,289 disclosures:

The difference between those routes became central to the litigation.

In the name-and-address route, an inaccurate address was likely to prevent a match because the address itself was part of the matching process.

The TIN route was different. Once the IRS found the taxpayer by TIN, it returned its own last-known address without requiring the address supplied by ICE to match that IRS address. That made it particularly important that the preliminary screening independently verify that ICE had supplied the kind of taxpayer address the statute required.

It did not.

Why the court said the procedure violated Section 6103

The D.C. Circuit identified structural problems rather than merely a handful of clerical mistakes.

The address check did not really verify an address

Before matching began, the IRS system checked several required ICE fields. But its test for an address was extraordinarily loose.

According to the appellate opinion, the system essentially asked whether the address field was nonblank and contained a string of five or nine digits. The digits did not have to constitute a valid ZIP code. The entry did not necessarily need a street, city or state.

That meant something such as a five-digit street number could satisfy the computer check. Later review found disclosures originating from ICE records containing entries such as “Unknown Address,” “Failed to Provide,” “NA NA” and partial addresses. IRS counsel acknowledged during the litigation that disclosures based on such submissions contravened the statute.

Because more than 90% of the successful disclosures came through the TIN route, this was not an obscure edge case in the architecture. The route responsible for 42,695 disclosures could locate a taxpayer by TIN and supply the IRS address even though the preprocessing system had never meaningfully established that ICE itself possessed the taxpayer address required for a §6103(i)(2) request.

The system did not establish that the named ICE officer was actually handling the investigation

Section 6103 also restricts disclosure to officers or employees “personally and directly engaged” in the qualifying investigation.

The IRS system’s check was essentially whether ICE’s point-of-contact field contained something.

The appellate record showed the field could pass with entries such as “Unknown” or “TBD.” More significantly, ICE identified the same person as the point of contact for every one of the roughly 1.28 million requests.

The district court found it implausible that one person could be personally and directly engaged in approximately 47,000 resulting matters, much less 1.28 million proposed investigations. The D.C. Circuit agreed that the procedure itself failed to enforce this statutory restriction.

ICE’s “specific reason” was also questioned

The June 27 batch request stated, in substance, that IRS information might contain an address potentially relevant to investigating a violation of 8 U.S.C. §1253(a)(1).

The D.C. Circuit said it “beggars belief” to characterize that generalized justification as the “specific reason” contemplated by §6103. The district court had similarly described the reasoning as more circular than specific.

There is an important limitation here. The appeals court did not need to decide whether this defect necessarily infected every future operation of the procedure. It was unclear whether the generic language was peculiar to that batch request or an unavoidable feature of the system.

The address and officer-validation defects were independently sufficient to support the preliminary relief.

Why 42,695 disclosures can be problematic while IRS says fewer than 5% had bad addresses

Two statistics in the record can sound contradictory:

• 42,695 disclosures went through the legally problematic TIN-matching route.
• IRS later estimated that less than 5% of the 47,289 successful matches involved potentially incomplete or insufficient ICE-supplied addresses.

They measure different things.

The 42,695 figure describes how the system operated. Every TIN-route disclosure passed through a procedure that did not actually verify the incoming taxpayer-address condition in the manner required by the statute.

The “less than 5%” figure comes from a later review asking a narrower factual question: in how many successful records could IRS reviewers affirmatively identify an ICE-supplied address that was plainly incomplete or insufficient?

Those records included obvious examples such as “Unknown Address” or incomplete institutional addresses.

The smaller number therefore does not establish that more than 95% of the disclosures were lawful. It merely estimates the subset in which IRS later identified an obvious address deficiency. The independent problem with the point-of-contact requirement remained, as did the structural weakness in the TIN workflow and the court’s concern over ICE’s generic statement of relevance.

There is also an unexplained discrepancy in the government’s own numbers

One numerical issue remains unresolved in the public record.

In a February 2026 sworn declaration, IRS Chief Risk and Control Officer Dottie Romo said approximately 2.6% of the roughly 1.28 million submissions had been rejected during preprocessing.

TIGTA’s later audit, however, gives the exact rejected count as 25,253 out of 1,277,464, or about 1.98%. At the same denominator, 2.6% would equal roughly 33,000 records.

The difference is too large to be explained by ordinary rounding.

The available records reviewed by sherafy.com do not explain whether the discrepancy resulted from a preliminary estimate, a later reclassification, a different processing stage or another denominator issue. For the main accounting in this article, we use TIGTA’s later audited figure while preserving the discrepancy rather than manufacturing a reconciliation.

Before 1.28 million, ICE tried to obtain addresses for more than 7 million people

The final request makes more sense when placed in its chronology.

A Massachusetts federal court reconstructed several earlier attempts by ICE to obtain IRS address information.

On June 5, 2025, ICE sought IRS address information for what it described as the “full alien population” — 7,615,279 people. ICE acknowledged that it did not necessarily possess addresses for everyone in the dataset and described its objective as “enrich[ing] the data” with the IRS’s most recent address. That request relied on a different criminal statute, 8 U.S.C. §1325. The IRS rejected it.

On June 24, ICE returned with another request covering approximately 7.3 million records. IRS personnel identified deficiencies including the lack of an adequate specific reason, proper identification of officers personally and directly engaged in the investigations, and other required formalities. That version was not processed as submitted.

Then, on June 27, Acting ICE Director Todd Lyons submitted the request that eventually produced results for approximately 1.28 million records, this time invoking 8 U.S.C. §1253(a)(1). IRS personnel received a “green light” to process it on July 1, and the IRS ultimately transferred the 47,289 address records on August 7, 2025.

That chronology matters because it makes clear that bulk address acquisition—not simply an isolated need for one taxpayer’s location—was an explicit operational objective during the program’s development.

Were all 1.28 million people really under criminal investigation?

ICE’s stated position was that the June 27 requests concerned criminal investigations under 8 U.S.C. §1253(a)(1).

That is a verified government representation.

But §1253 does not simply make it a crime to have a final removal order that is more than 90 days old. The statute covers specified willful conduct, including willfully failing or refusing to depart, willfully failing to make timely efforts to obtain necessary travel documents, conspiring or acting to prevent departure, or willfully failing to present for removal. It also contains protections for certain legitimate attempts to obtain relief.

So an old removal order, by itself, does not establish every element of a §1253 offense.

What the courts found

The district court concluded that the sequence of events raised an inference of pretext: an initial effort to obtain address information for millions of people was repeatedly reformulated until it was presented as a set of §1253 criminal investigations capable of fitting within §6103’s exception.

The D.C. Circuit recounted that inference but did not need to decide whether the government had subjectively fabricated criminal investigations. The procedure failed statutory safeguards regardless of the ultimate answer to the motive question.

The appellate court also identified a problem in one government explanation for the usefulness of the data. The government suggested an ICE officer could use an IRS address to determine whether a person had remained in the United States after the removal period. But the IRS address information contained no date showing when the taxpayer lived there. The court called that theory, as presented, a “nonstarter.”

What the total record reasonably supports

The strongest evidence-based inference is narrower than saying “the criminal investigations were fake.”

ICE first sought mass address enrichment for more than 7.6 million people. After rejection, it narrowed the population and changed the statutory basis. The final 1.28-million batch used the same point of contact for every request, relied on essentially standardized reasoning and was processed through a system designed to enrich ICE records with IRS addresses.

Taken together, that evidence strongly supports the inference that the §6103 criminal-investigation exception was being used as a bulk location and data-enrichment mechanism that could serve broader immigration enforcement, rather than merely as a conventional series of one-off address requests made late in 1.28 million separately developed criminal cases.

That is an inference from the documented chronology and system design—not a final judicial finding that every §1253 investigation was fictitious.

What did ICE do with the 47,289 IRS addresses?

The information did not simply sit unopened.

In the separate Massachusetts litigation, a sworn declaration from ICE official Richard Fitzgerald said ICE compared the IRS-provided information with its list of roughly 1.2 million people and identified approximately 33,000 “updated addresses.” The information was then made available to an Enforcement and Removal Operations analysis team.

“Updated” requires some caution. The court understood the term to mean addresses from IRS records that differed from addresses in ICE’s existing data for the same or similar individuals. It does not establish that all 33,000 were independently verified as each person’s present residence.

At the time described in the declaration, the IRS data had not yet been populated into the permanent systems contemplated by the agencies’ implementation agreement and was stored on a government computer associated with the project.

The Massachusetts court nevertheless concluded for preliminary-injunction purposes that the cross-referencing itself constituted use of the protected IRS information.

Did those IRS addresses lead to arrests or deportations?

The public record reviewed for this article does not establish a specific arrest, detention or removal caused by one of the IRS-derived addresses.

That is different from saying the information was never used.

ICE unquestionably compared the IRS results with its own data and derived approximately 33,000 different or “updated” addresses. Its broader enforcement workflow could include criminal investigation and civil immigration enforcement. But no primary record identified in this review ties a particular IRS-derived address to a named person’s subsequent arrest or removal.

Claims that the 47,289 records directly produced tens of thousands of deportations would therefore go beyond the available evidence.

Claims that ICE never used the data would also be inaccurate.

Can ICE still use the IRS information?

A Massachusetts federal judge issued a preliminary injunction on February 5, 2026 barring ICE and related officials from “inspecting, viewing, using, copying, distributing, relying on, or otherwise acting upon” the IRS return information obtained through the data-sharing arrangements, including the August 2025 transfer.

The government appealed that injunction to the U.S. Court of Appeals for the First Circuit as Case No. 26-1329. The district court’s August 24 order continued to describe that appeal as pending, and briefing in the First Circuit proceeded during the summer. No later First Circuit merits opinion resolving the appeal appeared on the court’s published-opinions feed in our final September 9 check.

What is less clear is whether every copy of the 47,289-record dataset has been destroyed.

IRS’s Romo declaration says Treasury asked DHS to arrange appropriate disposal of information associated with the narrower subset of requests later identified as having incomplete or insufficient ICE-supplied addresses. That is not the same as evidence that the entire dataset was erased.

The defensible answer as of September 9, 2026 is therefore:

ICE is judicially restricted from using the IRS-derived information, but the public record reviewed by sherafy.com does not establish that every copy of the full dataset has been destroyed.

Didn’t the same appeals court previously say IRS–ICE address sharing was legal?

Yes—but the two decisions answered different questions.

In Centro de Trabajadores Unidos v. Bessent, decided February 24, 2026, the D.C. Circuit considered a facial challenge to the IRS–DHS memorandum of understanding. The court held that §6103(i)(2) can permit the IRS to disclose taxpayer address information when a valid request for a qualifying non-tax criminal investigation actually satisfies the statute’s requirements.

The February court specifically said it was not deciding the legality of actions IRS or DHS took after finalizing the agreement.

That became the issue in the September case.

The agreement on paper promised valid requests, meaningful review, qualified investigations and properly involved officers. The actual automated system accepted address fields based on a crude digit test, did not meaningfully establish whether the designated officer was personally and directly engaged, and processed a massive batch using one common point of contact.

So there is no necessary contradiction:

February: IRS–ICE address sharing can be lawful if §6103’s requirements are actually met.

September: The procedure IRS actually implemented did not reliably enforce those requirements.

The September ruling therefore did not create a categorical rule that IRS can never provide an address to ICE.

Can ICE get an address connected to an ITIN in the future?

Potentially, yes, but only if the legal requirements are satisfied.

An Individual Taxpayer Identification Number, or ITIN, is a federal tax-processing number issued to people who need a U.S. taxpayer identification number but are not eligible for a Social Security number. An ITIN does not itself confer immigration status or work authorization.

The D.C. Circuit described the TIN matching used in this program as potentially involving either an SSN or an ITIN.

But there is no public breakdown showing how many of the 42,695 TIN-matched disclosures involved Social Security numbers and how many involved ITINs.

It would therefore be inaccurate to describe all 42,695 people as “ITIN filers.”

Likewise, the September ruling does not mean an address associated with an ITIN can never be disclosed to federal investigators. Section 6103 still contains its criminal-investigation exception. A future request that genuinely satisfies the statutory conditions could potentially qualify.

What the court rejected was a procedure that did not reliably enforce those conditions.

What is established—and what is not

The central lesson from the 1.28 million-to-47,289 gap

The unusual part of this episode is not simply that ICE requested a huge dataset or that only 3.7% produced IRS addresses.

It is the mismatch between how strict the system was when deciding whether two database records matched and how loose it was when checking whether the legal prerequisites for disclosure had actually been satisfied.

A misspelled name or differently formatted address could prevent a match.

Yet an incoming “address” containing little more than five digits could clear the statutory preprocessing check. A point-of-contact field could satisfy the system without proving that the person identified was actually handling the investigation. The same officer was used across approximately 1.28 million requests.

That is why the 47,289 figure should not be understood as 47,289 requests that survived rigorous individualized legal review.

They were the records that survived an automated data-matching pipeline whose legal safeguards, the D.C. Circuit concluded, did not actually implement key conditions Congress placed on access to confidential taxpayer information.

The litigation is not over. But the central mechanics are now unusually well documented: 1,277,464 submitted records became 47,289 IRS address disclosures because of matching; the court intervened because of the legality of the procedure that authorized those disclosures.

References and Further Reading

Primary court records and law

Center for Taxpayer Rights v. IRS — U.S. Court of Appeals for the D.C. Circuit, September 8, 2026 The controlling appellate opinion on the IRS Data-Exchange Procedure. It explains the matching architecture, statutory defects, 1.28-million request and preliminary-injunction ruling.

Centro de Trabajadores Unidos v. Bessent — U.S. Court of Appeals for the D.C. Circuit, February 24, 2026 The earlier facial challenge to the IRS–DHS agreement. Important for understanding why lawful §6103 disclosures remain possible and why the February and September rulings do not conflict.

Community Economic Development Center of Southeastern Massachusetts v. Bessent — District of Massachusetts preliminary-injunction order Contains the detailed chronology of ICE’s 7.6-million, 7.3-million and 1.28-million requests and the evidence concerning ICE’s subsequent use of the address data.

26 U.S.C. §6103 — Confidentiality and disclosure of returns and return information The federal tax-confidentiality statute at the center of the litigation, including the non-tax criminal-investigation exception.

8 U.S.C. §1253 — Penalties related to removal The criminal statute ICE cited for the June 27 batch. Its willfulness and conduct requirements are important to understanding why an old removal order alone does not establish the offense.

Inspector general and IRS evidence

TIGTA — The IRS Provided Addresses for Nearly 47,000 Persons to Immigration and Customs Enforcement The strongest audited source for the exact 1,277,464-record funnel, the 25,253 rejected records, 1,204,922 nonmatches, 47,289 disclosures and matching-system weaknesses.

Dottie A. Romo sworn IRS declaration, February 2026 IRS’s detailed description of the preprocessing rules, 42,695 TIN matches, 4,594 address matches and retrospective review of incomplete addresses. Its approximate 2.6% rejection estimate differs from TIGTA’s later exact count.

Additional authoritative context

IRS — Individual Taxpayer Identification Number (ITIN) Official IRS explanation of what an ITIN is and, importantly, what it does not confer.

Editorial currency note: Litigation over the IRS–ICE data-sharing arrangements remains active. The D.C. Circuit issued its latest opinion on September 8, 2026, and the related Massachusetts preliminary injunction has been appealed to the First Circuit. The operational status described here was checked through September 9, 2026 and should be updated if either appellate court issues a new order or opinion.