The opinion
United States Court of Appeals
FOR THE DISTRICT OF COLUMBIA CIRCUIT
Argued May 12, 2026 Decided September 8, 2026
No. 26-5006
CENTER FOR TAXPAYER RIGHTS, ET AL.,
APPELLEES
v.
INTERNAL REVENUE SERVICE, ET AL.,
APPELLANTS
Appeal from the United States District Court
for the District of Columbia
(No. 1:25-cv-00457)
Jacob E. Christensen, Attorney, U.S. Department of
Justice, argued the cause for appellants. With him on the briefs
were Brett A. Shumate, Assistant Attorney General, Eric D.
McArthur, Deputy Assistant Attorney General, and August E.
Flentje, Attorney.
Christopher J. Hajec and Matt A. Crapo were on the brief
for amicus curiae Federation for American Immigration
Reform in support of appellants.
2
Madeline Gitomer argued the cause for appellees. With
her on the brief were Simon C. Brewer, Daniel A. McGrath,
Steven Y. Bressler, and Robin F. Thurston.
Jeffrey S. Gutman was on the brief for amici curiae
Lawyers Defending American Democracy, Inc. in support of
appellees.
Andrew Weiner was on the brief for amici curiae 115
Members of Congress in support of appellees.
Before: MILLETT, PILLARD and WILKINS, Circuit Judges.
Opinion for the Court filed by Circuit Judge PILLARD.
PILLARD, Circuit Judge:
After the Watergate scandal exposed executive branch
abuses of U.S. taxpayers’ information to harass the
Administration’s enemies, Congress enacted a prohibition
against the Internal Revenue Service (IRS) sharing tax return
information with any other federal agency unless the requesting
agency meets stringent conditions. In response to requests
from Immigration and Customs Enforcement (ICE), in the
summer of 2025, the IRS developed a specialized procedure for
disclosing return information. The procedure failed to ensure
that ICE’s requests complied with statutory requirements. The
IRS nonetheless began using the procedure to disclose tens of
thousands of records.
Several groups sued. The IRS had turned over more than
47,000 records by the time the district court stayed the IRS
from using the new procedure and preliminarily enjoined
further disclosures without notice to the court. We affirm.
3
I.
A.
“Every year, millions of taxpayers submit sensitive,
personal information” to the IRS in the course of filing their tax
returns. Ctr. for Taxpayer Rts. v. Internal Revenue Serv., 815
F. Supp. 3d 1, 20 (D.D.C. 2025). As a result, “the IRS probably
has more information about more people than any other agency
in this country,” and “almost every other agency that has a need
for information about U.S. citizens, therefore, logically seeks it
from the IRS.” S. Rep. No. 94-938, at 316-17 (1976).
“Recognizing the value and sensitivity of tax information,”
Congress enacted 26 U.S.C. § 6103 to “regulate in minute
detail [its] disclosure.” Centro de Trabajadores Unidos v.
Bessent, 167 F.4th 1218, 1224-25 (D.C. Cir. 2026)
(modification in original) (quoting Lake v. Rubin, 162 F.3d
113, 115 (D.C. Cir. 1998)). In section 6103, Congress dictated
that taxpayers’ “[r]eturns and return information [are]
confidential,” and no federal employee “shall disclose any
return or return information obtained by him in any manner”—
even within the executive branch—unless a provision of Title
26 of the U.S. Code expressly authorizes disclosure. 26 U.S.C.
§ 6103(a).
As relevant to this case, section 6103(i)(2) authorizes the
IRS to disclose “return information” to other federal agencies
for use in specified non-tax criminal investigations. Id.
§ 6103(i)(2). (No statute authorizes the IRS to disclose “return
information” for non-tax civil investigations without the
taxpayer’s consent, or to disclose “taxpayer return
information” for any purpose, compare 26 U.S.C. § 6103(b)(2)
with id. § 6103(b)(3)). The “head of any Federal agency” can
request return information from the IRS for three purposes:
preparing for a judicial or administrative proceeding
4
“pertaining to the enforcement of a specifically designated
Federal criminal statute,” undertaking an “investigation which
may result in such a proceeding,” or proceeding before a grand
jury. Id. § 6103(i)(1)(A), (i)(2)(A). To submit such an
information request, the agency head must send a written
message to the Secretary of the Treasury identifying (i) “the
name and address of the taxpayer,” (ii) “the taxable period” of
the information requested, (iii) “the statutory authority” for the
proceeding or investigation, and (iv) “the specific reason or
reasons why such disclosure is, or may be, relevant to such
proceeding or investigation.” Id. § 6103(i)(2)(B)(i)-(iv). If the
agency head submits a compliant request, then the Secretary of
the Treasury “shall disclose” the requested information “to
officers and employees of such agency who are personally and
directly engaged in” the qualifying investigation, “solely for
the use of such officers and employees in [that] proceeding.”
Id. § 6103(i)(2)(A).
“The assurance of privacy secured by § 6103 is
fundamental to a tax system that relies upon self-reporting.”
Nat’l Treasury Emps. Union v. Fed. Lab. Rels. Auth., 791 F.2d
183, 184 (D.C. Cir. 1986). Underscoring the importance of
confidentiality, Congress has imposed civil and criminal
penalties on federal employees who “willfully . . . disclose”
return information in violation of section 6103. 26 U.S.C.
§ 7213(a)(1). As the IRS has explained, “[t]here is no
provision in the United States Code that authorizes the
disclosure or redisclosure of returns or return information for
enforcement of immigration laws.” Disclosures of Return
Information Reflected on Returns to Officers and Employees
of the Department of Commerce, Including the Bureau of the
Census, for Certain Statistical Purposes and Related Activities,
89 Fed. Reg. 93172, 93174 (Nov. 26, 2024) (codified at 26
C.F.R. § 301).
5
B.
Until 2025, the IRS had interpreted section 6103(i)(2) “to
prohibit disclosure of a taxpayer’s address when no other
information is requested.” Centro de Trabajadores Unidos,
167 F.4th at 1226. That spring, however, “news reports
emerged that [the Department of Homeland Security] had
asked IRS to disclose addresses of some undocumented
taxpayers.” Id. It came to light that the Department of
Homeland Security had entered into a Memorandum of
Understanding (MOU) with the IRS “to establish the
procedures and requirements for” ICE to submit putatively
“valid I[nternal] R[evenue] C[ode] § 6103(i)(2) requests for
addresses of persons subject to criminal investigation under 8
U.S.C. § 1253(a)(1)”—a statute that, among other things,
criminalizes willfully remaining in the United States beyond a
90-day grace period after a final order of removal has been
issued. DHS-ICE MOU 2 (App. 359).
With the MOU in place, ICE Acting Director Todd Lyons
sent a written request to the IRS seeking “the last known
address” for 1.28 million undocumented individuals. Lyons
Letter 1-2 (June 27, 2025) (App. 326-27); Romo Decl. ¶ 4, Ctr.
for Taxpayer Rts., 815 F. Supp. 3d 1 (D.D.C. 2025) (No. 25-
0457), Dkt. No. 66-1. Director Lyons’s letter announced that
ICE sought that information from the IRS because it “may
contain address information which is potentially at issue with
respect to investigating . . . a violation under 8 U.S.C.
§ 1253(a)(1).” Lyons Letter 1 (App. 326). On July 1, the IRS
gave its employees the “green light” to begin processing ICE’s
1.28 million requests. “Letter from ICE” Emails 1-2 (App.
440-41).
In response to ICE’s interest in return information
regarding more than a million individuals, the IRS developed a
6
protocol, the Data-Exchange Procedure, for responding to
ICE’s requests. See DHS-ICE Data Exchange Overview 1-4
(App. 462-65). The record in this case includes IRS documents
laying out the step-by-step mechanics of the Procedure. Id.
The Data-Exchange Procedure begins with the IRS
running a “[p]reprocessing task” that checks to ensure that
several fields of a data request from ICE are not blank. DHS-
ICE Data Exchange Overview 1 (App. 462). Of particular
relevance here, that check ensures the fields for first and last
name, taxable period, final removal-order date, address, and
ICE point of contact—indicating “the identity of the officer(s)
and/or employe(es) [sic] who are personally and directly
engaged in the criminal proceeding or criminal investigation”
concerning that taxpayer, Lyons Letter 1 (App. 326)—are “not
[] empty,” DHS-ICE Data Exchange Overview 1 (App. 462).
Importantly, while section 6103(i)(2) and the MOU
require the requesting agency to provide the “address of the
taxpayer,” 26 U.S.C. § 6103(i)(2)(B)(i); DHS-ICE MOU 3
(App. 360), the Data-Exchange Procedure merely checks
whether ICE supplied five or nine digits—any random five or
nine digits—in the address field within its request, DHS-ICE
Data Exchange Overview 1 (App. 462); Romo Decl. ¶¶ 6, 13.
To trigger IRS disclosure of tax return information under the
Data-Exchange Procedure, the five- or nine-digit number need
not even be an actual zip code, nor does ICE need to have
provided any other information, such as a street name, unit
number, city, or state. DHS-ICE Data Exchange Overview 1
(App. 462); Romo Decl. ¶ 13. And, although section
6103(i)(2) permits the IRS to disclose information only to
“officers and employees of [the requesting] agency who are
personally and directly engaged in” a qualifying criminal
investigation or proceeding, 26 U.S.C. § 6103(i)(2)(A), the
Data-Exchange Procedure requires no more than that the ICE
7
point of contact field “not be empty[,]” DHS-ICE Data
Exchange Overview 1 (App. 462). It thus fails to ensure that
the field contains a name, let alone the name of an ICE
employee responsible for a particular criminal investigation.
The Data-Exchange Procedure includes two methods for
the IRS to use after the preprocessing check to cull and provide
data to ICE.
First, the IRS checks whether ICE provided a Tax
Identification Number (TIN)—either a Social Security Number
(SSN) or an Individual Taxpayer Identification Number
(ITIN)—for the request. If ICE provided a TIN, the IRS runs
a search for that number in its internal database. DHS-ICE
Data Exchange Overview 1-2 (App. 462-63); Romo Decl.
¶ 8(a). If it finds the TIN in its records, the IRS then provides
ICE with its most recent address information corresponding to
the requested TIN, without regard to whether ICE supplied an
address in its request. See DHS-ICE Data Exchange Overview
1-3 (App. 462-64); Romo Decl. ¶ 13 (confirming that the IRS
“provided last known addresses to ICE in instances in which
the ICE-supplied address field . . . was either incomplete or
insufficiently populated”).
Second, if the ICE request lacks a TIN, the IRS uses the
name and address information provided by ICE to run a search
of its records for an individual whose name and past or present
address match the information provided by ICE. DHS-ICE
Data Exchange Overview 1-2 (App. 462-63). (The second
method, unlike the first, returns a result only if ICE supplies a
complete, matching address in its request.) Finally, the IRS
compiles the outputs of both methods and supplies the results
to ICE. DHS-ICE Data Exchange Overview 3 (App. 464).
Using the Data-Exchange Procedure, IRS has so far
identified and disclosed 47,289 records to ICE. Romo Decl.
8
¶ 10. More than 90% of the records were produced via the
TIN-matching method, id., meaning that the IRS never
confirmed whether the ICE request contained information
plausibly reflecting “the name and address of the taxpayer,” 26
U.S.C. § 6103(i)(2)(B)(i).
C.
Plaintiffs—the Center for Taxpayer Rights (the Center),
Main Street Alliance, and two labor unions—filed suit against
the IRS and a host of federal officials. Plaintiffs claimed that
the IRS unlawfully adopted a new policy governing disclosure
of return information to ICE, and they sought to “stay the
implementation” of that new policy. Ctr. for Taxpayer Rts.,
815 F. Supp. 3d at 18, 71. The IRS denied having adopted any
new policy. Id. at 40.
The district court made a factual finding that, “‘[a]lthough
the details of the [IRS’s] disclosure policy are still unclear, the
record leaves no doubt the [IRS] has a policy of disclosing
confidential information’ to ICE in a manner that it has not
previously been disclosed.” Id. at 40-41 (modifications in
original) (quoting Venetian Casino Resort, L.L.C. v. Equal
Emp. Opportunity Comm’n, 530 F.3d 925, 929-30 (D.C. Cir.
2008)). The district court concluded that plaintiffs were likely
to succeed in demonstrating that the new policy is unlawful, id.
at 45-58; that the new policy threatens to irreparably injure
plaintiffs, id. at 58-68; and that the equities support
preliminarily relief against the new policy and its further
implementation, id. at 68-72. The court entered an order
staying the policy under 5 U.S.C. § 705, preliminarily
enjoining defendants from disclosing taxpayer information
“except in strict compliance with the requirements of” section
6103(i)(2), and requiring defendants to inform the court before
responding to any future request from the Department of
9
Homeland Security for taxpayer information. Order of Nov.
21, 2025 (App. 1828-29).
The IRS appealed. After the district court transmitted the
record to this court, the IRS filed in district court a
supplemental declaration by its Chief Risk and Control Officer
(the Romo Declaration) explaining that the IRS had
“determined that it provided last known addresses to ICE in
instances in which” ICE’s request contained address
information for noncitizens that was “either incomplete or
insufficient[]”—i.e. that the IRS had provided information in
response to ICE requests that apparently did not meet statutory
preconditions to disclosure. Romo Decl. ¶¶ 1, 11-14. Plaintiffs
moved in this court for a limited remand so the district court
could supplement the record on appeal with the Romo
Declaration and consider the appropriateness of additional
discovery. Dkt. No. 2161752 at 1-2. A motions panel of our
court referred that motion to the merits panel. Dkt. No.
2166493 at 1.
II.
A plaintiff seeking preliminary relief “must establish
[1] that he is likely to succeed on the merits, [2] that he is likely
to suffer irreparable harm in the absence of preliminary relief,
[3] that the balance of equities tips in his favor, and [4] that an
injunction is in the public interest.” Winter v. Nat. Res. Def.
Council, Inc., 555 U.S. 7, 20 (2008). On appeal, we review for
abuse of discretion the district court’s decision to order
preliminary relief, “although we review the court’s underlying
legal conclusions de novo and factual findings for clear error.”
Atlas Air, Inc. v. Int’l Bhd. of Teamsters, 928 F.3d 1102, 1112
(D.C. Cir. 2019).
Pursuant to Federal Rule of Appellate Procedure 10(e)(2),
and based on the parties’ agreement, Oral Arg. Tr. 5:5-14, 49:3-
10
11, we accept the proffered Romo Declaration as a supplement
to the record on appeal. We accordingly dismiss as moot
plaintiffs’ motion for a limited remand.
III.
Because plaintiffs establish that they are likely to succeed
on the merits and the remaining equitable factors support
preliminary relief, we affirm the district court’s order.
A.
We begin with standing. At least one plaintiff, the Center
for Taxpayer Rights, is likely to succeed in establishing
standing.
Organizations “have standing ‘to sue on their own behalf
for injuries they have sustained’” so long as they “satisfy the
usual standards for injury in fact, causation, and
redressability.” Food & Drug Admin. v. All. for Hippocratic
Med., 602 U.S. 367, 393-94 (2024) (quoting Havens Realty
Corp. v. Coleman, 455 U.S. 363, 379 n. 19 (1982)). “To
demonstrate injury in fact, an organization must allege a
‘concrete and demonstrable injury to the organization’s
activities’ that is ‘more than simply a setback to the
organization’s abstract social interests.’” Am. Anti-Vivisection
Soc’y v. U.S. Dep’t of Agric., 946 F.3d 615, 618 (D.C. Cir.
2020) (quoting Havens Realty, 455 U.S. at 379). And causation
is shown where new activities, not previously part of the
organization’s “normal annual expenditures,” “became
necessary” in response to the injury, causing a “drain on the
organization’s resources.” Id. at 619 (quoting Havens Realty,
455 U.S. at 379). The Center has made those showings.
The Center has identified several ways in which the Data-
Exchange Procedure harms its interests, which include
11
“advancing taxpayer rights,” “promoting trust in the tax
system,” and “increasing access to justice in the tax system.”
Olson Decl. ¶ 3 (App. 168); see Ctr. for Taxpayer Rts., 815 F.
Supp. 3d at 28. The Center’s Executive Director attests that
reporting on “IRS’s new policy” has made many immigrant
taxpayers “less willing to come to the Center’s events, to seek
its guidance, or to engage with the Center’s education and
outreach.” Olson Decl. ¶ 41 (App. 178). And the Center’s pro
bono tax clinic has seen a “drastic” reduction of cases involving
taxpayers who lack social security numbers because potential
clients “fear . . . having their current status or location shared
with [the Department of Homeland Security]/ICE.” Id. ¶¶ 42,
44 (App. 179).
The IRS responds that the Center’s injury is not cognizable
because it “depends upon the independent choices of third
parties” who have “chosen to engage less with the Center.”
IRS Br. 26. But an injury may be premised “on the predictable
effect of Government action on the decisions of third parties.”
Dep’t of Com. v. New York, 588 U.S. 752, 768 (2019)
(reasoning that a citizenship question on the Census will
predictably depress Census participation rates in immigrant
communities). The district court reasonably found that many
taxpayers “are no longer willing to engage with the Center due
to the IRS’s” new policy and that the policy “has interfered
with the Center’s ability to provide its pro bono or nominal fee
representation services.” Ctr. for Taxpayer Rts., 815 F. Supp.
3d at 29.
The Center has also established that it is “divert[ing] and
redirect[ing] its limited resources to counteract and offset” the
effects of the IRS’s policy. People for the Ethical Treatment
of Animals (PETA) v. U.S. Dep’t of Agric., 797 F.3d 1087, 1095
(D.C. Cir. 2015). The Center’s Executive Director attests that
the Center has increased staffing “to focus on education and
12
outreach in light of the reduced trust in the tax system
engendered by the IRS’s policy change” and has reallocated
“nearly 10 percent” of the tax clinic’s operating expenses to
increase client outreach. Olson Decl. ¶¶ 45-46 (App. 179-80);
see Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 29. That is
sufficient to demonstrate the Center’s likely standing. See, e.g.,
Am. Anti-Vivisection Soc’y, 946 F.3d at 619.
The IRS insists that the Center may not “spend its way into
standing.” IRS Br. 24 (quoting All. for Hippocratic Med., 602
U.S. at 394). It is true that an organization may not establish
standing simply by spending money “opposing those policies”
that it “dislike[s].” All. for Hippocratic Med., 602 U.S. at 395.
But where, as here, a government action “directly affect[s] and
interfere[s] with” an organization’s “core business activities,”
and the organization “diverted its resources” to continue
pursuing those activities, such concrete harm to the
organization’s activities supports standing to sue. Id.
(discussing Havens Realty, 455 U.S. at 379); cf. Pierce v. Soc’y
of Sisters, 268 U.S. 510, 533 (1925) (private school could
challenge compulsory public-school attendance law based on
its “business . . . being destroyed and its property depreciated
[and] parents and guardians . . . refusing to make contracts for
the future instruction of their sons”).
Because we hold that the Center has made a “‘clear
showing’ that [it] is ‘likely’ to establish each element of
standing,” Murthy v. Missouri, 603 U.S. 43, 58 (2024) (quoting
Winter, 555 U.S. at 22), we need not address whether any other
plaintiff is likely to demonstrate standing.
B.
Next, the IRS argues that the Data-Exchange Procedure is
not subject to APA review because it is not final agency action.
13
IRS Br. 36 (citing 5 U.S.C. § 704). We conclude that plaintiffs
are likely to succeed in showing that the IRS took final action.
An action is “final” under the APA if (1) it “mark[s] the
consummation of the agency’s decisionmaking process” and
(2) “rights or obligations have been determined” by it or “legal
consequences will flow” from it. U.S. Army Corps of Eng’rs
v. Hawkes Co., 578 U.S. 590, 597 (2016) (quoting Bennett v.
Spear, 520 U.S. 154, 177-78 (1997)).
According to the IRS, the agency’s “only practice” is to
follow the terms of the MOU, which, in turn, merely require
the agency “to comply with § 6103(i)(2)’s disclosure
requirements.” IRS Br. 38. Further, the IRS contends, the
administrative record lacks an “agency statement pertaining to”
the Data-Exchange Procedure. Id. Lastly, the IRS argues that
following the MOU does not cause plaintiffs “direct and
appreciable legal consequences.” Id. at 39 (quoting Hawkes,
578 U.S. at 598).
None of those arguments holds up. The administrative
record amply documents the existence of the Data-Exchange
Procedure—an IRS policy for acting on taxpayer-information
requests under the MOU. That concededly statutorily deficient
process gives binding direction to IRS officials responding to
ICE requests. We accordingly hold that the Data-Exchange
Procedure is final agency action reviewable under the APA.
1.
Considerable evidence in the administrative record shows
that the Data-Exchange Procedure marks the consummation
and implementation of the IRS’s decision-making process on
how it discloses taxpayer information to ICE under the MOU.
14
First, the Data-Exchange Procedure is laid out in a final,
written document in the administrative record that prescribes
the steps of the process that IRS officials will follow to
implement the MOU and have already used to respond to
requests for information on at least 1.28 million taxpayers.
DHS-ICE Data Exchange Overview 1-4 (App. 462-65). There
is nothing “tentative or interlocutory” about it. Bennett, 520
U.S. at 178. The IRS also published multiple illustrated flow-
charts in a Guidance Document for use by agency officials that
further explain the Procedure. DHS-ICE Data Exchange
Guidance Document 1-5 (App. 473-77).
The Data-Exchange Procedure begins when the “IRS
receives [an] input file from DHS” via the specified software
system. DHS-ICE Data Exchange Overview 1 (App. 462).
The Procedure then details a “[p]reprocessing task” followed
by either a “[TIN]-Based Lookup” or “Name & Address-Based
Processing.” DHS-ICE Data Exchange Overview 1-2 (App.
462-63); see Romo Decl. ¶ 8(a) (confirming that TINs,
including but not limited to SSNs and ITINs, were used to
match records). Two data sheets are formulated: one that is
used for an internal review and check of results, and the second
prepared for release to ICE. DHS-ICE Data Exchange
Overview 3 (App. 464). After the internal review, a final data
sheet is released to ICE. DHS-ICE Data Exchange Overview
3 (App. 464). Both IRS files are then “stored in a secure
archival location.” DHS-ICE Data Exchange Overview 3
(App. 464).
The agency has not only finalized the process but has also
used it to make disclosures. Ms. Romo has attested that this
Data-Exchange Procedure was used to process at least 1.28
million ICE requests in August 2025. Romo Decl. ¶ 6 (citing
the Data-Exchange Procedure as the one used “to ensure
compliance with Section 6103 of the Tax Code and the MOU”
15
once the IRS is in “receipt of ICE’s letter and Datafile”); id. ¶ 8
(citing the same and confirming that the IRS matched records
using either the taxpayer’s TIN or “[a]ddress [m]atching”); id.
¶ 10 (describing request volume).
Use of the Data-Exchange Procedure by IRS personnel is
not optional. The Treasury’s Deputy General Counsel gave the
go-ahead to the IRS to “begin processing and sharing
information back to ICE.” “Letter from ICE” Emails 5 (App.
444); see also “Letter from ICE” 1 (App. 440) (email from IRS
Deputy Chief Counsel directing IRS to “begin processing the
request . . . and sharing information back to ICE”). The
Procedure effectuates that command by prescribing what
“will” happen upon receipt of an ICE request for taxpayer
information. DHS-ICE Data Exchange Overview 1-3 (App.
462-64); see also “DHS Notes for Briefing” Email 1 (App.
472) (noting that by following the Data-Exchange Procedure
“script,” “IRS will share matches, unmatched, and
rejects . . . to ICE”). The IRS’s lawyers describe the Procedure
as “IRS’s computerized process for validating ICE requests.”
IRS Reply Br. 12. They further “confirm that IRS followed
that process when responding to ICE’s request in August
2025,” id. See Biden v. Texas, 597 U.S. 785, 795, 807-09 &
n.7 (2022) (holding that an informal four-page memorandum
issued by the Secretary of the Department of Homeland
Security announcing the termination of the Migrant Protection
Protocols was final agency action when it created “employee[]
obligations” to implement the termination).
The Data-Exchange Procedure was not formally noticed or
published, but that is not a prerequisite for final agency action.
See Her Majesty the Queen in Right of Ontario v. EPA, 912
F.2d 1525, 1531 (D.C. Cir. 1990) (“[T]he absence of a formal
statement of the agency’s position, as here, is not dispositive:
An agency may not, for example, avoid judicial review ‘merely
16
by choosing the form of a letter to express its definitive position
on a general question of statutory interpretation.’” (quoting
Ciba-Geigy Corp. v. EPA, 801 F.2d 430, 438 n.9 (D.C. Cir.
1986))); Barrick Goldstrike Mines Inc. v. Browner, 215 F.3d
45, 48 (D.C. Cir. 2000) (“[W]e [have] rejected the proposition
that if an agency labels its action an ‘informal’ guideline it may
thereby escape judicial review under the APA.”).
The IRS argues that the agency’s “only practice in this
respect, consistent with the MOU, is to comply with
§ 6103(i)(2)’s disclosure requirements . . . as the statute
requires.” IRS Br. 38; Oral Arg. Tr. 16:23-25 (arguing that the
Data-Exchange Procedure is not final agency action because it
“simply reflects the agency’s views of what it is allowed to do
under the law”).
There are two fatal flaws in that argument. First, the Romo
Declaration—which the IRS itself filed with the district
court—refutes the contention that there is some other
procedure in place for processing ICE information requests that
hews to the requirements and limitations of section 6103. The
Declaration confirms that the IRS employed the Data-
Exchange Procedure in responding to at least 1.28 million
individual requests for information about listed taxpayers.
Romo Decl. ¶¶ 10, 13; see Excerpts of ICE Requests 1-6 (App.
434-39). And the Romo Declaration candidly acknowledges
that the Procedure operated as laid out in the Overview and
accompanying illustrated guidance by “provid[ing] last known
addresses to ICE” even when the address field “was either
incomplete or insufficiently populated.” Romo Decl. ¶ 13.
The policy thereby requires official action in direct violation of
section 6103(i)(2) and the MOU. 26 U.S.C. § 6103(i)(2)(B)(i);
DHS-ICE MOU 2 (App. 359) (MOU commitment that IRS will
“return to ICE any requests not meeting the requirements
necessary for disclosure pursuant to IRC § 6103(i)(2)”).
17
Second, the record contradicts the IRS’s argument that the
Data-Exchange Procedure is just a statement of the agency’s
view of what the law means. The enumerated steps of the
Procedure demonstrate that it is the actual, on-the-ground
policy. The IRS has used it to produce 47,289 individual
records for ICE, Romo Decl. ¶¶ 10, 12, largely through a
process that failed to ensure compliance with the statute and
the MOU, see id. ¶¶ 10, 13 (for 90.3% of the matches IRS
produced to ICE, the Data-Exchange Procedure failed to check
whether ICE provided a valid address); Oral Arg. Tr. 9:1-3
(acknowledging that the implementation of the Data-Exchange
Procedure resulted in “concededly unlawful” transfers); id. at
9:10-11 (same); see also Section III.D, infra. When an agency
implements a policy choice, putting it into motion in a way that
leads to concrete results and prescribes consequences, it takes
final agency action. See Biden, 597 U.S. at 809-10 (holding
that “an ‘agency statement . . . designed to implement,
interpret, or prescribe law or policy’” is reviewable
(modification in original) (quoting 5 U.S.C. § 551(4)); Lujan v.
Nat’l Wildlife Fed’n, 497 U.S. 871, 890 n.2 (1990) (explaining
that when an agency “appl[ies] some particular measure across
the board to all” affected persons, that action “can of course be
challenged under the APA”).
The Data-Exchange Procedure is the type of “operative
agency action[],” Biden, 597 U.S. at 810, that qualifies as final
because it makes concrete the agency’s policy decision to allow
disclosures of confidential taxpayer information on specified
terms. Diverging significantly from the requirements of
section 6103(i)(2), the Procedure requires the IRS to return
taxpayer data to ICE even when ICE fails to provide the
taxpayer’s address as required by law and the MOU. As long
as ICE offers any random five or nine digits in the “address”
field of its request, the Data-Exchange Procedure validates the
request and generates the taxpayer’s information to provide to
18
ICE. DHS-ICE Data Exchange Overview 1-2 (App. 462-63)
(only requiring that ICE-provided address field “not be empty”
and “contain zip code”); Romo Decl. ¶¶ 6, 13 (acknowledging
that the Data-Exchange Procedure accepted any five- or nine-
digit number as a “proxy” for a zip code and did not require the
provision of any other address information); Oral Arg. Tr.
24:23-24 (“[T]he thinking was . . . that [the number] would
serve as an accurate proxy.”); see also Ctr. for Taxpayer Rts. v.
Internal Revenue Serv., No. 25-cv-457, 2026 WL 551105, at
*3 (D.D.C. Feb. 26, 2026) (“A zip code is not an address, and
a zip code proxy, as the IRS would define it, might as well be
a set of random numbers. For instance, ICE could have
submitted a request with an ‘address’ like, ‘Don’t Care 12345,’
or, ‘00000,’ and still received a taxpayer’s address through the
IRS’s TIN Matching process.”). The IRS’s operative policy to
provide information on those terms flies in the face of the
statutory command that the IRS share return information only
when the requesting agency provides “the name and address of
the taxpayer with respect to whom the requested return
information relates.” 26 U.S.C. § 6103(i)(2)(A), (B)(i)
(emphasis added).
Presumably that is why counsel for IRS candidly conceded
that the Data-Exchange Procedure does not comply with the
requirements of section 6103(i)(2) or the MOU. See Oral Arg.
Tr. 15:17-19 (“With respect to the extent [the Data-Exchange
Procedure] doesn’t require an address, it’s an error in
implementing the policy [as previously laid out in the
MOU].”); id. at 28:11-13 (“[T]he Government would readily
admit that there were mistakes made[,] that some information
was disclosed not in compliance with the statute.”). While the
MOU merely tracked the language and bounds of section
6103(i)(2), see Centro de Trabajadores Unidos, 167 F.4th at
1236, the Data-Exchange Procedure veers off that course.
Such an “unannounced departure in practice from a written
19
[policy]” is reviewable final agency action. Hisp. Affs. Project
v. Acosta, 901 F.3d 378, 387 (D.C. Cir. 2018); Immigr. Nat’y
Serv. v. Yueh-Shaio Yang, 519 U.S. 26, 32 (1996) (an agency’s
“irrational departure from [a] policy (as opposed to an avowed
alteration of it) could constitute action . . . within the meaning
of the [APA]”).
The Data-Exchange Procedure also represents a dramatic
change in agency policy from individualized review of records
submitted under section 6103(i)(2) to a mass, automated
review of millions of records at the press of a button. Before
April 17, 2025, the IRS’s Internal Revenue Manual provided
detailed instructions for IRS “Disclosure Managers” to process
individual records requested under section 6103(i)(2). IRM
11.3.28.2 (July 23, 2018). That process included contacting the
requesting official assigned to the individual criminal case
(“usually the Assistant United States Attorney”) to “[i]nquire”
about the relevant court date and to “[d]iscuss alternative”
disclosure options that would be less intrusive on
confidentiality, such as “offering a transcript in lieu of a
return.” Id. Further, the “Disclosure caseworker” was required
to “review all releases of documents” to make sure that only
material covered by section 6103(i)(2) was released to the U.S.
Attorney’s Office. Id.
That is a far cry from the current Data-Exchange
Procedure, which automates the review of millions of records
without any individual review or any other means of ensuring
compliance with the legal prerequisites to releasing each
individual taxpayer’s information. See DHS-ICE Data
Exchange Overview 1-4 (App. 462-65). Such a substantial and
material change in policy is yet another indication that the
Procedure is final agency action. See Nat’l Env’t Dev. Ass’n’s
Clean Air Project v. EPA, 752 F.3d 999, 1007 (D.C. Cir. 2014)
(“If an agency action announces a binding change in
20
its . . . policy which immediately affects the rights and
obligations of regulated parties, then the action is likely final
and subject to review.”).
Finally, the record shows that the Data-Exchange
Procedure will be applied on an ongoing basis. The IRS’s
illustrated guidance document explaining the Data-Exchange
Procedure calls it an “[o]n demand process,” underscoring that
it can and will be used whenever ICE sends data requests to the
IRS going forward. DHS-ICE Data Exchange Guidance
Document 1 (App. 473). And a few pages later, that document
includes a list of “Discussion points,” including “volume &
frequency of the data we are expecting.” DHS-ICE Data
Exchange Guidance Document 4-5 (App. 476-77). The fact
that the IRS was having either internal discussions or strategic
planning sessions with ICE discussing the “volume” and
“frequency” of expected incoming requests further
demonstrates that the Data-Exchange Procedure was designed
for continued use.
Importantly, the IRS has indicated that the Data-Exchange
Procedure remains operational with, at best, the possibility of
unknown adjustments. See Oral Arg. Tr. 46:17-20 (IRS
Counsel: “What action IRS has since taken to remedy the error,
I can only speculate. I’m not aware of what, if any, action IRS
has done to correct the [error].”); id. at 47:14-16 (IRS Counsel:
“As far as changing the computer process, I can only speculate
what’s happened.”); id. at 48:19-20 (IRS Counsel: “I’m not
aware of what action IRS has taken” to fix the Data-Exchange
Procedure). In any event, “[t]he mere possibility that an agency
might reconsider [its action] in light of ‘informal discussion’
and invited contentions of inaccuracy [from regulated parties]
does not suffice to make an otherwise final agency action
nonfinal.” Sackett v. EPA, 566 U.S. 120, 127 (2012).
21
For those reasons, the IRS’s formal Data-Exchange
Procedure, as written and implemented, constitutes the
consummation of the agency’s decision making on how it will
share—and has shared—confidential taxpayer information
with ICE.
2.
The Data-Exchange Procedure is also an agency action
“by which ‘rights or obligations have been determined.’”
Bennett, 520 U.S. at 178 (quoting Port of Boston Marine
Terminal Ass’n v. Rederiaktiebolaget Transatlantic, 400 U.S.
62, 71 (1970)).
An agency action carries “direct and appreciable legal
consequences” sufficient to render it final when it imposes new
restrictions or obligations on government officials. Id. For
example, the Court in Bennett held that the Secretary of the
Interior took final action when he issued an opinion that
“authoriz[ed another agency] to take [an] endangered species
if (but only if) it complies with the prescribed conditions.” Id.
The Secretary’s opinion “alter[ed] the legal regime to which
the [other] agency is subject,” and accordingly was final
agency action. Id.
Applying that precedent, we have held that EPA guidance
was final when it “altered the legal regime by resolving” a
question about states’ obligations under the Clean Air Act. See
Nat. Res. Def. Council v. EPA, 643 F.3d 311, 320 (D.C. Cir.
2011). Before the guidance, EPA regional directors “retained
discretion” to reject certain state proposals “solely for failing
to comply with” the statute, without considering whether a
state’s alternative, “not less stringent” program satisfied the
statute. Id. at 319. The guidance removed that discretion,
directing that states’ alternatives be considered, thereby
“bind[ing] EPA regional directors and thus qualif[ying] as final
22
agency action.” Id. at 320 (citing Bennett, 520 U.S. at 177-78).
By the same token, in Center for Auto Safety v. National
Highway Traffic Safety Administration, we concluded that the
agency’s guidelines did not determine rights or obligations, and
thus were not final agency action, because the agency “has not
commanded, required, ordered, or dictated” that “officials in
[the National Highway Traffic Safety Administration’s] Office
of Defects Investigation are bound to apply the guidelines”—
nor did any evidence indicate that the agency had so bound
itself. 452 F.3d 798, 808-09 (D.C. Cir. 2006).
The Data-Exchange Procedure is final because it binds
IRS officials. It “alter[s] the legal regime” to which the IRS’s
processing of ICE return-information requests “is subject.”
Bennett, 520 U.S. at 178. Specifically, the Procedure sets out
the conditions under which IRS employees are required to
transfer confidential taxpayer data to ICE. See DHS-ICE Data
Exchange Overview 1-4 (App. 462-65). And it removes IRS
employees’ discretion to reject a request for failure to meet
certain statutory requirements. From July to August 2025, the
IRS developed the Data-Exchange Procedure and then started
using it in determining whether to respond to ICE requests
concerning 1.28 million taxpayers. See IRS Correspondence
Emails and Teams Meetings (App. 456-61, 468-71, 78); Romo
Decl. ¶ 10.
Finally, the Data-Exchange Procedure reduces
noncitizens’ privacy rights in their tax returns. By providing a
distinct, automated pathway for ICE to request noncitizens’
information, the Data-Exchange Procedure deprives
noncitizens of the protections that section 6103 guarantees to
all taxpayers.
23
* * *
Because the Data-Exchange Procedure marks the
consummation of the IRS’s decision to turn over confidential
taxpayer information to ICE, and because legal consequences
flow from it, the Data-Exchange Procedure is final agency
action that is reviewable under the APA.
C.
The IRS contends that the Internal Revenue Code
implicitly precludes APA review because the Code expressly
provides for civil damages for certain failures to comply with
section 6103 and even authorizes criminal charges for willful
violations. See IRS Br. 42 (asserting that APA claims are
precluded by the Code’s “comprehensive remedial scheme for
violations of 26 U.S.C. § 6103”). The APA supplies a cause of
action for plaintiffs to challenge “final agency action for which
there is no other adequate remedy in a court.” 5 U.S.C. § 704.
If another statute creates a “special and adequate review
procedure” for particular agency actions, that alternative
scheme “oust[s] a district court of its normal jurisdiction under
the APA.” Bowen v. Massachusetts, 487 U.S. 879, 904 (1988).
But a statute that provides only “doubtful and limited relief”
has no such effect, so cannot be read to displace the APA by
implication. Id. at 901.
The provisions that the IRS identifies in the Internal
Revenue Code offer only “doubtful and limited” relief,
inadequate to remedy the harm plaintiffs here claim. Id. The
Code provides no mechanism to review, set aside, or enjoin
IRS policies implementing section 6103. It provides a claim
against the United States only for actual damages if “any
officer or employee of the United States knowingly, or by
reason of negligence, inspects or discloses any return or return
information . . . in violation of . . . section 6103,” and punitive
24
damages for willful disclosures or disclosures due to gross
negligence. 26 U.S.C. § 7431(a)(1), (c)(1)(B)(ii). It also
authorizes the United States to press a felony charge against
any “officer or employee of the United States” who
“willfully . . . disclose[s]” return information in violation of
section 6103. Id. § 7213(a)(1). But neither of the Internal
Revenue Code consequences that the IRS identifies holds the
agency itself accountable for unlawful official actions or
“would provide plaintiffs anything like the relief they seek,”
Humane Soc’y of the U.S. v. Vilsack, 797 F.3d 4, 11 (D.C. Cir.
2015), so neither precludes application of the APA.
No other evidence indicates that Congress sought to
exempt the IRS from ordinary APA review. “When
considering whether an alternative remedy is ‘adequate’ and
therefore preclusive of APA review, we look for ‘clear and
convincing evidence’ of ‘legislative intent’ to create a special,
alternative remedy and thereby bar APA review.” Citizens for
Resp. & Ethics in Washington (CREW) v. U.S. Dep’t of Just.,
846 F.3d 1235, 1244 (D.C. Cir. 2017) (quoting Garcia v.
Vilsack, 563 F.3d 519, 523 (D.C. Cir. 2009)). We decline to
conclude that Congress, by attaching criminal and civil
consequences to individual employees’ violations of section
6103, meant to bar APA review of IRS policies implementing
the section. If anything, the criminal and civil penalties in the
Code underscore Congress’s seriousness about the
confidentiality of taxpayer information. They do not substitute
for APA review of IRS policies. See Tierney v. Schweiker, 718
F.2d 449, 457 (D.C. Cir. 1983) (“The availability of a $1,000
damage remedy after the information is released fails to protect
[taxpayers’] right to confidentiality.”). Given that plaintiffs
here can access no statutory remedy “of the same genre” as
APA review, they may bring suit under the APA. El Rio Santa
Cruz Neighborhood Health Ctr., Inc. v. U.S. Dep’t of Health
and Hum. Servs., 396 F.3d 1265, 1275 (D.C. Cir. 2005)
25
(quoting Women’s Equity Action League v. Cavazos, 906 F.2d
742, 751 (D.C. Cir. 1990)).
D.
Having dispensed with threshold issues, we turn to the
merits. The Center is likely to succeed in demonstrating that
the Data-Exchange Procedure is contrary to law. 5 U.S.C.
§ 706(2)(A).
The Data-Exchange Procedure indisputably contravenes
the requirements of section 6103. Most egregiously, section
6103(i)(2) expressly requires a requesting agency to provide
the “address of the taxpayer” whose information the agency
seeks, 26 U.S.C. § 6103(i)(2)(B)(i), but the Data-Exchange
Procedure does not require ICE to submit any address of the
taxpayer in its request for information about that taxpayer,
DHS-ICE Data Exchange Overview 1 (App. 462). The
Procedure requires only that the IRS provide some five- or
nine-digit number in the address field. See Romo Decl. ¶ 13.
Under the Data-Exchange Procedure, the IRS has
produced individual taxpayer records—including last known
addresses—in response to ICE requests listing an address as
“Unknown Address,” “Failed to Provide,” or “NA NA.” Id.
IRS also produced records in response to ICE requests
providing a partial address lacking critical information, such as
“a street name or street number.” Id. Those IRS disclosures
establish that the Data-Exchange Procedure contravenes
section 6103(i)(2), as counsel for IRS acknowledged at oral
argument. Oral Arg. Tr. 8:19-9:3, 9:10-11.
Next, the Data-Exchange Procedure fails to implement the
statutory requirement that the IRS disclose responsive
information about a taxpayer only to individuals “personally
and directly engaged” in the qualifying criminal proceeding or
26
investigation concerning that taxpayer. 26 U.S.C.
§ 6103(i)(2)(A). The Data-Exchange Procedure calls for ICE’s
taxpayer-information requests to include a “point of contact
field” indicating “the identity of the officer(s) and/or
employe(es) [sic] who are personally and directly engaged in
the criminal proceeding or criminal investigation” concerning
that taxpayer. Lyons Letter 1 (App. 326); see DHS-ICE Data
Exchange Overview 1, 4 (App. 462, 465) (requiring each ICE
request to contain an “ICE-POC” field). But the Procedure
validates a request so long as the ICE point of contact field is
“not [] empty.” DHS-ICE Data Exchange Overview 1 (App.
462). The Procedure thus requires the IRS to respond to a
request even if ICE lists the point of contact as “Unknown” or
“TBD.” It entirely fails to ensure that ICE lists a federal
employee, let alone one “personally and directly engaged” in a
qualifying investigation of a particular taxpayer.
That failure has serious consequences. When ICE
requested information on 1.28 million taxpayers in the summer
of 2025, ICE identified the same person as the point of contact
for every single request. Ctr. for Taxpayer Rts., 815 F. Supp.
3d at 46. The district court found it facially implausible “that
a single individual could be ‘personally and directly engaged’
in approximately 47,000 criminal matters” against taxpayers
whose information the IRS supplied, “let alone 1.28 million of
them” against all the taxpayers whose information ICE sought.
Id. at 48. Citing ICE’s early-June 2025 requests for
information on “the full alien population” of more than 7
million people that ICE asserted had improperly entered the
United States, and its requests later that month for information
on more than 1 million people whom ICE asserted had stayed
more than 90 days after a removal order, the district court found
it “unreasonable to think that, in one month, the same Assistant
Director could be ‘personally and directly engaged’ in 7.6
million criminal matters under one statute and 1.2 million
27
criminal matters under another.” Id. at 66. Assessing those
assertions together with the government’s acknowledgement
that ICE sought the information to support the White House’s
mass deportation agenda, the district court concluded that the
record “raises an inference that ICE’s representation that it is
conducting criminal investigations under 8 U.S.C. § 1253(a)(1)
was pretext.” Id. at 66-67.
The IRS advances one theory of how a single ICE officer
might oversee so many investigations: It asserts that an officer
can easily screen the IRS disclosures to determine “whether
and how many of [the 1.28 million targeted individuals] are
present in the United States at times after issuance of the
removal order in violation of the criminal statute.” IRS Br. 55
(emphasis added). But that theory is a nonstarter. The lone
ICE officer who purportedly handles the mass investigation
cannot simply compare the date of the final order to the date of
the IRS’s last known address. Under the Data-Exchange
Procedure, IRS does not disclose a date for the address
information it supplies to ICE. It provides only the “IRS last
known address.” DHS-ICE Data Exchange Overview 3 (App.
464); see Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 49, 54. The
Procedure thus likely caused IRS to violate section
6103(i)(2)(A) and systematically will cause IRS to continue to
ignore that statutory requirement.
Plaintiffs identify still more ways in which the IRS’s
disclosures under the Data-Exchange Procedure were likely
illegal. For one, plaintiffs explain that the IRS failed to require
ICE to provide a “specific reason” why the requested return
information “is or may be relevant to [a qualifying] proceeding
or investigation,” as the statute demands. Appellees’ Br. 45-46
(quoting 26 U.S.C. § 6103(i)(2)(B)(iv)). The IRS accepted a
cover letter accompanying a batch of 1.28 million requests
from ICE that merely stated that “the reason why each
28
requested disclosure is[] or may be[] relevant to such
proceeding or investigation is that the requested information
may contain address information which is potentially at issue
with respect to investigating or proving a violation under 8
U.S.C. § 1253(a)(1).” Lyons Letter 1 (App. 326). It beggars
belief to call that vague, unbounded reasoning “specific.” See
Specific (2a), Merriam-Webster, https://www.merriam-
webster.com/dictionary/specific [https://perma.cc/BS86-
MSLZ] (“restricted to a particular individual [or] situation”).
The plain text of the statute requires, at a minimum, that the
requesting agency offer a theory of the relevance of the
requested information to the qualifying proceeding or
investigation. ICE instead offered a reason “more circular than
specific,” Ctr. for Taxpayer Rts., 815 F. Supp. 3d at 54, and the
IRS flouted its own statutory obligation when it accepted that
facially non-specific “reason” as sufficient to enable it to
provide information pursuant to ICE’s requests.
It remains unclear whether the IRS’s failure to demand a
specific reason is a one-time result of the IRS’s approval of
Director Lyons’s June 27, 2025, cover letter or a persistent
feature of the Data-Exchange Procedure. See “Letter from
ICE” Emails 1 (App. 440) (IRS determination that the Lyons
Letter “satisfies the written request provisions in the MOU and
meets the requirements of the statute”). We need not resolve
that question at this preliminary stage: The Procedure
continues to govern the IRS’s response to ICE requests and
clearly violates section 6103(i)(2) in at least two other ways
already discussed, so plaintiffs have established that they are
likely to succeed on the merits of their APA challenge.
The IRS is now on notice twice over regarding the legal
inadequacies of its summer 2025 disclosures. The government
and its personnel face steep civil and criminal consequences for
willful disclosure of information in violation of section 6103.
29
26 U.S.C. §§ 7213(a)(1), 7431(c)(1). As this court has already
cautioned, “we expect that, going forward, [the] IRS will
adhere to the representations made before this court regarding
the address requirement,” and we stress that the same applies
to the other requirements of section 6103. Centro de
Trabajadores Unidos, 167 F.4th at 1232.
E.
Turning to the remainder of the Winter factors, we
conclude that the district court acted within its sound discretion
when it issued preliminary relief.
Plaintiffs have demonstrated “a likelihood of irreparable
injury.” League of Women Voters v. Newby, 838 F.3d 1, 8-9
(D.C. Cir. 2016) (citing Winter, 555 U.S. at 22). A threatened
injury is irreparable if it is “‘certain and great,’ ‘actual and not
theoretical,’” and “beyond remediation” at a later date. Id. at
7-8 (quoting Chaplaincy of Full Gospel Churches v. England,
454 F.3d 290, 297 (D.C. Cir. 2006)). An organization faces
irreparable harm when it sues to challenge “new obstacles
[that] unquestionably make it more difficult for the
[organization] to accomplish [its] primary mission” in
circumstances where “there can be no do over and no redress.”
Id. at 9 (quoting League of Women Voters of N.C. v. North
Carolina, 769 F.3d 224, 247 (4th Cir. 2014)). For example, we
have held that a voter education and mobilization organization
suffers irreparable harm when state law hinders its ability to
register voters in the run-up to an election deadline. See id. at
8-9.
As binding law defines it, the injury the Center claims is
irreparable. The Center carries out its mission by representing
low-income taxpayers in tax proceedings with strict deadlines.
See Olson Decl. ¶¶ 83-89 (App. 189-92); Ctr. for Taxpayer
Rts., 815 F. Supp. 3d at 59. Just as there are no do-overs for
30
voters entitled to participate in elections, there are none for the
Center’s taxpayer-clients who face IRS deadlines. If the Center
fails to engage a potential client in time, it may permanently
lose the opportunity to help that person obtain relief. The
district court found that the Center has provided sufficient
evidence, at this stage of the litigation, to show that the Data-
Exchange Procedure hinders its ability to provide time-
sensitive services. Ctr. for Taxpayer Rts., 815 F. Supp. 3d at
59. In addition, the district court found that the Data-Exchange
Procedure created a serious threat to the Center’s work. Id. at
59-60; see Olson Decl. ¶ 52 (App. 182) (“We cannot fulfill our
mission if we cannot reach the communities we serve . . . . An
extended period of mass data sharing with ICE is very likely to
permanently obstruct the Center’s ability to accomplish its
mission.”). And the IRS has identified no reason to think that
the district court clearly erred in either assessment.
The remaining preliminary injunction factors—the
balance of equities and the public interest—“merge when the
Government is the opposing party.” Nken v. Holder, 556 U.S.
418, 435 (2009). “[T]here is a substantial public interest in
having governmental agencies abide by the federal laws that
govern their existence and operations.” Newby, 838 F.3d at 12
(quoting Washington v. Reno, 35 F.3d 1093, 1103 (6th Cir.
1994)). In contrast, “[t]here is generally no public interest in
the perpetuation of unlawful agency action.” Id. Plaintiffs thus
have the better of the balance, as they seek to prevent the IRS
from making unlawful disclosures.
The IRS asserts that the district court’s order “impedes and
delays federal law enforcement by improperly restricting the
information that ICE is entitled to receive from IRS under
§ 6103(i)(2) for use in criminal investigations.” IRS Br. 66.
But that’s a gripe with Congress, not the court. As we have
explained, the Data-Exchange Procedure is likely contrary to
31
law. See Section III.D, supra. The government has no
legitimate interest in conducting criminal investigations in
violation of the statute. The IRS also asserts that the
preliminary injunction is “highly unusual and harmful”
because it requires the IRS to provide the district court with
“prior notice of criminal investigatory activity.” IRS Br. 66.
That argument is weak sauce where the district court has
permitted the IRS to file any necessary notifications “under
seal,” thereby shielding any criminal investigative activity
from disclosure. Order of Nov. 21, 2025 (App. 1828-29).
Importantly, the district court’s advance notice requirement
reasonably balances the government’s interest in making
lawful disclosures with the plaintiffs’ interest in preventing
unlawful disclosures that, if made, would likely be difficult or
impossible to remedy. See Ctr. for Taxpayer Rts., 815 F. Supp.
3d at 71-72.
F.
Finally, the IRS contends that the district court erred by
entering relief that extended beyond the parties, pointing to
Trump v. CASA, Inc., 606 U.S. 831 (2025). IRS Br. 67-68. But
“CASA does not control the scope of relief available under” 5
U.S.C. § 705. Make the Rd. N.Y. v. Noem, No. 25-5320, 2025
WL 3563313, at *34 (D.C. Cir. Nov. 22, 2025) (Statement of
Millett and Childs, JJ.); cf. CASA, 606 U.S. at 847 n.10
(“Nothing we say today resolves the distinct question whether
the Administrative Procedure Act authorizes federal courts to
vacate federal agency action.”). Section 705 is one of the two
provisions supporting the district court’s remedial order, and it
allows a district court to preliminarily “postpone the effective
date of an agency action” when “necessary to prevent
irreparable injury.” 5 U.S.C. § 705. As a textual matter, stays
entered under section 705 “operate on the legal source of
authority for an agency to act at all” so “do not simply insulate
32
certain parties from enforcement measures.” Make the Rd.,
2025 WL 3563313, at *35 (Statement of Millett and Childs,
JJ.).
What is more, the IRS fails to explain how the district court
could have crafted narrower relief capable of redressing
plaintiffs’ irreparable injuries. The Center’s injuries, in
particular, stem from the very existence of the Data-Exchange
Procedure, which undermines the Center’s ability to reach and
represent clients. The Center does not fear that the IRS will
unlawfully disclose its own information; rather, it suffers
because the Procedure eviscerates the statutory privacy rights
on which its clients depend when they access the Center’s
services. There is no way to redress the Center’s injury without
“incidentally” benefitting the nonparties whose information
might otherwise be disclosed. See CASA, 606 U.S. at 851-52.
The district court thus acted within its sound discretion when it
preliminarily enjoined the IRS from using the Data-Exchange
Procedure.
IV.
For the foregoing reasons, we affirm the district court’s
order of November 1, 2025, staying the Data-Exchange
Procedure under section 705 and preliminarily enjoining
further disclosures without notice to the court.
So ordered.