Trump v. IRS: A High-Stakes Test of Taxpayer Privacy Rights

This article was originally published in Tax Notes Federal on March 16, 2026 and republished here with permission.

In this article, David Gair and Gibson Odderstol examine President Trump’s unprecedented lawsuit against the IRS for the unauthorized disclosure of his tax return information.

President Trump’s tax returns have been a hot topic since he failed to release his returns during the 2016 presidential campaign. This bucked a decades-long tradition in which every major party candidate for president since 1980 had released their tax returns during the campaign. Trump said he would release his returns once his IRS audit was completed.¹ The exhaustive coverage of this saga has evolved once again: Trump’s recently filed suit against the IRS presents a new chapter of controversy not only for him and his tax returns, but also for the law that protects taxpayer privacy rights.²

I. Background

In April 2019 the chair of the House Ways and Means Committee, Rep. Richard E. Neal, D-Mass., made a request to the IRS for then-President Trump’s tax returns for the years 2013 to 2018. The committee’s first attempt was rejected by the Treasury Department, at the time led by Trump appointee Steven Mnuchin, who said there was no legitimate legislative basis for the request.³

Later that year, Charles Littlejohn, an employee of Booz Allen Hamilton and an IRS contractor (more on that later), stole the tax records of many notable and wealthy individuals.⁴ Included in that theft were 15 years of Donald Trump’s tax returns, which Littlejohn leaked to The New York Times between August and October 2019, with the story released in a series of articles in September 2020.⁵

At a White House briefing on September 27, 2020, Trump denied the New York Times story and called it “a total fake,” claiming that he pays “a lot” in federal income taxes, saying, “I pay a lot, and I pay a lot in state income taxes.”⁶

Neal made an updated request in 2021 seeking Trump’s 2015 to 2020 tax returns and related information, and the Treasury Department’s Office of Chief Counsel determined that the IRS was required to comply.⁷

Trump then sued to block the disclosure of his tax returns to the committee, arguing that it lacked a legitimate purpose and that the real motive was to expose Trump’s finances and gather evidence for a criminal case. Trump lost at both the federal district court level and at the D.C. Circuit. The legal battle lasted over three years, and on November 22, 2022, the Supreme Court refused to block the Ways and Means Committee’s request for Trump’s tax returns, with no noted dissents.⁸ The Treasury Department complied with the decision and transferred the records on November 30, 2022.⁹ On December 20, 2022, the Ways and Means Committee voted 24 to 16 along party lines to release redacted versions of Trump’s tax returns. The committee released six years of Trump’s personal and business returns, ending years of legal wrangling and speculation.

Meanwhile, on December 13, 2022, the billionaire CEO of the hedge fund Citadel LLC, Ken Griffin (one of the individuals whose information was stolen by Littlejohn), filed a suit against the IRS in the U.S. District Court for the Southern District of Florida over the unauthorized disclosure of his tax information.¹⁰ Griffin was alerted to this breach when ProPublica published an article on “America’s top 15 earners” on April 13, 2022.¹¹ On October 12, 2023, Littlejohn pleaded guilty to disclosing tax return information without authorization in violation of section 6103.¹² The following day, Griffin amended his complaint to identify Littlejohn as the source of the IRS leak and to address the attendant legal complications that a conviction would bring.¹³ Griffin and the IRS settled this suit on June 25, 2024, after the court ruled on the IRS’s motion to dismiss partially in favor of Griffin. In exchange for dropping the suit, the IRS issued a public apology for the leak and committed to a greater focus on information security.¹⁴

On January 29, 2026, Trump, his sons Donald Jr. and Eric, and his corporate entities filed a lawsuit against the United States, seeking billions in damages for the unauthorized disclosure of his tax return information. The suit, filed in the U.S. District Court for the Southern District of Florida, alleges that an IRS employee illegally leaked years of confidential tax data to news organizations, leading to their widespread publication.¹⁵ This case places a spotlight on the civil remedies available to taxpayers under section 7431 and the Privacy Act of 1974, presenting significant legal hurdles for the plaintiff, particularly concerning the statute of limitations, the defendant’s employment status, and the fundamental requirement of proving damages.

II. The Basic Elements of an Unauthorized Disclosure Claim

To succeed in a civil action for damages under section 7431, a plaintiff must prove several key elements. The statute provides a cause of action if “(1) any officer or employee of the United States (2) knowingly, or by reason of negligence (3) inspects or discloses any return or return information with respect to a taxpayer (4) in violation of any provision of section 6103.”¹⁶

The lawsuit also brings a claim under the Privacy Act, which has similar standards for proving damages.¹⁷ While the leak itself is not in dispute, the plaintiff faces a difficult path to satisfy all the required elements and overcome the government’s defenses.

III. The Challenge of Proving Damages

A central challenge for the plaintiff is proving damages. The complaint seeks two forms of relief: actual damages or statutory damages, and punitive damages.

A. Actual Damages

Under section 7431(c)(1)(B)(i), a plaintiff can recover “the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure.” The code does not define actual damages, leaving courts to interpret the term. As established in cases like Castillo,¹⁸ a plaintiff must demonstrate that the unauthorized disclosure was the actual and proximate cause of the harm they suffered. Courts often look to general tort principles, including the “but for” test for factual causation and foreseeability, for proximate causation, as articulated by the Supreme Court in Paroline.¹⁹

For the Trump plaintiffs, quantifying actual damages will be exceptionally difficult. Allegations of reputational harm are hard to translate into a specific monetary figure, especially when, by some measures, the former president’s net worth has reportedly increased since the disclosures.²⁰ While some damages, such as legal fees incurred in related litigation, might be demonstrable, they fall far short of the amounts claimed.

The case of Jones²¹ provides a rare example of a successful section 7431 suit in which a plaintiff proved actual damages. In Jones, an IRS agent told a confidential informant, out of concern for the informant’s safety, that the plaintiff’s workplace, Jones Oil, was going to be subject to a raid. In turn, the informant leaked news of the raid to the local press, which was present for coverage of the IRS raid on the plaintiff’s business. The raid did not result in charges against the plaintiff. Even so, the negative coverage that resulted from it caused the company to lose contracts and sales opportunities, which ultimately resulted in bankruptcy for Jones Oil.²² The court determined that these lost contracts were quantifiable, as was the emotional distress that plaintiffs suffered as a result of the news coverage. The plaintiffs employed convincing expert testimony that quantified the impact of the news coverage on both the financial health of Jones Oil and their own physical health.²³ Moreover, the court found the leak of the raid to be the proximate cause of that harm. In making that determination, the court held that the government lacked any “meaningful evidentiary foundations” for disputing proximate cause.²⁴ The plaintiffs in Jones were able to point to concrete examples of the negative impact of the IRS leak; the harm in Trump is far more attenuated and less quantifiable. If there is meaningful evidence of the significant economic harm alleged by the plaintiffs in Trump, it does not exist in the public record and would need to be elicited in discovery.

B. Statutory and Punitive Damages

In lieu of actual damages, section 7431(c)(1)(A) allows for statutory damages of “$1,000 for each act of unauthorized disclosure.” The plaintiff’s complaint advances a novel theory that “each act” refers to every individual who read the information published by news outlets, leading to a claim for at least $10 billion.²⁵ However, this interpretation is not supported by precedent. Courts in cases like Mallas²⁶ and Minda²⁷ have held that damages are calculated based on the number of discrete acts of disclosure from the leak, not the number of people who ultimately receive the information downstream. An act of disclosure is the unauthorized communication between the government employee and the unauthorized party. Some courts have ruled that it would go against congressional intent to extend statutory damages to the communications resulting from an unauthorized disclosure.²⁸ The narrow interpretation of “each act” of disclosure severely limits the potential for a large statutory damages award, forcing plaintiffs who seek substantial compensation to prove actual damages, however difficult that may be.

The path to punitive damages is also complicated. While section 7431 waives sovereign immunity to allow for punitive damages in cases of willful or grossly negligent disclosures, the Ninth Circuit in Siddiqui²⁹ held that an award of punitive damages is contingent upon a successful demonstration of actual damages. The court reasoned that any ambiguity in the government’s waiver of sovereign immunity must be construed in its favor. This is not settled law, however; the court in Mallas held that punitive damages could be awarded even if the plaintiff’s actual damages were zero.³⁰ So, the application of punitive damages in section 7431 cases is a matter of dispute. Courts would be skeptical of the punitive damages the plaintiffs are seeking in either approach outlined above.

IV. Critical Legal Hurdles

Beyond damages, the lawsuit faces at least two potentially fatal threshold issues.

A. Employee or Contractor?

A claim under section 7431 requires the disclosure to have been made by an officer or employee of the United States. Littlejohn was an employee of an IRS contractor, Booz Allen Hamilton — not a direct employee. If the court determines that he was a mere contractor without sufficient government control over his work, the claim against the United States will fail. The government would not be vicariously liable because the waiver of sovereign immunity does not explicitly provide for that liability. For there to be a valid claim against the government in Trump, the plaintiffs need to sufficiently allege that Littlejohn was more than a contractor.

This issue was a central point of contention in the lawsuit filed by Griffin. In Griffin, the government moved to dismiss on these grounds. It argued that Littlejohn’s confession served as a factual basis for his status as a contractor.³¹ The court, however, denied the motion, finding that the plaintiff had plausibly alleged that the degree of supervision and control the IRS exercised over Littlejohn could render him a de facto employee for liability purposes.³² The court did not get to consider the principal-agent analysis as applied to the facts of Griffin. The parties never even completed discovery. The complaint in Trump borrows heavily from the reasoning in Griffin, but this remains a significant factual dispute that must be resolved.

The courts have considered the principal-agent relationship in the context of section 7431 in a case brought against the IRS by Hunter Biden. In that case, Biden alleged that IRS employees acted through their personal attorneys to unauthorizedly disclose his tax return information. The court emphasized that the common law approach to principal-agent relationships governs the analysis of whether an actor for the IRS is an employee or a contractor.³³ Moreover, the court ruled that employees could violate section 6103 through intermediaries and that, in this case, a lawyer was a clear agent of the IRS employees.³⁴

The ruling in Biden does not have a direct bearing on the analysis that will apply to the facts of Trump. However, it does provide a basis to understand the balance that must be struck when applying common law principles to the waiver of sovereign immunity in section 7431. When Congress is ambiguous on how a waiver of sovereign immunity should be applied, courts use common law principles to fill in the gaps.³⁵ Section 7431 does not provide a framework to differentiate an employee from a contractor, so, as in Biden, the court in Trump will look to the common law of principal-agent relationships to determine Littlejohn’s status. That analysis is fact intensive and unlikely to be resolved in a motion to dismiss. So, these common law principles will be vital in considering Trump.

B. Statute of Limitations

The lawsuit also faces a formidable statute of limitations defense. Under section 7431(d), a plaintiff must bring an action within two years from the date they discover the unauthorized disclosure. The Ninth Circuit’s decision in Aloe Vera³⁶ established that this two-year period is jurisdictional, meaning it is an absolute limit on the government’s waiver of sovereign immunity and is not subject to equitable tolling.³⁷

The key question is when discovery occurred. News stories based on the leaks were published as early as September 2020. The government will almost certainly argue that discovery does not require knowledge of the leaker’s identity, only knowledge of the unauthorized disclosure itself, which occurred upon publication in 2020. The plaintiffs will counter that they could not have discovered a claim against the IRS until they had reason to know the source was an IRS employee or agent, which they claim was not until they received official notification.

Under section 7431(e), the government must notify taxpayers if an unauthorized disclosure of their information occurs. The concept of notification is not tied in any way to the discovery that begins the tolling of the limitations period. So, it is not given by the statute that the plaintiffs in Trump discovered the unauthorized disclosure when they were notified by the IRS. The limitations period for Trump is further complicated by the public filing of Griffin in December 2022. Griffin alleged the same leak by an IRS actor and may undermine the argument that the source of the leak was unknowable before that time. The government can point to multiple moments when the plaintiffs could have discovered the leak. The original reporting by The New York Times, the complaint in Griffin, and the confession of Littlejohn are all discrete moments that would have tolled the limitations period before the plaintiffs’ complaint was filed. There is no precedent for the deductive reasoning expected from a plaintiff in a case such as this, so it is difficult to say how a court would rule if asked when the plaintiffs should have filed. If this case were to proceed to discovery, the defense would surely seek information from the plaintiffs regarding any communications they had speculating on the source of the leak. Because any ambiguity in the statute of limitations must be resolved in favor of the government, this defense poses a serious threat to the entire case.

V. Conclusion

The Trump tax returns are in their 10th year of public controversy. In that time, Trump has staunchly advocated for his privacy rights as a taxpayer. This advocacy has metastasized into Trump, which at its core is a valid enforcement of those rights against an unauthorized disclosure of taxpayer information. That lawsuit is clouded by issues such as unrealistic damages and significant legal hurdles. It also raises a host of ethical and constitutional questions that deserve dedicated analysis. Ultimately, if Trump’s goal is to enforce taxpayer privacy rights, this may prove a fraught method of doing so. But on a positive note, this lawsuit has brought attention to the important confidentiality rights we all have as taxpayers.

Footnotes

1. Richard Rubin, “In Break From Tradition, Donald Trump Rules Out Releasing Tax Returns Ahead of Election,” The Wall Street Journal, May 11, 2016.
2. Complaint, Trump v. IRS, No. 1:26-cv-20609 (S.D. Fla. Jan. 29, 2026).
3. Nicholas Fandos, “House Ways and Means Chairman Subpoenas Trump Tax Returns,” The New York Times, May 10, 2019.
4. Justice Department, “Former IRS Contractor Sentenced for Disclosing Tax Return Information to News Organizations,” 23-103 (Jan. 29, 2024).
5. Russ Buettner, “The President’s Taxes: Long-Concealed Records Show Trump’s Chronic Losses and Years of Tax Avoidance,” The New York Times, Sept. 27, 2020.
6. Allan Smith, “Trump Lashes Out at New York Times Report Alleging Years of Tax Avoidance,” NBC News, Sept. 27, 2020.
7. Letter from Neal to Secretary Janet Yellen and Commissioner Charles Rettig (June 16, 2021).
8. Andrew Chung, “U.S. Supreme Court Clears Way for Lawmakers to Get Trump’s Tax Returns,” Reuters, Nov. 22, 2022.
9. Katelyn Polantz, “House Committee Receives Donald Trump’s Federal Tax Returns From IRS,” CNN, Nov. 30, 2022.
10. Complaint, Griffin v. IRS, No. 1:22-cv-24023, at para. 1 (S.D. Fla. Dec. 13, 2022) (ECF No. 1).
11. “America’s Top 15 Earners and What They Reveal About the U.S. Tax System,” ProPublica, Apr. 13, 2022.
12. Justice Department, “IRS Contractor Pleads Guilty to Disclosing Tax Return Information to News Organizations,” 23-1127 (Oct. 12, 2023).
13. Second Amended Complaint, Griffin v. IRS, No. 1:22-cv-24023, at para. 1 (S.D. Fla. Nov. 13, 2023) (ECF No. 55).
14. IR-2024-172.
15. Complaint, Trump, No. 1:26-cv-20609, at para. 1.
16. Section 7431(a)(1).
17. Privacy Act of 1974, 5 U.S.C. section 552a.
18. Castillo v. United States, No. 1:21-cv-00007 (S.D.N.Y. 2022).
19. Paroline v. United States, 572 U.S. 434 (2014).
20. Dan Alexander and Kyle Khan-Mullins, “Here’s How Much Donald Trump Is Worth,” Forbes, Sept. 19, 2025.
21. Jones v. United States, 9 F. Supp. 2d 1119 (D. Neb. 1998).
22. Id. at 1127.
23. Id. at 1144-1148.
24. Id. at 1143.
25. Complaint, Trump, No. 1:26-cv-20609, at para. 104.
26. Mallas v. United States, 993 F.2d 1111 (4th Cir. 1993).
27. Minda v. United States, 851 F.3d 231 (2d Cir. 2017).
28. Castillo, No. 1:21-cv-00007.
29. Siddiqui v. United States, 359 F.3d 1200, 1204 (9th Cir. 2004), holding that “the award of damages under section 7431 is allowed only pursuant to an express waiver of the Government’s sovereign immunity, ambiguity as to whether section 7431(c)(1)(B) authorizes a punitive damages award absent proof of actual damages must be resolved in favor of the Government.”
30. Mallas, 993 F.2d at 1126, finding that a taxpayer may recover punitive damages under subsection (1)(B)(ii), even when their actual damages are zero under subsection (1)(B)(i), provided that those damages together exceed the amount of the subsection (1)(A) statutory damages.
31. United States’ Motion to Dismiss Second Amended Complaint, Griffin v. IRS, No. 1:22-cv-24023, at 10 (S.D. Fla. Nov. 27, 2023) (ECF No. 58).
32. Order Denying in Part and Granting in Part Motion to Dismiss, Griffin v. IRS, 730 F. Supp. 3d 1312, at 5 (S.D. Fla. Apr. 22, 2024) (ECF No. 108).
33. Biden v. IRS, 752 F. Supp. 3d 97 (D.D.C. 2024).
34. Id. at 110.
35. Id. at 108, citing Allen v. District of Columbia, 969 F.3d 397, 402 (D.C. Cir. 2020) (quoting Astoria Federal Savings & Loan Association v. Solimino, 501 U.S. 104, 108 (1991)).
36. Aloe Vera of America Inc. v. United States, 580 F.3d 867 (9th Cir. 2009).
37. Id. at 873 (citing John R. Sand & Gravel Co. v. United States, 552 U.S. 130 (2008)).