A data-sharing agreement between ICE and the Internal Revenue Service (IRS) allowing mass requests for immigrants’ addresses was ruled illegal by a federal appeals court last February — but a $10 million contract between ICE and a third-party data broker may have secured the immigration agency the same information anyway, legal experts say.
Last June, ICE awarded a contract to ThunderCat Technology to access “ITIN [individual taxpayer identification numbers] data”, which immigrants without legal status use to pay taxes.
The subscription potentially exposes millions of immigrants to the U.S. Department of Homeland Security’s dragnet. Five million ITINs were active in 2025, according to the Treasury Inspector General for Tax Administration. More than 328,000 were issued to people living in New York State.
The February injunction in Massachusetts federal court blocked, for a second time, an agreement under which the IRS would provide ITINs and last known addresses to ICE based on an April 2025 memorandum of understanding.
“Our concern is that the new contract is a way that ICE is getting around the injunction, undermining its validity,” said Josh Rosenthal, workers’ rights program director at Asian Law Caucus, which is suing alongside UndocuBlack Network and other plaintiffs for more information about the contract.
Signed in June, the ICE contract with ThunderCat Technology states that the company — a data broker and technology integrator that holds federal contracts worth $1.3 billion — “provides ITIN data subscription service and analytics for HSI [Homeland Security Investigations] agents in fraud investigations.”
HSI is the branch of ICE that normally deals with transnational crime, including such things as the illegal movement of people, goods, money, and weapons into and out of the U.S. However, according to a Cato Institute analysis, almost 90% of its agents have been redeployed by the Trump administration to routine immigration enforcement tasks.
Circumventing the law
People who use their ITIN numbers for purposes beyond paying taxes — to obtain services with financial institutions, utility companies, or any type of creditor, for instance — are especially at risk.
Credit-reporting agencies like Equifax, Experian, and TransUnion collect, process, and sell this data to brokers. They call it “credit header” data, which includes names, addresses, dates of birth, and Social Security numbers or ITINs. Brokers repackage and resell the data to a wide range of clients, including marketing and advertisement companies, financial institutions, risk-management companies, and law enforcement agencies.
“If this is IRS information that relates to the collection of taxes, that information — and this is the core of our case — is subject to extremely strict privacy protections,” said Rosenthal, adding that the disclosure of tax records can only be done in exceptional circumstances, including certain federal criminal investigations. Immigration enforcement is squarely civil law.
Moreover, the February court’s injunction specifically barred ICE from using information “obtained from the IRS” to identify, detain, or deport any person.
Name, address, Social Security Number or ITINs are information that is protected under Section 6103 of the Tax Reform Act of 1976, enacted after President Richard Nixon used tax data to retaliate against his political enemies. This means that the IRS or its employees cannot divulge tax records except in specific circumstances, often involving a judicial warrant. Divulging tax records carries civil, criminal and administrative consequences.
However, data brokers do not need to obtain ITINs from the IRS; they can get them from credit-rating agencies, which access information clients willfully provide to financial institutions or utility companies in exchange for loans or basic services.
So, even if the direct sharing of information between the IRS and ICE violates the law, as two courts have ruled, acquiring that same data through a third party — which accesses the information through a credit-rating agency, which obtains that data from a financial institution or utility company that gets it from their customers — relies on what is known as the data-broker loophole. It’s not illegal.
All the Trump administration has to do, explained Claudia Ruiz, senior civil rights policy advisor at the nonprofit UnidosUS, “is go through a side door and contract with private third-party contractors, data brokers, to access that data.”
Even so, purchasing access to tax data through a data broker is a novel practice for ICE, a drastic shift away from the longstanding commitment to taxpayer privacy, according to the American Immigration Council. It’s a new frontier for immigration surveillance.
Neither ThunderCat Technology nor ICE responded to requests for comment.
‘Data betrayal’
The IRS estimated that roughly 3.8 million individuals filed taxes using an ITIN in 2022 — the last year for which figures are available — paying $96.7 billion in federal, state, and local taxes. According to the Institute on Taxation and Economic Policy, a non-partisan think tank, this is equivalent to each undocumented individual in the United States — about 10.9 million people — paying $8,889 in taxes per year.
ITIN filers fund the same programs that immigrants without legal status are barred from accessing, such as Social Security pensions, Medicare, and unemployment insurance. In Social Security taxes alone, immigrant ITIN holders paid $25.7 billion in 2022.
The administration’s attempts to access ITINs are a remarkable break from precedent, said Carmen Feliciano, vice president of policy and advocacy at UnidosUS. “This is a breach of a trust relationship that is part of a democracy,” she said. “This is data betrayal.”
Accessing ITINs is one piece of the Trump administration’s broader scheme to obtain usually off-limits data under the guise of immigration enforcement, including data from Social Security, Medicaid, Supplemental Nutrition Assistance Program, and voter registration records.
“It’s part of what we’re seeing overall: an attack on democratic institutions,” said Feliciano. “It’s going to take a while to regain the trust of the communities.” Non-citizens are not the only ones affected, she added.
For non-citizens, the Trump administration’s ever-growing access to data is transforming their relationship with the U.S. government, said Gregory Nojeim, director of the Center for Democracy and Technology’s security and surveillance project. “ICE data demands are having an enormous impact on the relationship of non-citizens and new Americans to their government.”
Immigrants who for decades paid taxes and participated in the financial system using their ITINs may be discouraged from doing so again, Nojeim said. “More and more people are refraining from availing themselves of government services to which they are lawfully entitled,” he said. “The climate of fear documented in the community has been enormous.”
