Accounting and tax: the numbers, the rules, the AI picture.

• Circular 230, section 10.30: advertising and solicitation (31 CFR 10.30)

  Practitioners may not use public communications or private solicitations that are false, fraudulent, coercive, misleading or deceptive. Enrolled agents and similar credential holders may not use the term "certified" or imply an employment relationship with the IRS. Fee information may be published, including fixed fees for routine services, hourly rates and fee ranges, but a practitioner may not charge more than the published rates for at least 30 calendar days after publication. For direct mail and e-commerce, a copy of the communication and a list of recipients must be kept for at least 36 months.

  What it means: Check every credential on your website, bio and email signature against the wording the rule allows. If you publish a price, treat it as a commitment for 30 days. Keep a dated copy of every campaign, newsletter and ad, with the recipient list, for three years. Do not keep contacting a prospect who has said they do not want to be solicited.

  [5] law.cornell.edu

• AICPA Code of Professional Conduct: advertising, commissions and referral fees (1.600.001, 1.600.010, 1.520.001)

  A member in public practice may not seek clients by advertising or other forms of solicitation in a manner that is false, misleading or deceptive, and solicitation by coercion, over-reaching or harassing conduct is prohibited. Promotional efforts are misleading if they create false or unjustified expectations of favorable results, imply an ability to influence a court or regulator, or quote a fee when the member likely knew it would rise substantially. A member who pays or accepts a referral fee for recommending a CPA service must disclose it to the client, and a member must not do through others what the Code forbids the member to do directly.

  What it means: Never write 'maximum refund' or 'we will win your audit' copy. Disclose any referral fee to the client, which matters if you pay a bank, lawyer or lead service for introductions. Review what your marketing vendor and review-management tools publish in your name, because you remain responsible for them. Audit and review clients carry an extra ban on commissions.

  [9] mn.gov

• State boards of accountancy: advertising and firm-name rules

  The licence to practise as a CPA firm comes from your state, and so do the advertising and naming rules. Kansas, for example, bars advertising that is false, misleading or deceptive, bars using the name of a non-CPA or an unregistered firm in advertising CPA services, and judges violations against the AICPA Code. A 2009 AICPA and NASBA working paper, which is non-authoritative, proposed that names are misleading if they mislead about the firm's legal form or owners, create false expectations of favorable results, or imply influence over a regulator.

  What it means: Register your firm name before you print it, and check the exact name on your website, profile and letterhead. A name that implies an entity form, owners or specialization you do not have invites a board complaint. Multi-state firms need to check each state they serve, because rules and wording differ.

  [10] law.cornell.edu

• Section 7216 consent rules for marketing with client return data (26 CFR 301.7216-2 and 301.7216-3)

  A tax return preparer may not use or disclose tax return information without the taxpayer's knowing, voluntary and signed written consent, unless an exception applies. A preparer may keep a separate list of client names, addresses, phone numbers, entity type and return form number, and use it to send educational tax information or to solicit more tax return preparation, but not to solicit any other service or product. Marketing statistics must be anonymous and cannot state an aggregate drawn from fewer than ten returns, and an average refund may not appear in marketing. Consent to solicit non-tax products must name each product, and a preparer may not ask for it after handing the completed return over for signature.

  What it means: Do not market wealth management, insurance, loans or payroll to your tax clients from their return data without signed consent that names the product. A newsletter with tax updates is fine. An 'our average client saves $X' claim is not. Treat the client list as a restricted asset, and never sell or transfer it except with the sale of the practice.

  [11] law.cornell.edu

• FTC Safeguards Rule (GLBA) and IRS Publication 4557: protecting client data on your site and in your systems

  The FTC lists tax preparation firms as examples of financial institutions covered by the Safeguards Rule. The rule requires a written information security program with a designated Qualified Individual, a written risk assessment, access controls, encryption of customer information in transit and at rest, multi-factor authentication, an incident response plan, and notice to the FTC within 30 days of discovering unauthorized acquisition of unencrypted information on 500 or more consumers. Firms holding information on fewer than 5,000 consumers are exempt from some provisions. IRS Publication 4557 (Rev. 6-2024) says the definition of financial institutions includes professional tax preparers and points firms to Publication 5708 for a written plan template. In an August 18, 2026 release (IR-2026-92) the IRS reminded tax and accounting professionals that federal law requires a written information security plan.

  What it means: Your website is part of the program. Contact forms, document portals and chat widgets collect customer information, so they need encryption, access controls and a vendor you have vetted. Do not ask for Social Security numbers in a web form or email. Add the plan to your marketing checklist, because a redesign that changes the intake form changes your risk.

  [6] ftc.gov

• CAN-SPAM Act and the TCPA (47 CFR 64.1200) for outreach

  The FTC says CAN-SPAM covers all commercial email, including business-to-business email. Messages need accurate headers, a non-deceptive subject line, an ad identification, a valid postal address and a clear opt-out that you honor within 10 business days. The FTC page lists penalties of up to $53,088 per violating email, and you stay responsible when a vendor sends for you. For phones, FCC rule 47 CFR 64.1200 requires prior express written consent for autodialed or prerecorded telemarketing calls and texts to wireless numbers. It also restricts calls to numbers on the National Do Not Call Registry and bars residential telephone solicitations before 8 a.m. or after 9 p.m.

  What it means: A cold email to a lawyer or banker is not exempt because it is business to business. Add your address and opt-out to every campaign, and suppress unsubscribes across every tool. Do not text prospects from a list without written consent. Keep a do-not-contact list for tax-season cold outreach, and see Circular 230 for the separate record-keeping duty.

  [12] ftc.gov

• FTC Consumer Reviews and Testimonials Rule, Google review policy and client confidentiality

  The FTC rule took effect on October 21, 2024. It bars fake reviews, paying for positive reviews, undisclosed insider reviews and review suppression through intimidation or unfounded legal threats. Google's Maps policy is stricter: it bars offering payment, discounts or free services in exchange for a review, bars review gating (asking only happy customers) and removes reviews with a conflict of interest, such as those from employees. In the UK, ICAEW guidance says a testimonial is fine only if the client has consented, because the firm and client relationship is confidential.

  What it means: Ask every client the same way, with no gift and no 'leave five stars' script. Never write reviews yourself or ask staff and family to post them. When you reply to a review, give no client details, because a public reply can disclose a confidential relationship. In the US the AICPA Code has a Confidential Client Information Rule (1.700.001) and Section 7216 limits use of return data.

  [13] ftc.gov

• Outside the US: Canadian CPA bodies and the UK (ICAEW)

  In Canada, provincial CPA bodies set the conduct rules, and Rule 217 covers advertising, solicitation and endorsements. CPABC says a registrant may not solicit in a manner that is persistent, coercive or harassing, must stop when a prospect asks, and may run seminars and distribute technical information. In the UK, the ICAEW Code of Ethics (R115.2) bars marketing that brings the profession into disrepute. ICAEW also says advertising must conform to the Advertising Standards Authority, and that UK GDPR and PECR usually require a positive opt-in for marketing emails and texts.

  What it means: A Canadian or UK firm cannot reuse a US page. Opt-in rules are stricter in the UK, and Canadian firms follow their provincial body and Canada's anti-spam law, which this page does not cover. Check your own regulator before you publish, and use a local adviser for cross-border campaigns.

  [14] icaew.com

This is general information, not legal or compliance advice. Rules differ by credential, state or province and country, and they change. Confirm every page, post, email and ad with your own counsel, your state board and the IRS before publishing.