The IRS is seeking the identities and transaction histories of all Coinbase customers in the U.S.

It has petitioned a court to let it serve what is known as a “John Doe Summons,” which requires a business to turn over information about any of its customers that match a specific criteria. In this case it is “United States persons who, at any time during the period January 1, 2013, through December 31, 2015, conducted transactions in a convertible virtual currency[.]” That is such a broad class that it could encompass millions of accountholders.

Often used on off-shore banks, a John Doe summons is a powerful tool that the IRS uses to identify tax evaders when there is “a reasonable basis for believing that such person or group or class of persons may fail or may have failed to comply with any provision of the tax laws.” In its filing, the IRS cites a couple of instances in which virtual currency was used to evade taxes, as well as public perceptions about it, among other things, as its reasonable basis.

That the IRS is investigating possible tax evasion using cryptocurrency is not surprising. What is surprising is how low the burden is that the IRS must meet to acquire the identities and transaction histories of millions of Americans–identities and histories that Coinbase is obligated to record by the Bank Secrecy Act. Coinbase has responded:

We take user privacy very seriously and will work to protect the privacy of our users in broad information requests. We are taking a very careful look at this petition and the scope of the government’s authority as it relates to this request.

I’m not a tax lawyer, nor an expert on these types of petitions, but I can’t imagine that such a request affecting so many people can have many precedents, and I would hope that a court would want to see much more before it allowed the privacy of so many people to be affected. Stay tuned.