The opinion
United States Court of Appeals
FOR THE DISTRICT OF COLUMBIA CIRCUIT
____________
No. 26-5243 September Term, 2026
1:25-cv-03501-SLS
Filed On: September 4, 2026
League of Women Voters, et al.,
Appellees
v.
United States Department of Homeland
Security, et al.,
Appellants
State of Texas,
Appellee
------------------------------
Consolidated with 26-5301
BEFORE: Srinivasan, Chief Judge, and Wilkins and Katsas*, Circuit Judges
ORDER
Upon consideration of the emergency motion for stay pending appeal, which
includes a request for an administrative stay, the response thereto, and the reply; the
motions to participate as amici curiae and the lodged amicus briefs; and the Rule 28(j)
letters, it is
ORDERED that the motions to participate as amici curiae be granted. The Clerk
is directed to file the lodged briefs. It is
FURTHER ORDERED that the motion for stay be denied. For the reasons
discussed in the attached per curiam statement, appellants have not satisfied the
stringent requirements for a stay pending appeal. See Nken v. Holder, 556 U.S. 418,
434 (2009); D.C. Circuit Handbook of Practice and Internal Procedures 33 (2025). It is
* Circuit Judge Katsas would grant the motion for stay pending appeal for the
reasons discussed in the attached dissenting statement.
United States Court of Appeals
FOR THE DISTRICT OF COLUMBIA CIRCUIT
____________
No. 26-5243 September Term, 2026
FURTHER ORDERED that the request for an administrative stay be dismissed
as moot. It is
FURTHER ORDERED, on the court’s own motion, that these consolidated
appeals be expedited and that, within 10 days of the date of this order, the parties
submit a proposed expedited schedule and proposed formats for the briefing of these
cases.
Per Curiam
FOR THE COURT:
Clifton B. Cislak, Clerk
BY: /s/
Francis A. Walter
Deputy Clerk
Page 2
PER CURIAM:
A stay pending appeal is “extraordinary relief.” Citizens
for Resp. & Ethics in Washington (CREW) v. FEC, 904 F.3d
1014, 1017 (D.C. Cir. 2018) (per curiam). To obtain its
requested stay, the government therefore must make, among
other things, a “strong showing that [it] is likely to succeed on
the merits” of its appeal. Nken v. Holder, 556 U.S. 418, 434
(2009) (citation omitted).
Here, the government faces a further obstacle. Only after
the district court had already granted summary judgment for
plaintiffs did the government raise what are now its central
arguments regarding plaintiffs’ Social Security Act claim.
When the government first aired those forfeited arguments in
moving for a stay pending appeal, the district court declined to
consider them in that expedited posture but expressly invited
the government to submit a post-judgment motion to excuse the
forfeiture and receive full consideration of the late-raised
arguments. The government did not do so, instead coming
straight to our court and seeking a stay pending appeal based in
significant part on the forfeited arguments.
To grant the extraordinary relief of a stay, we would need
to elect to excuse the government’s forfeiture for purposes of
this preliminary stage of the proceedings and then conclude
that there is a strong showing that the forfeited arguments—yet
to be considered on the merits by any court—are likely to
succeed in this appeal. We decline to overlook the forfeiture
for purposes of the government’s stay motion; and at any rate,
even considering the forfeited arguments as they are presented
in the necessarily constrained context of an expedited stay
motion, we cannot conclude that the government has made the
requisite strong showing of a likelihood of success. We
therefore deny the government’s motion.
2
I.
A.
The Systematic Alien Verification for Entitlements
program, or SAVE, is an immigration- and citizenship-
verification system administered by the Department of
Homeland Security (DHS). Congress created SAVE in 1986,
directing DHS’s predecessor to establish an automated means
of verifying the immigration status of noncitizens applying for
certain public benefits. See Immigration Reform and Control
Act of 1986, Pub. L. No. 99-603, § 121(c)(1), 100 Stat. 3359,
3391; 42 U.S.C. § 1320b-7(d); Gov’t Mot. 2–3.
For nearly four decades, SAVE principally searched
DHS’s own immigration records. An agency generally
submitted a request about a specific individual using a DHS
identifier for the person, such as an alien registration number.
SAVE returned citizenship or immigration-status information,
and the requesting agency made any ultimate eligibility
determination. See 42 U.S.C. § 1320b-7(d)(5)(A); Gov’t Mot.
3–4. The system ordinarily could not verify the citizenship of
a person born in the U.S. (about whom DHS would have no
immigration records), it could not be searched using a Social
Security number (SSN), and it could not accept bulk queries
encompassing multiple persons. Gov’t Mot. 4–5.
That changed as a result of modifications to SAVE
implemented in 2025. In March of that year, President Trump
issued an Executive Order directing DHS to ensure that state
and local election officials had “access to appropriate systems
for verifying the citizenship or immigration status of
individuals registering to vote or who are already registered.”
Exec. Order No. 14,248, § 2(b)(i), 90 Fed. Reg. 14005, 14006
(Mar. 25, 2025). The order also directed the Social Security
Administration (SSA) to make its Social Security Number
3
Verification Service, Death Master File, and other relevant
federal databases available for that purpose. Id. § 3(a), 90 Fed.
Reg. at 14007.
DHS soon announced the new system at issue here, which
we, like the district court and the parties, will call “modified
SAVE.” The new system differed from its predecessor version
in three principal respects: (i) it connected SAVE to SSA
records and permitted searches using full or partial SSNs; (ii)
that connection allowed SAVE to return information about
persons—including many U.S.-born citizens—who had no
DHS immigration records; and (iii) the system permitted bulk
queries. Gov’t Mot. 5–6; DHS Administrative Record (DHS
AR) 115–17.
The information exchange under modified SAVE
generally works in relevant respects as follows. Using a web
interface, a requesting agency—for example, a state or local
government—can access the SAVE system and initiate a
request about a person or group of persons. The requester
provides the names, dates of birth, full or partial SSNs, and
other available identifying information for each person
encompassed by the query. DHS then sends those data to SSA.
SSA compares the submitted information with its own records
and generates separate true-or-false match indicators for the
SSN, name, and date of birth for each person. SSA returns a
file to DHS containing the match results, as well as yes-or-no
indicators capturing whether queried individuals are citizens,
deceased, or foreign-born, and other data fields that indicate
state or country of birth and alien registration number if
applicable and available. If the requester provided only a
partial SSN and SSA nonetheless identified a match in its own
records, SSA shares the associated full (nine-digit) SSN with
DHS for DHS’s own records. SSA also sends any error code
descriptions associated with errors incurred during SSA’s
search. Gov’t Mot. 6; DHS AR 116, 224–26, 424, 437–38.
4
DHS then makes the results available to the requesting
agency through the SAVE web interface. For each person
encompassed by the query, the SAVE results report the name,
SSN, date of birth, and other identifying information contained
in the request, alongside search results. The search results may
include an indicator of citizenship or immigration status, an
indicator capturing whether the individual is deceased, and
descriptions of errors generated by the search process. As to
the latter, if, for example, a requesting agency submitted only
a partial SSN and SSA was unable to identify a match in its
records, SAVE says “Full SSN Required – Resubmit with
Additional Information.” With respect to a person’s
citizenship, if SAVE does not provide confirmation that the
person is a U.S. citizen, SAVE may instruct the requesting
agency to contact the individual, who may then be asked for
proof of citizenship. SAVE users can review the results for
each person one by one or can download a bulk file containing
the composite results for all individuals in a query. The time
to produce SAVE results can vary from a matter of seconds to
a number of days depending on the complexity of the query and
the need for human involvement. Gov’t Mot. 6–7; DHS AR
762, 1379, 1443–44, 1507–08, 1525–26.
B.
Plaintiffs include the League of Women Voters (the
League), several state League affiliates, the Electronic Privacy
Information Center, and individual citizens. In September
2025, plaintiffs filed this action challenging modified SAVE
on several grounds, including that DHS and SSA lacked
statutory authority for the new system and that its
implementation violated the Social Security Act, the Privacy
Act, and the Administrative Procedure Act.
The district court initially denied preliminary relief on the
ground that plaintiffs had not shown irreparable harm. League
5
of Women Voters v. DHS, No. 25-cv-3501, 2025 WL 3198970,
at *5 (D.D.C. Nov. 17, 2025). The parties then fully briefed
the merits. Plaintiffs moved for summary judgment, and the
government cross-moved to dismiss or, alternatively, for
summary judgment. See Pls.’ Summ. J. Mot., Dkt. 66-1; Fed.
Defs.’ Mot., Dkt. 77-1; Pls.’ Reply & Opp., Dkt. 99; Fed.
Defs.’ Reply, Dkt. 106.
On June 22, 2026, the district court granted plaintiffs
summary judgment. League of Women Voters, 2026 WL
1784297, at *35. The court held that plaintiffs had standing,
that DHS lacked statutory authority to implement modified
SAVE, that the system violated the Social Security Act and the
Privacy Act, and that its adoption was arbitrary and capricious.
Id. at *11–18, *20–33; Add. 25–70. The court set aside
modified SAVE, along with two Systems of Records Notices
issued by DHS and SSA that described the new uses of their
records. League of Women Voters, 2026 WL 1784297, at *35;
Add. 76–77.
The government appealed and asked the district court to
stay its decision pending the appeal. In the stay motion, the
government presented entirely new arguments concerning
plaintiffs’ claim under the Social Security Act. That claim rests
on a confidentiality mandate established by 42 U.S.C. §
405(c)(2)(C)(viii)(I), which generally bars disclosure of SSNs
“and related records that are obtained or maintained . . .
pursuant to any provision of law enacted on or after October 1,
1990.” Plaintiffs had also argued that the same sharing of
information independently violated another provision of the
Social Security Act, 42 U.S.C. § 1306(a)(1). The district court
did not reach that alternative theory because it concluded that
the government had offered no response under the terms of §
405(c)(2)(C)(viii)(I).
6
Throughout the months-long summary-judgment
proceedings, the government never made an argument under
the terms of § 405(c)(2)(C)(viii)(I)’s confidentiality mandate.
That is, the government never argued that, to the extent the
provision’s confidentiality mandate applies, modified SAVE is
consistent with it. See Add. 94–97. Instead, the government
argued only that § 405(c)(2)(C)(viii)(I) does not apply in the
first place because other immigration statutes—chiefly, 8
U.S.C. § 1373(c)—specifically authorize the disclosures
brought about by modified SAVE. See Fed. Defs.’ Mot. 49–
50; Add. 94–97. Then, after the district court granted summary
judgment for plaintiffs on the Social Security Act claim, the
government’s motion for a stay pending appeal for the first
time engaged with the substance of § 405(c)(2)(C)(viii)(I)’s
confidentiality mandate. Only then did the government argue
that, to the extent modified SAVE discloses any information at
all, any such disclosures are consistent with §
405(c)(2)(C)(viii)(I). Add. 94–97.
The district court held those new arguments forfeited.
Add. 94–98. It emphasized that the government’s new theories
implicated two relevant transfers of information in response to
a SAVE query: SSA’s initial transmission of responsive
information to DHS, and DHS’s ensuing transmission of
information to the initial SAVE requester. The court explained
that the forfeited arguments could require renewed
examination of the administrative record and additional factual
determinations about what is communicated at each step. Add.
95–97. The court declined to take up the forfeited arguments
“in an expedited fashion” in the context of “a stay motion,” but
it expressly invited the government to ask it to excuse the
forfeiture and engage with the arguments through a
postjudgment motion, “where they can receive adequate and
thorough consideration.” Add. 98 n.3. The government did
7
not take up the district court’s invitation, instead filing the
present motion in this court for a stay pending appeal.
II.
In attempting to satisfy its burden to make a strong
showing of a likelihood of success on the merits of its appeal,
the government initially argues that plaintiffs lack standing.
The government has not shown the requisite likelihood of
success on that argument.
The League has associational standing if one member
would have standing in her own right, the interests it seeks to
protect are germane to its purpose, and neither the claim nor
the requested relief requires an individual member’s
participation. Institutional S’holder Servs., Inc. v. SEC, 142
F.4th 757, 764 (D.C. Cir. 2025). Only the first requirement is
disputed. And because the League seeks prospective relief, the
question is whether at least one member faces an ongoing or
sufficiently imminent injury.
At least two do. J. Doe 4 is a League member and U.S.
citizen who lives in Louisiana, which has agreed to use
modified SAVE for voter-list maintenance. J. Doe 4 Suppl.
Decl. ¶¶ 1–2, 5, 13, Dkt. 16-3. Doe applied for an SSN while
a noncitizen, later became a U.S. citizen, and states in a sworn
declaration that SSA’s records continue to list them as a
noncitizen. Id. ¶¶ 2, 8, 14. J. Doe 6 is likewise a League
member and U.S. citizen who lives in Virginia, where election
officials have agreed to use modified SAVE for voter-list
maintenance. J. Doe 6 Decl. ¶¶ 1–2, 5, 14, Dkt. 16–8. J. Doe
6 likewise applied for an SSN before naturalizing and states
that SSA’s records continue to list them as a noncitizen. Id. ¶¶
2, 9, 15. While SSA does not require individuals to update their
records when their citizenship status changes (since such a
change would not necessarily affect eligibility for related
8
benefits), J. Doe 6 nonetheless tried unsuccessfully to update
their SSA citizenship data before the November 2025 elections.
Id. ¶ 15.
If modified SAVE were used to obtain information about
them, the inaccurate SSA records for J. Doe 4 and J. Doe 6
would likely produce a SAVE record that fails to confirm their
citizenship. What would then presumably follow would count
as injury for standing purposes. DHS instructs election
officials receiving such a response to obtain proof of
citizenship from the voter. DHS AR 762. And President
Trump has “directed” states to remove all ineligible voters
from their rolls “immediately.” White House, President Trump
Delivers an Address to the Nation, at 39:36–39:46 (YouTube,
July 16, 2026), https://www.youtube.com/
watch?v=iIlqG0untYM. If a person needs to prove their
citizenship to remain registered to vote or if they are removed
from the registration rolls, they suffer a cognizable injury. See
Meese v. Keene, 481 U.S. 465, 475 (1987).
The agencies themselves have made clear that the
threatened injury J. Doe 4 and J. Doe 6 describe is far from
speculative. DHS warned that “[s]hortfalls in data accuracy”
in SSA citizenship data could produce “incomplete or false
results.” DHS AR 260, 302; see also DHS AR 240. SSA
likewise cautioned that its citizenship information is accurate
“for SSA’s program purposes,” but “if used later for other
purposes, it may not be current.” SSA Administrative Record
(SSA AR) 103; see also SSA AR 44. The implementation of
modified SAVE in Texas shows how the dynamic can
materialize in practice. When modified SAVE produced
adverse results for Texas League members whom federal
records misclassified as noncitizens, state officials required
them to prove their citizenship and, in some cases, cancelled
their registrations. See Nel Decl. ¶¶ 19–21, 24, 26 & Exs. 1, 2,
Dkt. 66-3; A. Doe Decl. ¶¶ 11–14 & Ex. 1, Dkt. 66-4; B. Doe
9
Decl. ¶¶ 11–17, 21–22, 24–27, 30–31 & Exs. 1, 2, Dkt. 66-5;
C. Doe Decl. ¶¶ 12–14, 18 & Ex. 1, Dkt. 66-6. That experience,
together with J. Doe 4’s and J. Doe 6’s out-of-date federal
records and their own states’ planned use of modified SAVE,
makes injury sufficiently likely to establish their standing. See
Jibril v. Mayorkas, 20 F.4th 804, 814 (D.C. Cir. 2021).
Contrary to the government’s argument, the intervening
role of state officials does not defeat causation. An injury
remains fairly traceable to federal action when third parties
“will likely react” to it “in predictable ways.” Diamond Alt.
Energy, LLC v. EPA, 606 U.S. 100, 112 (2025) (cleaned up).
The sequence of events in Texas illustrates that states’ response
to an adverse SAVE result is not conjectural—after all, the
states wanting to use modified SAVE to conduct citizenship
checks do so because they expect its result to inform their
eligibility determinations. And the threatened injuries are
fairly traceable and redressable because setting aside modified
SAVE removes the federal response that sets the process in
motion. The government thus has not shown that it is likely to
succeed in challenging plaintiffs’ standing.
III.
Nor has the government made the requisite strong showing
that it is likely to succeed on the merits of its appeal. The
district court’s grant of summary judgment against the
government on plaintiffs’ Social Security Act claim
independently supports its judgment. As to that claim, the
central arguments the government now advances in its stay
motion were forfeited before the district court. We decline to
excuse that forfeiture for purposes of considering the
government’s preliminary request for an interim stay,
regardless of whether the forfeiture might ultimately be
overcome when the government’s appeal is considered on the
merits after the full briefing attending that stage. And at any
10
rate, even if we consider the government’s forfeited arguments
in this posture, the government still does not make the requisite
strong showing of a likelihood of success on those new
arguments as currently presented.
A.
The Social Security Act’s relevant confidentiality mandate
provides:
Social security account numbers and related
records that are obtained or maintained by
authorized persons pursuant to any provision of
law enacted on or after October 1, 1990, shall
be confidential, and no authorized person shall
disclose any such social security account
number or related record.
42 U.S.C. § 405(c)(2)(C)(viii)(I).
A “social security account number” is an SSN, and a
“related record” is “any record, list, or compilation that
indicates, directly or indirectly, the identity of any individual
with respect to whom a social security account number or a
request for a social security account number is maintained.” Id.
§ 405(c)(2)(C)(viii)(IV). There is no dispute that the
confidentiality mandate’s disclosure prohibition applies not
only to the transmission of information from within the federal
government to outside it (e.g., DHS to a SAVE user) but also
from one federal agency to another (e.g., SSA to DHS).
1.
Plaintiffs contend that modified SAVE violates §
405(c)(2)(C)(viii)(I). In moving for summary judgment on that
claim and in defending against plaintiffs’ motion for summary
judgment, the government offered two responses. Neither
11
disputed plaintiffs’ argument that, insofar as §
405(c)(2)(C)(viii)(I) applies to modified SAVE, the program
violates the provision’s confidentiality mandate. The
government instead argued only that plaintiffs lack a cause of
action to assert a violation of § 405(c)(2)(C)(viii)(I) and that
other statutes in any event provide the requisite authorization
for modified SAVE’s information sharing. Fed. Defs.’ Mot.
49–50. The district court rejected both of those arguments (the
first of which the government no longer presses). League of
Women Voters, 2026 WL 1784297, at *20, *30–33.
The government, as explained, first raised arguments
under the terms of § 405(c)(2)(C)(viii)(I) only after the district
court entered judgment. Add. 94–97. Although the district
court deemed the arguments forfeited, the government now
relies on them as the central basis of its challenge to the district
court’s ruling on the Social Security Act claim. Gov’t Mot.
15–17. The government’s stay motion thus asks us to doubly
exercise discretion in its favor. First, a stay pending appeal is
“not a matter of right”; it is an “exercise of judicial discretion”
governed by equitable principles, Nken, 556 U.S. at 433–34
(citations omitted), and is relief we have correspondingly
termed “extraordinary,” CREW, 904 F.3d at 1017. Second,
consideration of an argument forfeited in the district court is
also not a matter of right. See Flynn v. Comm’r, 269 F.3d 1064,
1068–69 (D.C. Cir. 2001). The usual rule is that a forfeited
argument will not be considered on appeal at all, Kingdomware
Technologies, Inc. v. United States, 579 U.S. 162, 173 (2016);
OBB Personenverkehr AG v. Sachs, 577 U.S. 27, 38 (2015),
much less considered as the central ground for a stay pending
appeal, see Ohio v. EPA, 603 U.S. 279, 298–99 (2024).
In that regard, when considering whether to grant a stay
pending appeal, we ordinarily assess whether a party is likely
to succeed in appealing the district court’s rejection of an
argument that was thoroughly examined based on full
12
development through meaningful adversarial testing. A
forfeited argument does not come to us with the benefit of that
sort of exploration by either the parties or the district court. Of
course, our court still might decide in unusual circumstances to
consider a forfeited argument after full merits briefing and
argument. But it is another matter altogether to rely on the
same forfeited argument to grant discretionary interim relief
pending the appeal at an expedited preliminary stage, without
the benefit of meaningful development in full merits briefing.
See Nken, 556 U.S. at 433–34; McBride v. Merrell Dow &
Pharms., Inc., 800 F.2d 1208, 1210–11 (D.C. Cir. 1986). The
concerns animating forfeiture principles—that late-raised
arguments create “the risk of an improvident or ill-advised
opinion” by denying courts and parties normal opportunities
for development, McBride, 800 F.2d at 1210 (citation
omitted)—have added force at this threshold stage.
Those considerations carry pronounced weight here given
the course of the litigation. The government had a full
opportunity before the district court’s judgment to raise and
develop the theories it now presses. Plaintiffs squarely invoked
§ 405(c)(2)(C)(viii)(I), Pls.’ Summ. J. Mot. 32–33; the parties
briefed the merits of that and other issues over a period of
months; and the government not only opposed plaintiffs’
motion but also cross-moved for judgment in its favor. Fed.
Defs.’ Mot. The government does not seriously dispute its
forfeiture, Gov’t Mot. 17–18, and it does not ask us to find that
the district court erred in deeming the arguments forfeited.
The district court also, in an unusual gesture, affirmatively
invited the government to make use of a second opportunity to
gain discretionary consideration of its late-raised arguments.
In its denial of the government’s motion for a stay, the district
court directed the government to a procedural pathway that
would allow it to ask the court to excuse the forfeiture and
13
engage with the new theories in a manner allowing for their full
development and consideration. Add. 98 n.3. That course
accords with our precedent, which directs a party wishing to
gain postjudgment consideration of a new issue to first present
it to the district court, often under Rule 59(e) (or potentially
under Rule 60(b)(6) when appropriate). City of New York v.
Nat’l R.R. Passenger Corp., 776 F.3d 11, 17 (D.C. Cir. 2015);
see Arias v. DynCorp, 752 F.3d 1011, 1016 (D.C. Cir. 2014);
Jones v. Horne, 634 F.3d 588, 603 (D.C. Cir. 2011). Here, such
a route was still available: a motion of the kind invited by the
district court can be filed within 28 days of the judgment, see
Fed. R. Civ. P. 59(e); accord Fed. R. Civ. P. 52(b), and the
district court extended its invitation when 12 days remained in
that period. The government, though, declined to take up the
invitation and instead immediately sought relief in this court,
forgoing further development and consideration of the forfeited
arguments in the district court.*
*
The district court suggested that the government file a motion
under Rule 52(b), Add. 98 n.3, which allows a party to move within
28 days of a judgment for a court to amend or supplement its findings
and amend the judgment accordingly; Rule 59(e), relatedly, permits
a party within the same period to ask the court directly to alter or
amend the judgment. Fed. R. Civ. P. 52(b), 59(e). The two rules are
routinely invoked together and provide closely related and
overlapping forms of postjudgment relief in precisely the same
timeframe. See 9C Charles Alan Wright & Arthur R. Miller, Federal
Practice and Procedure § 2582 (3d ed. updated Apr. 2026); Nat’l
Metal Finishing Co. v. BarclaysAmerican/Com., Inc., 899 F.2d 119,
122 (1st Cir. 1990) (describing “the close relationship between Rule
59(e) and Rule 52(b)” and the relief available under them as “so
similar”). Whatever the precise procedural vehicle—Rule 52(b),
Rule 59(e), or both—the district court expressly offered and
essentially encouraged the government to ask the court to exercise
its discretion to grant first-instance, “adequate and thorough
consideration” of the late-raised arguments. Add. 98 n.3.
14
Granted, we retain “independent power to identify and
apply the proper construction of governing law.” Kamen v.
Kemper Fin. Servs., Inc., 500 U.S. 90, 99 (1991). But our
“respect for the district judges,” among other considerations,
favors giving the court that entered judgment the first
opportunity to consider, develop, and resolve a late-raised issue
that might call for adjusting the court’s result. City of New
York, 776 F.3d at 17. And in the circumstances of this case, as
the district court explained, the new theories could require
further factual development in that court: an informed
consideration of the new arguments could turn in part on what
information passes from SSA to DHS, what information later
passes from DHS to SAVE users, and what the system’s
matching and confirmation responses communicate. Add. 95–
97. De novo review of the ultimate statutory question does not
eliminate the need for an adequately developed factual account
of the system to which the statute applies. Courts of appeals
“do not sit as self-directed boards of legal inquiry and research”
into such matters. Carducci v. Regan, 714 F.2d 171, 177 (D.C.
Cir. 1983).
In asking us to overlook its forfeiture, the government
submits that “[i]t would be extraordinary to use this unusual
litigation history to justify precluding millions of verifications”
through modified SAVE. Gov’t Mot. 18. But the government
makes that appeal in the context of asking us to grant it the
“extraordinary relief” of a stay pending appeal. CREW, 904
F.3d at 1017. And it would be all the more out-of-the-ordinary
to grant that extraordinary relief on the basis of forfeited
arguments: the government does not identify any case in which
a court has granted a stay pending appeal based on a likelihood
of ultimate success as to forfeited (and hence underdeveloped)
arguments.
15
The asserted interests of states that rely on SAVE, see
Dissent 11, do not warrant departing from ordinary forfeiture
principles either. The consequences of a party’s litigation
choices often—indeed, nearly always—extend beyond the
party itself. Those downstream interests also run in both
directions here, and nothing in this preliminary stay posture
necessarily calls for allocating the risk of error to citizens
eligible to vote who may be burdened by inaccurate modified-
SAVE results rather than to states temporarily unable to use
modified SAVE’s new functionality. If such downstream
effects sufficed to excuse forfeiture, ordinary forfeiture
principles could give way whenever—as may often be the
case—government action affects nonparties. Nor does that
description fit every state invoking those interests: Texas
intervened as a defendant to protect its interests in modified
SAVE and independently briefed the Social Security Act
claim, yet it too did not advance the specific late-raised theories
on which the government now principally relies. See Order
Granting Tex. Mot. to Intervene 1, Dkt. 86; Tex. Mot. to
Dismiss 26, Dkt. 97.
Here, moreover, the statutory obligations the states
invoke—determining eligibility for various benefits and
maintaining accurate voter rolls—long predate modified
SAVE’s introduction in 2025. For decades, states carried out
those duties using the preexisting SAVE system and other
available means. The district court’s judgment requires only
that they return to those long-used methods while an appeal
determines whether modified SAVE is lawful. Whatever
advantages modified SAVE’s functions afford, the question at
this stage is limited to their interim unavailability during the
appeal.
The significance of the issues in this appeal to the public
at large does not dictate a contrary conclusion. In a related
16
context, we have declined to consider an argument raised only
in a limited fashion by a party even where—and indeed,
especially because—“important questions of far-reaching
significance are involved.” Carducci, 714 F.2d at 177 (internal
quotation marks omitted). And the Supreme Court, when
considering an emergency stay application involving a major
federal regulatory program, declined to consider a theory
advanced by the dissent rather than the government itself in
opposing the stay: “if the government had arguments along
these lines,” the Court emphasized, “it did not make them”
despite its “ample resources and voluminous briefing”—and
the Court in that context thought that “sticking to [its] normal
course of declining to consider forfeited arguments [was] the
right course.” Ohio v. EPA, 603 U.S. 279, 298–99 (2024). We
similarly adhere to that course here.
We are unpersuaded to do otherwise based on the parallel
proceedings pertaining to modified SAVE in the Northern
District of Florida. Several states there entered into a
settlement with DHS requiring, among other things, access to
modified SAVE’s SSN-search and bulk-upload functionality.
After the district court here set aside modified SAVE, the
Florida court enforced the parties’ settlement there and ordered
DHS to restore those functions for the plaintiff states. See
Florida v. DHS, No. 3:24-cv-509, Dkt. 45, at 5–9 (N.D. Fla.
July 7, 2026); Add. 105–12.
It is far from clear that the two proceedings present
conflicting legal determinations. The district court here
adjudicated plaintiffs’ claims on the merits; the Florida court,
by contrast, enforced a settlement DHS voluntarily entered
while this litigation was already pending. The Florida court did
not—and, by nature of the proceeding, could not—address the
substance of the claims presented here. The fate of the Florida
court’s enforcement order also is uncertain as it is presently on
17
appeal in the Eleventh Circuit. And questions about the effect
of the district court’s judgment here on the Florida proceedings
are being litigated in the Eleventh Circuit appeal.
The government, meanwhile, has not sought to reduce any
practical tension raised by its obligations in the two cases by
arguing here that the district court’s relief is too broad; and the
mere existence of parallel proceedings—even assuming the
orders in fact conflict—does not itself suggest which order, if
either, should yield. Indeed, the state parties there have
themselves opposed expedition, arguing that the appeal
presents “many novel and complex questions” and urging that
both appeals proceed “in the ordinary course.” State
Appellees’ Opp. to Mot. to Expedite 1–2, 13, Florida v. League
of Women Voters, No. 26-12533 (11th Cir. July 28, 2026).
Those circumstances provide limited reason to depart from
ordinary forfeiture principles here.
We therefore decline to take the highly unusual step of
considering the government’s forfeited arguments at this
preliminary stage. A subsequent merits panel remains free to
decide for itself whether to entertain the arguments after full
appellate briefing. And in any event, as we explain below, even
if we consider the government’s forfeited arguments at this
stage on the present record, the government fails to make the
required strong showing of a likelihood of success.
2.
Before taking up the government’s forfeited arguments in
the alternative, we first explain why the government does not
make a strong showing of a likelihood of success if we confine
our consideration to the sole properly preserved argument the
government now presses on the Social Security Act claim. Fed.
Defs.’ Mot. 44–50. That argument is one the government
advances only as a fallback matter. Gov’t Mot. 17. It rests on
18
8 U.S.C. § 1373(c), which generally requires DHS to respond
to state and local inquiries seeking citizenship or immigration-
status information. That provision does not establish a
likelihood of success for the government.
A general duty to answer a citizenship inquiry under 8
U.S.C. § 1373(c) does not by itself authorize disclosure of
information that another statute, 42 U.S.C. §
405(c)(2)(C)(viii)(I), specifically makes confidential. The two
commands can readily coexist and function together: DHS
may answer the inquiries Congress calls for it to answer while
still complying with a separate restriction on the disclosure of
specific information Congress deemed confidential. See
League of Women Voters, 2026 WL 1784297, at *30–33.
Congress’s treatment of employment verification in the
same 1996 legislation that enacted § 1373(c) reinforces that
conclusion. Congress expressly authorized SSA to participate
in an employment-verification system by matching names and
SSNs against its records; specified what information SSA
could return; and restricted how that information could be used.
See Illegal Immigration Reform and Immigrant Responsibility
Act of 1996, Pub. L. No. 104-208, § 404(e), (h), 110 Stat. 3009-
546, 3009-665 (codified at 8 U.S.C. § 1324a note). Section
1373(c) contains no comparable reference to SSA records, SSN
matching, or the Social Security Act’s confidentiality rule.
Congress thus knew how to authorize SSN matching, and it
expressly did so elsewhere in the same statute. We see little
basis to read § 1373(c)’s general instruction to answer
citizenship inquiries as both silently accomplishing the same
thing and silently displacing an otherwise applicable
confidentiality restriction.
Once the forfeited theories are removed from
consideration per the usual rule attending forfeiture, then, the
government is left with no preserved argument in its stay
19
motion that independently makes a strong showing that it is
likely to defeat the Social Security Act claim. That itself
warrants denying the government’s stay motion because we
would decline to consider the forfeited arguments at this stage
for the reasons explained. We nevertheless next take up those
forfeited theories in the alternative and explain why the
government still does not carry its burden.
B.
The government’s forfeited theories, even if considered,
do not make the requisite strong showing of a likelihood of
success. Recall the terms of the Social Security Act’s relevant
confidentiality mandate: “Social security account numbers and
related records that are obtained or maintained by authorized
persons pursuant to any provision of law enacted on or after
October 1, 1990, shall be confidential, and no authorized
person shall disclose any such social security account number
or related record.” 42 U.S.C. § 405(c)(2)(C)(viii)(I). In its
forfeited arguments, the government posits two theories under
that provision’s terms: (i) that the information conveyed under
modified SAVE is “obtained or maintained” “pursuant to . . .
law[s] enacted” before “October 1, 1990”; and (ii) that
regardless, modified SAVE does not involve “disclos[ure]” of
a “social security account number or related record.” Id.
Those new arguments implicate unresolved legal
questions whose factual premises are incompletely developed
in the available briefing and record. And since the government
raised those arguments too late to enable their full development
in (and full consideration by) the district court—and since the
government in any event bears the burden to justify the
extraordinary interim relief it seeks—any uncertainties
resulting from the arguments’ inadequate development at this
stage weigh against the granting of relief. Considered in that
light, neither of the government’s new theories, at least as
20
presently constituted, makes the requisite showing of a strong
likelihood of success on the merits of its appeal.
1.
The government first argues that the confidentiality
provision’s temporal limitation excludes the records implicated
by modified SAVE. Gov’t Mot. 15–16. Section
405(c)(2)(C)(viii)(I) protects from disclosure SSNs and related
records “obtained or maintained” pursuant to law enacted on or
after October 1, 1990. The government submits that this
temporal limitation excludes essentially everything flowing
from SSA because SSA began issuing SSNs in the 1930s and
collecting citizenship or alien-status information in the 1970s.
The government reasons from that history that, even if SSNs or
related records are disclosed via modified SAVE, the fact that
those records exist under a long-existing legal architecture
necessarily means their disclosure cannot breach the
confidentiality mandate. Gov’t Mot. 15–16.
The statutory terms, however, call for a particular inquiry:
is the disclosed information “obtained or maintained . . .
pursuant to [a] provision of law enacted on or after October 1,
1990”? 42 U.S.C. § 405(c)(2)(C)(viii)(I). As to the question
posed by the statute—i.e., pursuant to what provision of law is
each SSN and related record at issue obtained or maintained—
the government’s stay motion identifies no “provision of law,”
pre-1990 or otherwise. Instead, it cites an article written by an
SSA employee that recounts the history of the SSN and
describes SSA’s recordkeeping practices. See Gov’t Mot. 16
(citing Carolyn Puckett, The Story of the Social Security
Number, 69 Soc. Sec. Bull. 55 (2009)). Read in its entirety, the
article does not adequately answer the question posed by the
statute’s terms in a way that would satisfy the government’s
burden at this stage.
21
For one thing, the article itself explains that SSA’s
Numerical Identification System (Numident)—the database in
which SSA maintains records associated with SSNs—is not
simply a collection of records fixed when each SSN was first
assigned. When information changes—including when
statutes require changes in the procedures by which data are
“obtained or maintained,” § 405(c)(2)(C)(viii)(I)—SSA adds a
new “entry” or “iteration” to each individual’s record. A single
Numident record thus can contain dozens, and sometimes
hundreds, of entries. Puckett, supra, at 63. The article also
surveys the many times, before and after 1990, when Congress
enacted laws that altered SSA’s collection and verification of
information. See, e.g., Help America Vote Act of 2002, Pub.
L. No. 107-252, § 303(a)(5)(C), 116 Stat. 1666, 1710–11;
Intelligence Reform and Terrorism Prevention Act of 2004,
Pub. L. No. 108-458, § 7213(a)(1)(B)–(C), 118 Stat. 3638,
3830–31.
Neither the government’s briefing nor the present record
tells us which Numident entry supplies the information used to
fulfill queries from modified SAVE; when that entry was
created or updated; or pursuant to what specific statutory
authority it has been “obtained or maintained” within the
meaning of § 405(c)(2)(C)(viii)(I). That is, the fact that SSA
generally began collecting the same broad categories of
information long before 1990 does not establish that the
particular records at issue here fall outside the temporal
limitation established by § 405(c)(2)(C)(viii)(I). Indeed, if the
pre-1990 origins of SSA’s system place SSNs outside the
confidentiality mandate, as the government now argues, it is
unclear what in § 405(c)(2)(C)(viii)(I) would prevent SSA
from publicly releasing any—or even every—SSN in its
database. Cf. 42 U.S.C. § 1306(a)(1) (similar confidentiality
provision).
22
In any event, modified SAVE does not merely transmit
preexisting fields from Numident. It also generates new
person-specific records at several junctures—and the
government’s temporal argument does not address those new
records or their implications for the temporal question raised
by § 405(c)(2)(C)(viii)(I) either. In responding to a query, SSA
compares the information supplied by DHS with its own
records and creates a new, query-specific match record, which
flags whether matches to its database using the submitted SSN,
name, and date of birth were successful and appends the results
to the requested citizenship information. DHS likewise creates
and retains a person-specific SAVE case for ten years.
Although our dissenting colleague notes that the SAVE case
itself is not disclosed to the SAVE user, Dissent 8, DHS uses
the SAVE case to create a “SAVE case response”—another
new, user-facing file—that is disclosed. DHS AR 114–20;
Notice of a Modified System of Records, 90 Fed. Reg. 48948,
48950, 48954–55 (Oct. 31, 2025).
Assuming those records are SSNs or “related records” and
that the transfers are disclosures within the meaning of §
405(c)(2)(C)(viii), the temporal question is, again, pursuant to
what authority are they obtained or maintained. The
government does not say. Elsewhere, the government invokes
§ 1373(c) as authority for the modified-SAVE exchange, but
that provision cannot supply the needed pre-1990 authority:
Congress enacted § 1373(c) in 1996. Gov’t Mot. 3, 17.
The government thus ultimately at best establishes a
potentially salient historical fact: SSA began collecting certain
categories of information long before 1990. But the
government does not provide adequate support for the
proposition its argument requires: that the particular SSNs and
related records implicated by modified SAVE are neither
obtained nor maintained pursuant to any post-1990 law. Of
course, had the government timely raised the argument in the
23
district court or sought to fully develop it in the way the district
court invited, the picture might look quite different. And full
merits briefing in this appeal might also flesh out the arguments
(and potential responses) in ways that alter our understanding
of the meaning of the confidentiality provision. But on the
briefing and record before us at this preliminary stage, the
argument does not make a strong showing that the temporal
limitation defeats plaintiffs’ claim.
2.
The government next argues that modified SAVE does not
“disclose” SSNs or “related records” in a way that §
405(c)(2)(C)(viii)(I) bars. The theory is that the sole
information disclosed to a SAVE user is citizenship status (and,
when applicable, an indicator that the person is deceased). That
information, the government posits, is neither an SSN nor a
“related record” that identifies an individual. Gov’t Mot. 16–
17. At least on the record before us at this stage, that account
of modified SAVE is inadequate to carry the government’s
burden.
First, modified SAVE undisputedly involves at least one
disclosure of an SSN in the most literal sense. When a SAVE
user submits only a partial SSN and the query produces a
match, SSA sends DHS the complete nine-digit number. Gov’t
Mot. 6, 15; DHS AR 424. SSA thus gives DHS a full SSN that
DHS did not previously possess. Assuming the SSN otherwise
falls within § 405(c)(2)(C)(viii)(I), that is plainly a disclosure.
The government acknowledges the transfer of a person’s full
SSN—and, in fact, explains in its stay motion the conditions
under which it occurs—but does not address how it may fall
outside the confidentiality mandate. Gov’t Mot. 6.
24
Second, modified SAVE does more than merely return an
indicator for citizenship or death status. It verifies the
information supplied by the SAVE user against SSA’s records,
including as to a person’s SSN. For each query, SSA takes the
submitted SSN, name, and date of birth and creates a query-
specific match record containing three separate results: SSN
match—true or false; name match—true or false; date-of-birth
match—true or false. SSA then sends those new matching
results to DHS together with citizenship and other information.
DHS AR 116, 225–26, 424, 437–38.
There are sound reasons to think verification of that kind
might well amount to a “disclos[ure]” of an SSN for purposes
of § 405(c)(2)(C)(viii)(I). Although we have no need to
authoritatively construe the provision’s use of that term at this
stage, we have repeatedly recognized in related privacy
contexts that an agency can reveal new information by
confirming its accuracy. As we have explained, confirmation
by an agency “in a position to know” may be revealing because
it removes “any lingering doubts” about the information in
question. Frugone v. CIA, 169 F.3d 772, 774–75 (D.C. Cir.
1999) (citation omitted); Knight First Amend. Inst. at Columbia
Univ. v. CIA, 11 F.4th 810, 816 (D.C. Cir. 2021) (citation
omitted).
Here, the verifying agency itself assigns and maintains the
records being checked. When SSA reports an SSN match, it
confirms that its records associate the submitted number with
the person identified in the query; and when it reports no match,
it communicates the contrary. Indeed, the familiar Glomar
response to a Freedom of Information Act request—refusing
either to confirm or deny whether particular records exist—
rests on the premise that either answer may itself disclose
protected information. See Wolf v. CIA, 473 F.3d 370, 374
(D.C. Cir. 2007). Separately, we have rejected the categorical
25
proposition that information cannot be “disclosed” to a
recipient whenever the recipient already knows it. See Pilon v.
Dep’t of Just., 73 F.3d 1111, 1119–26 (D.C. Cir. 1996). Those
authorities of course do not definitively resolve the meaning of
§ 405(c)(2)(C)(viii)(I). They do, however, call into question
the government’s premise that verification cannot amount to
disclosure when the requester supplied the information being
verified. After all, if a party asked SSA to verify that a
particular nine-digit number it believes may be a given
person’s SSN is in fact the correct SSN, and SSA would
respond with either a yes or a no rather than declining to
answer, it is quite conceivable that an affirmative answer
amounts to a disclosure by SSA of the person’s SSN at some
meaningful level.
There appears to be no dispute that verification of an SSN
occurs when SSA transfers information to DHS in response to
a query using modified SAVE; and that verification itself
involves a possible violation of § 405(c)(2)(C)(viii)(I)’s
confidentiality mandate. As for the ensuing transfer of
information from DHS to the querying SAVE user, the present
record leaves uncertain precisely how, and to what extent,
SSA’s match information ultimately reaches a SAVE user. At
least some error messages appear in user-facing responses. See
DHS AR 762. And DHS’s own description of the system states
that, when a corresponding record is located, SAVE sends a
“SAVE case response” that “includes the data elements used to
create the case” and other fields supplied by SSA. Notice of a
Modified System of Records, 90 Fed. Reg. at 48950; see also
DHS AR 1379, 1443–44. The district court specifically
identified this as a question on which further factual
development could have been useful had the issue been timely
presented. Add. 95–97. Those sorts of factual uncertainties
weigh against the government at this stage.
26
Finally, the government’s argument about “related
records” rests on a similarly narrow—possibly too narrow—
description of what modified SAVE discloses. Congress
defines a “related record” as “any record, list, or compilation
that indicates, directly or indirectly, the identity of any
individual” for whom an SSN or request for one is maintained.
42 U.S.C. § 405(c)(2)(C)(viii)(IV). The government reasons
that a citizenship (or death status) indicator does not itself
identify anyone and that the identifying information instead
“flows the other way,” from the SAVE user to DHS. Gov’t
Mot. 16.
That, though, is not the specific inquiry called for by the
statutory definition. The statute does not ask whether one field
in a record—“U.S. Citizen,” for example—alone identifies a
person. It asks whether the “record, list, or compilation”
indicates the identity of an individual, “directly or indirectly.”
42 U.S.C. § 405(c)(2)(C)(viii)(IV). The government’s motion
narrows both parts of that definition: it focuses on a single data
field rather than the record in which the field appears, and it
replaces “directly or indirectly” with an ellipsis when quoting
the statute. Gov’t Mot. 16; Pls.’ Resp. 20–21.
The records produced by modified SAVE seem to fit the
definition as written. DHS creates a separate SAVE case for
each person submitted and retains that record for ten years.
Notice of a Modified System of Records, 90 Fed. Reg. at
48950, 48954–55. And the “SAVE case response” DHS sends
to a user “includes the data elements used to create the case”
together with additional citizenship or immigration
information. Id. at 48950. For bulk submissions, users may
also generate reports listing cases, statuses, and SAVE
responses. Id. at 48951. A record that links a person’s
submitted name, date of birth, and SSN to a citizenship
response can indicate whose information it reports even if the
27
citizenship field itself contains no name. The government does
not explain why such a record falls outside the definition
merely because the requester initially supplied many of its data
elements. For that reason, too, the government has not made a
strong showing that the records disclosed through modified
SAVE fall outside § 405(c)(2)(C)(viii)(IV).
IV.
The government does not argue that it could be entitled to
a stay pending appeal even if it fails to make a strong showing
of a likelihood of success on the merits. We thus have no
occasion to consider the remaining stay factors—whether the
government would be irreparably injured absent a stay,
whether a stay would substantially injure the other parties, and
where the public interest lies. Nken, 556 U.S. at 434. We
nonetheless briefly note some considerations that would inform
that inquiry, as to which the government would bear the burden
to show that the circumstances would justify an exercise of our
equitable discretion. Id. at 433–34.
The government’s principal operational harm from the
denial of a stay pending appeal is that, without interim access
to modified SAVE during the pendency of the appeal, some
citizenship verifications are slower and more cumbersome.
Gov’t Mot. 26–27. And the government identifies certain
specific programs that will be impeded without access to
modified SAVE, including verifications of eligibility for
commercial driver’s licenses and certain housing benefit
programs. Gov’t Mot. 26. Those operational consequences are
real, but it also bears noting that they are not of an all-or-
nothing character: whatever its limitations, the preexisting
SAVE program in operation for decades remains available to
the states and to federal programs. The harm stems from the
unavailability of modified SAVE’s SSN- and bulk-search
28
functionalities, not the loss of SAVE-based verification
altogether—and then only for the pendency of this appeal.
Although the chief use of modified SAVE giving rise to
this litigation concerns citizenship verifications related to voter
eligibility, disruptions to that use do not present the kind of
imminent harm that would warrant intervention in this posture.
Federal law constrains systematic voter-list maintenance in the
immediate time ahead. The National Voter Registration Act
makes it unlawful to undertake systematic voter removal within
the 90-day period preceding a federal primary or general
election. See 52 U.S.C. § 20507(c)(2)(A). As the government
itself argued when opposing plaintiffs’ request for preliminary
relief in the district court, the NVRA’s 90-day limitation was
“fatal” to a claim of imminent harm premised on systematic
voter-roll maintenance. See Add. 103–04. By the time the
government sought a stay pending appeal in this court, that
limitation was already operative in several states and soon
would be in many more: when the government filed its motion
on July 8, for instance, Florida (an amicus supporting the
government) was already within the 90-day period preceding
its August 18 primary, and the 90-day period leading up to the
general election was less than one month away.
While the Supreme Court’s recent order granting a stay in
Trump v. California, No. 26A124 (Aug. 24, 2026), focused on
the timing of an asserted election-related harm, the situation
there was materially different. The Court emphasized that,
absent interim relief, ordinary appellate review would itself
deprive the Executive of an ability to pursue its election-related
objectives: “reversal of the District Court’s judgment would
come too late.” Id. (slip op. at 9). Here, by contrast, federal
law itself—in the form of the NVRA—constrains the principal
election-related use of modified SAVE during the relevant
period. Denying a stay thus does not deprive the government
or the states of an otherwise available opportunity to undertake
29
systematic voter-list maintenance while ordinary appellate
review proceeds. And although our dissenting colleague
suggests that modified SAVE could be used for individualized
decisions that may fall outside the NVRA’s reach, Dissent 20
n.4, the government itself drew no such distinction when it
invoked the NVRA to address the imminence of election-
related harm in the district court. In any event, the preexisting
version of SAVE remains available during the appeal for
individualized queries of the sort it has long permitted.
As for the competing harms to plaintiffs that would attend
the grant of an interim stay, the district court described the
adverse consequences to citizens from using inaccurate SSA
citizenship information in modified SAVE, including the
risk—already borne out in Texas—that citizens may be
required to prove citizenship to remain registered and, in some
cases, may have their registrations cancelled. Add. 103–04.
The public interest does not favor interim restoration of a
system the government has not made a strong showing it may
lawfully operate. See League of Women Voters of the United
States v. Newby, 838 F.3d 1, 12 (D.C. Cir. 2016).
* * * * *
Because the district court’s ruling under the Social
Security Act independently supports its judgment, we do not
address the court’s additional holdings concerning DHS’s
statutory authority, the Privacy Act, or arbitrary-and-capricious
review. The government has not made the requisite “strong
showing that [it] is likely to succeed on the merits” of the Social
Security Act claim, Nken, 556 U.S. at 434, and we therefore
deny its motion for a stay pending appeal.
KATSAS, Circuit Judge, dissenting: For decades, states
have obtained data regarding citizenship and immigration
status from the Department of Homeland Security to assess
eligibility for public benefits and voting. DHS answers these
queries through its Systematic Alien Verification for
Entitlements (SAVE) database. Before 2025, SAVE had
limited utility: States could submit only individualized queries,
DHS had no means of confirming the citizenship of U.S.-born
individuals, and DHS lacked access to relevant records of the
Social Security Administration. After multiple states sued,
demanding that DHS make SAVE more effective, the agency
implemented changes that permitted bulk queries and allowed
internal agency use of social security numbers to determine the
citizenship of individuals lacking an immigration number from
DHS.
A voting-rights organization and a privacy organization
challenged these changes. On summary judgment, the district
court vacated the notices announcing the changes and the
modified SAVE program. For the reasons set forth below, I
would stay the order pending the government’s appeal.
I
A
The Immigration Reform and Control Act of 1986 (IRCA)
directed the Department of Homeland Security’s predecessor
agency to “implement a system for the verification of
immigration status.” Pub. L. No. 99-603, § 121(c)(1), 100 Stat.
3359, 3391. Congress requires states and some federal
agencies to use this system to assess eligibility for a wide array
of federal benefits. See, e.g., 42 U.S.C. § 1320b-7(a), (b)(1)–
(4), (d)(3) (Temporary Assistance for Needy Families,
Medicaid, unemployment compensation, and Supplemental
Nutrition Assistance Program); id. § 1436a(d)(3) (housing
benefits); 20 U.S.C. § 1091(g) (student aid); see also 49 C.F.R.
2
§ 383.73(m) (commercial driver’s license); 6 C.F.R. § 37.13(b)
(REAL ID).
To comply with IRCA, DHS administers the Systematic
Alien Verification for Entitlements (SAVE) program. SAVE
allows federal, state, and local government agencies to query
DHS about the citizenship or immigration status of individuals.
The federal government also uses SAVE to control “access [to]
sensitive government functions—such as employment in
government positions, entry to secure facilities,” and
“government-issued licenses and credentials.” Add. 88.
SAVE does not itself determine eligibility for any benefits;
ultimate eligibility determinations are left to the querying
agencies that use SAVE. 42 U.S.C. § 1320b-7(d)(5).
Congress also has required states to ensure that their voter-
registration records are accurate, see 52 U.S.C. §§ 21083(a)(4),
20501(b)(4), and prohibited aliens from voting in federal
elections, see 18 U.S.C. § 611(a). Furthermore, under the
Illegal Immigration Reform and Immigrant Responsibility Act
of 1996 (IIRIRA), DHS has the “[o]bligation to … respond to
an inquiry by a Federal, State, or local government agency,
seeking to verify or ascertain the citizenship or immigration
status of any individual within the jurisdiction of the agency for
any purpose authorized by law, by providing the requested
verification or status information.” 8 U.S.C. § 1373(c). Since
2005, states have used SAVE to verify that voters are citizens.
Today, 27 states use SAVE for that purpose. From January 1,
2025, to April 1, 2026, these states made some 60 million
voter-verification queries to SAVE. In all, over 1,300 federal,
state, and local government agencies use SAVE, which
processed some 25 million queries in fiscal year 2024 and 200
million queries in fiscal year 2025. Add. 83; About SAVE,
USCIS, https://perma.cc/XXG4-498F.
3
B
Before 2025, SAVE had three significant shortcomings.
First, it could not verify the citizenship of individuals born in
the United States. Second, SAVE could access only DHS
records linked to an individual’s DHS numeric identifier, such
as an alien registration number. It could not access records of
the Social Security Administration (SSA) or conduct searches
using social security numbers (SSNs). Third, SAVE could
process verification requests only one individual at a time; it
could not process bulk requests. According to the plaintiffs
themselves, these shortcomings made SAVE “exceedingly
limited in scope and functionality.” First Amended and
Supplemental Complaint, ECF Doc. 61, at 2.
Dissatisfied with these limitations, a group of states sued
DHS in the District Court for the Northern District of Florida
in late 2024. The states alleged that SAVE’s deficiencies made
DHS unable to comply with its obligation under IIRIRA to
respond to their inquiries about citizenship or immigration
status. The states and DHS resolved the case through a
settlement agreement executed in November 2025 and
approved by the Northern District in December 2025. The
agreement required DHS to ensure that SAVE could “integrate
with the Social Security Administration to allow searches with
full SSNs” or “with last-four-digits SSNs” and could “process
bulk upload verification requests so that users of the system
will not need to input verification requests one-by-one.”
Florida v. DHS, No. 24-cv-509, 2026 WL 1968339, at *1 (N.D.
Fla. July 7, 2026) (cleaned up).
In March 2025, President Trump ordered DHS to ensure
that state and local officials have “access to appropriate
systems for verifying the citizenship or immigration status of
individuals registering to vote or who are already registered.”
4
Exec. Order No. 14248, Preserving and Protecting the
Integrity of American Elections, 90 Fed. Reg. 14005, 14006
(Mar. 25, 2025). He also ordered the SSA to “take all
appropriate action to make available the Social Security
Number Verification Service, the Death Master File, and any
other Federal databases containing relevant information to all
State and local election officials engaged in verifying the
eligibility of individuals registering to vote or who are already
registered.” Id. at 14007. Thus, in May 2025, DHS announced
two major changes to the SAVE database. First, SAVE users
could now verify the citizenship or immigration status of
individuals using their SSNs. Second, SAVE users could
submit queries in bulk, checking their entire voter-registration
lists against federal databases to identify potential non-citizen
voters. Optimizing SAVE: New Options to Create Cases with
a Social Security Number and by Bulk Upload, USCIS,
https://perma.cc/BY4S-AXKP. I refer to this new version as
“modified SAVE.”
With modified SAVE, the requesting agency enters into a
spreadsheet the following required information for each person
whose citizenship or immigration status it seeks to verify: first
and last name, date of birth, the reason for verification, and at
least one numeric identifier, such as an SSN or any DHS
identifier. DHS AR 1443–45. If the user provides SSNs,
SAVE then checks individuals listed in the spreadsheet against
the SSA’s records. Id. at 1364. As relevant here, the SSA
reports to DHS whether the submitted name, date of birth, and
SSN match its records. Add. 18. If the requesting agency
supplies a partial SSN that matches, the SSA reports the full
SSN to DHS. Id. The SSA also reports to DHS whether its
records show each individual to be a citizen, the immigration
status of any non-citizen, whether the individual was foreign-
born, and whether the individual is deceased. Id.
5
If the search of SSA records flags a potential non-citizen,
DHS attempts to verify citizenship status by other means. Add.
18–19. If a DHS numeric identifier is available, SAVE
automatically queries additional federal databases. Id. If those
queries do not confirm citizenship, DHS conducts manual
searches of yet other DHS systems. Add. 80. If this process
confirms that the individual is a citizen, the requesting agency
is so informed. Id. at 19. If SAVE returns anything else—such
as a non-citizen status, an unconfirmed status, or a death
indicator—the requesting agency is told to contact the
individual for more information. Id. at 19–20.
II
The lead plaintiffs in this case are two nonprofit
organizations: the League of Women Voters and the Electronic
Privacy Information Center (EPIC). The League of Women
Voters is dedicated to “encouraging Americans to participate
in the electoral process,” and it registers people to vote. First
Amended and Supplemental Complaint, ECF Doc. 61, at 4–5.
EPIC is dedicated to monitoring “government activities that
impact individual privacy.” Id. at 6. In September 2025, the
plaintiffs sued DHS and the SSA in the District Court for the
District of Columbia. The organizations contend they have
members who have been incorrectly identified as non-citizens
under modified SAVE and thus required to document their
citizenship, as well as members whose SSNs have been
disclosed without consent. The organizations argue that the
agencies’ operation of modified SAVE lacks statutory
authorization, violates the Social Security Act and the Privacy
Act, and is arbitrary.
The district court denied a stay under the Administrative
Procedure Act, but then granted summary judgment to the
plaintiffs. As relevant here, the court concluded that the
6
plaintiffs have Article III standing to challenge the operation of
modified SAVE, that its operation violates substantive
disclosure restrictions in the Social Security Act and the
Privacy Act, that DHS and the SSA failed to give adequate
notice of the new uses of data, and that the agencies acted
arbitrarily. The court issued final, universal relief purporting
to vacate modified SAVE, including its ability to accept bulk
queries from requesting agencies, and the notices
implementing modified SAVE.
In response to the D.D.C. order, DHS and the SSA
disabled modified SAVE. Arguing that this order conflicted
with the settlement agreement approved by the Northern
District of Florida, the state plaintiffs moved that court to
enforce the settlement agreement against DHS. The Northern
District concluded that DHS had violated the settlement
agreement, granted the enforcement motion, and ordered DHS
to reinstate the bulk-upload and SSN-search functions of
modified SAVE as to the four state plaintiffs. Florida v. DHS,
2026 WL 1968339, at *4. The League of Women Voters and
EPIC intervened in the Northern District and appealed the
enforcement order to the Eleventh Circuit. Florida v. DHS, No.
26-12533 (11th Cir. July 21, 2026). In the D.D.C., the League
of Women Voters and EPIC moved to enforce the summary-
judgment order. In a minute order, that court deferred ruling
on the motion to enforce, pending the outcome of the Eleventh
Circuit appeal.
DHS and the SSA (collectively “the government”)
appealed the D.D.C. summary-judgment order and moved in
that court for a stay pending appeal. The district court denied
the stay motion, and the government then moved this Court for
a stay pending appeal.
7
In assessing the government’s stay motion, we consider
the government’s likelihood of success on the merits, whether
it will suffer irreparable injury absent relief, and the balance of
the equities. Trump v. California, Nos. 26A124, 26A139, 2026
WL 2473573, at *2 (U.S. Aug. 24, 2026) (per curiam).
III
The government argues that the plaintiffs are unlikely to
succeed on appeal because they lack Article III standing and
their claims are without merit. In determining likelihood of
success at the stay stage, we may consider standing and merits
questions, and we may do so in either order. See Mullin v. Doe,
146 S. Ct. 2121, 2137 (2026) (plurality). I conclude that the
government is likely to succeed on the merits, so I need not
address standing at this stage.
A
The government is likely to succeed in showing that
modified SAVE does not violate the Social Security Act’s
prohibition on disclosure of SSNs or related records. That Act
provides:
Social security account numbers and related
records that are obtained or maintained by
authorized persons pursuant to any provision of
law enacted on or after October 1, 1990, shall
be confidential, and no authorized person shall
disclose any such social security account
number or related record.
42 U.S.C. § 405(c)(2)(C)(viii)(I). In considering whether the
operation of modified SAVE violates this disclosure bar, we
must consider both (1) disclosures from the SSA to DHS and
8
(2) disclosures from DHS to the requesting agency. In my
view, section 405 does not bar either category of disclosure.
To begin, the bar does not apply to the SSA’s disclosures
to DHS, because the SSA obtains and maintains its relevant
records pursuant to laws enacted well before 1990. The Social
Security Act of 1935 authorizes the SSA to create and maintain
SSNs. See Pub. L. No. 74-271, § 808, 49 Stat. 620, 638;
Identification of Taxpayers under Title VIII of the Social
Security Act, 1 Fed. Reg. 2023, 2024 (Nov. 7, 1936). And, in
1972, amendments to that Act instructed the SSA to “require
of applicants for social security account numbers such evidence
as may be necessary to establish the age, citizenship, or alien
status, and true identity of such applicants.” Social Security
Amendments of 1972, Pub. L. No. 92-603, § 137(2), 86 Stat.
1329, 1364–65 (codified at 42 U.S.C. § 405(c)(2)(B)(ii)). In
sum, the SSA creates, obtains, and maintains SSNs and records
related to age, citizenship and alien status, and identity
pursuant to statutes enacted decades before 1990.1 And that
information is exactly what the SSA discloses to DHS. 90 Fed.
Reg. at 48950, 48952.2
1
The majority finds it implausible that section 405’s disclosure
bar may not apply to the SSA’s handling of core records like SSNs.
Ante, at 21. But the bar itself was not even enacted until November
1990. See Food, Agriculture, Conservation, and Trade Act of 1990,
Pub. L. No. 101-624, §§ 1735(b), 2201(c), 104 Stat. 3359, 3792,
3952. And Congress enacted the bar in direct conjunction with
provisions newly permitting other agencies, such as the Department
of Agriculture, to collect SSNs. See id. §§ 1735(a), 2201(a)–(b), 104
Stat. at 3791–92, 3951–52. So it is thus hardly surprising that this
1990 bar does not cover the SSA’s management of its own core
records, though of course other statutes may.
2
The majority contends that SAVE generates new types of
records: a “match record” from the SSA, a “SAVE case” that DHS
9
Moreover, DHS discloses neither SSNs nor related records
to the requesting agency. Instead, DHS conveys only
information about the individual’s citizenship or immigration
status (plus whether the individual is still alive). See 90 Fed.
Reg. at 48950; Add. 18–19. Thus, if the SSA provides a
matching SSN to DHS, the SSN itself never leaves DHS. See
id. Nor does DHS disclose any related records covered by the
disclosure bar. A “related record” is “any record, list, or
compilation that indicates, directly or indirectly, the identity of
any individual with respect to whom a social security account
number or a request for a social security account number is
maintained.” 42 U.S.C. § 405(c)(2)(C)(viii)(IV). The
plaintiffs note that DHS “obtain[s]” such records from the SSA
when it receives a “full SSN for all matches (when a partial
SSN is provided) and a ‘true/false’ match response on certain
inputted fields: SSN, name, and date of birth.” Plaintiffs’ Resp.
at 21 (cleaned up). But even if DHS obtains such covered data
from the SSA, DHS never discloses it to the requesting agency
or to anyone else. Nor does DHS “indicate[], directly or
indirectly, the identity of any individual,” 42 U.S.C.
§ 405(c)(2)(C)(viii)(IV), because its disclosure to the
requesting agency communicates only what SSA records say
about the citizenship of individuals identified by the requesting
agency when it provides DHS with a first and last name, date
of birth, and SSN or other identifier. Moreover, the Social
Security Act itself distinguishes between the “identity” of an
individual, which DHS does not provide to the requesting
maintains for ten years, and SAVE’s responses to user queries. Ante,
at 22. However, the “match record” merely includes the contents of
records that the SSA maintains pursuant to pre-1990 law. See 90
Fed. Reg. at 48952. DHS does not disclose any “SAVE case” records
to the requesting agency, except for the responses that SAVE
automatically provides. See id. at 48954–55; Add. 19. And as
explained below, those responses do not qualify as “related
record[s]” under the Social Security Act.
10
agency, and “the fact that such individual is a citizen or a
noncitizen,” which DHS does seek to provide. See id.
§ 405(c)(2)(B)(i)(III). In sum, SAVE responses are not
“related records” because they simply repeat identifying
information provided by the SAVE user, in the course of
conveying any additional, unprotected information about the
identified individual’s citizenship status.3
The district court treated these arguments as forfeited, but
we have discretion to excuse forfeitures “in cases involving
uncertainty in the law” and in “extraordinary situations with the
potential for miscarriages of justice.” Flynn v. Comm’r, 269
F.3d 1064, 1069 (D.C. Cir. 2001). The majority stresses that
we should exercise this discretion sparingly, both in general
and especially in the context of stay litigation. Ante, at 9–17.
I have no quarrel with those propositions in the abstract. But
in my view, several considerations support excusing the
forfeiture in the quite unusual circumstances presented here.
3
The majority notes that disclosure bars sometimes cover
disclosures to individuals who already know the protected
information. Ante, at 24–25 (citing Pilon v. DOJ, 73 F.3d 1111,
1119–26 (D.C. Cir. 1996)). Fair enough, but it seems to me quite a
stretch to extend that principle to the identifying information at issue
here, where the assertedly protected information flows from the
requesting agency to DHS, and does so for the sole purpose of
generating a discrete response disclosing unprotected information
about citizenship or immigration status. Similarly inapposite is the
cloak-and-dagger law regarding official acknowledgment and
Glomar responses, ante, at 24–25, which applies where the existence
or not of agency records is itself protected information. See, e.g.,
Knight First Amend. Inst. at Columbia v. CIA, 11 F.4th 810, 813–16,
819–20 (D.C. Cir. 2021). Here, it is no secret that the SSA since
1972 has been statutorily required to obtain and maintain records
regarding the citizenship or alien status of individuals authorized or
required to have SSNs. See 42 U.S.C. § 405(c)(2)(B)(ii).
11
First, this case involves the ongoing administration of an
important federal program mandated by Congress to facilitate
eligibility determinations for voting and a wide range of federal
benefits. See Pub. L. No. 99-603, § 121(c)(1), 100 Stat. at 3391
(IRCA); 8 U.S.C. § 1373(c) (IIRIRA). The original SAVE
program was severely limited in its functionality; among other
things, it could not even confirm the citizenship of U.S.-born
individuals, and it required queries to be performed one-by-
one. The modified SAVE program cured those deficiencies, so
we should not lightly frustrate its operation based on legal
premises that may be erroneous. Instead, we should exercise
our “independent power to identify and apply the proper
construction of governing law.” Kamen v. Kemper Fin. Servs.,
Inc., 500 U.S. 90, 99 (1991).
Second, the program implicates various statutory
obligations, entitlements, and interests of the states. Federal
law requires the states to ensure that their voter-registration
rolls are accurate. See 52 U.S.C. §§ 21083(a)(4), 20501(b)(4).
It also prohibits aliens from voting in federal elections, see 18
U.S.C. § 611(a), the manner of which is presumptively a state
responsibility, U.S. Const. art. I, § 4, cl. 1. How are states to
carry out these responsibilities effectively, if they cannot obtain
reliable information about the citizenship and immigration
status of their residents from a federal government assigned
with the primary “power over the subject of immigration and
the status of aliens”? Arizona v. United States, 567 U.S. 387,
394 (2012). To help states carry out these responsibilities, as
well as the responsibility for enforcing eligibility restrictions
governing state-administered federal programs, IIRIRA gives
states an affirmative entitlement to receive from DHS
information about “the citizenship or immigration status of any
individual” within their respective jurisdictions. See 8 U.S.C.
§ 1373(c) (imposing on DHS the “[o]bligation to respond” to
such queries). Likewise, states have important interests in
12
receiving this information to the extent that many state
entitlement programs are also limited to United States citizens
resident in the state. See Br. of Amici Curiae Iowa, Florida,
Indiana, and Ohio at 5–7 (States’ Br.). It is one thing to saddle
the United States with the consequences of its own litigation
decisions; it is quite another to so saddle the states.
Third, this case involves dueling district-court injunctions,
as the district court here has prohibited what the Northern
District of Florida has compelled. Specifically, the Northern
District ordered DHS to “immediately comply with the court-
approved settlement agreement” in the case before it “by
reinstating [the plaintiff states’] access to the bulk-upload and
SSN-search features in the [modified] SAVE system.” Florida
v. DHS, 2026 WL 1968339, at *4. And the district court here
purported to “set[] aside and vacate[] the 2025 SAVE modified
system,” Add. 5, thus effectively and universally enjoining its
use. The majority notes that the Northern District did not
expressly “address the substance of the claims presented here.”
Ante, at 16. True enough, though the Northern District did state
that its approval of the settlement agreement reflected an
“implicit determination that the modifications to the SAVE
system were lawful.” Florida v. DHS, 2026 WL 1968339, at
*3. And the Northern District did expressly “disagree[] with
the conclusions” of the district court here, id., which in turn
stated its view that the Northern District had “erred in
significant ways” in enforcing the settlement agreement, Add.
107. In any event, the respective orders unquestionably impose
conflicting legal obligations, regardless of how the respective
district courts might view the underlying merits. And in doing
our part to resolve the conflict, we should say what the
governing law actually is. In other words, if the Northern
District provided the state plaintiffs there with legally justified
relief, we should not allow its order to be frustrated based on
any litigation missteps by the federal government in this case.
13
Finally, excusing the forfeiture here would neither
prejudice the plaintiffs nor sandbag the district court. The
government made its likely winning argument in stay motions
before the district court and this Court; the plaintiffs thoroughly
responded on the merits both below and here; the district court
had a chance to excuse the forfeiture; and the issue depends “on
a pure issue of statutory interpretation” that we would review
de novo and that does not depend on further factual
development. Amcast Indus. Corp. v. Detrex Corp., 2 F.3d
746, 749–50 (7th Cir. 1993) (Posner, J.).
Against all of this, the majority notes that the district court
offered the government an opportunity to seek consideration of
its forfeited arguments under Federal Rule of Civil Procedure
52(b). Ante, at 13 n* (citing Add. 98 n.3). That rule allows
post-judgment motions asking the court to “amend its
findings—or make additional findings” and to “amend the
judgment accordingly.” But “findings” under Rule 52 involve
matters of fact, not “conclusions of law” that the rule separately
addresses. Fed. R. Civ. P. 52(a)(1); see Env’t Comm. of Fla.
Elec. Power Coordinating Grp., Inc. v. EPA, 94 F.4th 77, 91
(D.C. Cir. 2024) (per curiam). As explained above, the
forfeited arguments here turn on what statutes authorize the
SSA to obtain or maintain SSNs and information regarding
citizenship or immigration status, and on whether the
disclosures made by DHS under modified SAVE qualify as
“related records” under the disclosure bar in the Social Security
Act. As those disputes involve pure questions of law, Rule
52(b) was not an available avenue for the government.
The majority likewise suggests another possibility not
mentioned by the district court—that the government could and
should have sought to raise its forfeited arguments through a
motion to alter or amend the district court’s judgment under
Federal Rule of Civil Procedure 59(e). Ante, at 13. True, we
14
have indicated that parties “should” present new arguments by
seeking reconsideration in the district court before raising them
on appeal. City of New York v. Nat’l R.R. Passenger Corp.,
776 F.3d 11, 17 (D.C. Cir. 2015). But there is no categorical
requirement to do so, and we have sometimes reached the
merits despite even an express waiver below, above and
beyond the mere failure to seek reconsideration. United States
ex rel. Cimino v. IBM Corp., 3 F.4th 412, 418 n.1 (D.C. Cir.
2021). Moreover, new arguments are substantially disfavored
in reconsideration motions under Rule 59(e), which we have
described as “not a vehicle to present a new legal theory that
was available prior to judgment.” Leidos, Inc. v. Hellenic
Republic, 881 F.3d 213, 217 (D.C. Cir. 2018) (cleaned up). So
the hypothetical Rule 59(e) motion posited by the majority
would have presented essentially the same question that we
now confront—whether unusual circumstances warrant
excusing a forfeiture. See, e.g., Dyson v. District of Columbia,
710 F.3d 415, 420 (D.C. Cir. 2013). And the government’s
failure to move for reconsideration does not undermine any of
the reasons for excusing the forfeiture here: Administration of
modified SAVE is still important. The states’ interests in
receiving information from modified SAVE are still pressing.
The two judicial orders still conflict. And the governing legal
questions are still cleanly presented.
B
The government is also likely to succeed in showing that
modified SAVE does not violate the Privacy Act. It argues that
the Privacy Act claims here are not judicially reviewable and
that they lack merit. Because the government is likely to
succeed on the merits, I need not consider its alternative non-
reviewability arguments.
15
1
The Privacy Act generally bars agencies from disclosing
individuals’ records without consent, 5 U.S.C. § 552a(b), but it
exempts “routine use[s],” which are disclosures “compatible
with the purpose for which [the record] was collected,” id.
§ 552a(b)(3), (a)(7). This Court has not settled on a definitive
test for compatibility, but every possible formulation sets a low
bar. Judge Silberman and Judge Williams construed the term
according to its ordinary meaning: A disclosure of a record is
“compatible” so long as it does not conflict with or frustrate the
purposes for which the record was collected. U.S. Postal Serv.
v. Nat’l Ass’n of Letter Carriers, 9 F.3d 138, 144 (D.C. Cir.
1993) (opinion of Silberman, J.); id. at 146–47 (Williams, J.,
concurring in part). Other circuits, relying on legislative
history, require “some meaningful degree of convergence”
between the purposes of collection and disclosure. Britt v.
Naval Investigative Serv., 886 F.2d 544, 549–50 (3d Cir. 1989);
Swenson v. U.S. Postal Serv., 890 F.2d 1075, 1078 (9th Cir.
1989). We need not settle on a “precise definition of
‘compatibility,’” Chichakli v. Tillerson, 882 F.3d 229, 233
(D.C. Cir. 2018), because modified SAVE satisfies “any
reasonable formulation of the compatibility test,” Ames v.
DHS, 861 F.3d 238, 240 n.1 (D.C. Cir. 2017) (Kavanaugh, J.).
Even if SSN data was originally collected only to establish
authorization to work and eligibility for social-security
benefits, disclosing that data to confirm eligibility for other
benefits and voting neither conflicts with nor frustrates those
initial purposes. Similarly, such disclosure likely satisfies
Britt’s stricter standard as well, because the same purpose runs
through the collection and disclosures here: establishing
individuals’ eligibility to work, vote, or receive government
benefits. The SSA maintains SSNs to match individuals to
benefits they are entitled to; SAVE uses the same data to match
16
individuals to extant records of their citizenship or immigration
status, which allows requesting agencies to determine
eligibility for those same benefits, for other public benefits, and
for voting. The district court likely erred by framing the
collection purpose at too low a level of generality, which is at
odds with both the statute’s forgiving text (“compatible”) and
with the SSN’s long-established role as a “nearly universal
identifier.” Puckett, The Story of the Social Security Number,
69 Soc. Sec. Bull. no. 2 (2009), https://perma.cc/59V7-XG2D.
2
The government is also likely to succeed in showing that
the Privacy Act’s procedural requirements provide no basis for
affording prospective relief against the future operation of
modified SAVE.
Under the Privacy Act, a system of records is “a group of
any records under the control of any agency from which
information is retrieved by the name of the individual or by
some identifying number, symbol, or other identifying
particular assigned to the individual.” 5 U.S.C. § 552a(a)(5).
When an agency establishes or revises a system of records, it
must publish in the Federal Register a notice of the system’s
“existence and character,” including “each routine use” of the
records. Id. § 552a(e)(4). An agency may not put a new
routine use of the information into effect until at least 30 days
after the notice is published, during which time there must be
“an opportunity for interested persons to submit written data,
views, or arguments to the agency.” Id. § 552a(e)(11). The
notice is called a System of Records Notice (SORN). The
parties agree that SAVE qualifies as a system of records subject
to these notice requirements.
Neither DHS nor the SSA published a SORN when the
agencies set up modified SAVE in May 2025, but each agency
17
later published a SORN regarding its respective new routine
uses of data. The SORNs described those new uses, invited
comments within 30 days, and provided that the new uses
would become effective at the close of the comment period.
See Notice of a Modified System of Records, 90 Fed. Reg.
48948, 48948–50 (Oct. 31, 2025) (DHS); Notice of a Modified
System of Records, 90 Fed. Reg. 50879, 50879–81 (Nov. 12,
2025) (SSA). The SORNs could not retroactively authorize
any uses of data that occurred before their effective date. But
now that the agencies have provided the requisite notice and
opportunity to comment, any past procedural violations cannot
justify forward-looking relief against modified SAVE.
The district court concluded that the SORNs failed to
provide the requisite opportunity for comment. Relying on
cases concerning notice-and-comment rulemaking under the
APA, the court reasoned that the SORNs, in making modified
SAVE effective on the last day of the comment period, made
clear that the opportunity to comment was not “meaningful”
and that the administrative “process was anything but open-
minded.” Add. 59–60. But unlike the APA, which requires
“notice,” an “opportunity” to comment, and “consideration” of
the comments, 5 U.S.C. § 553(c) (emphasis added), the Privacy
Act requires only “notice” and “opportunity” to comment, id.
§ 552a(e)(11). Given the ubiquity of APA notice-and-
comment procedures, Congress’s omission of the
“consideration” requirement for SORNs is striking. Moreover,
the opportunity to comment was meaningful despite the
effective date set at 30 days out: The agencies might have
changed their minds based on comments received, either before
or after the original effective date. A rule promulgated
pursuant to APA notice-and-comment procedures binds the
agency once it is final. See, e.g., Humane Soc’y of the U.S. v.
USDA, 41 F.4th 564, 575 (D.C. Cir. 2022). In contrast, nothing
would have prevented DHS or the SSA from ending the new
18
routine uses of data for modified SAVE, even after its effective
date, if the agencies found persuasive any comments submitted
during the 30-day period. So, announcing the effective date
denied no “meaningful” opportunity to comment.
Furthermore, the district court’s analysis would have been
mistaken even under the APA requirement for “consideration”
of comments. In Little Sisters of the Poor Saints Peter and
Paul Home v. Pennsylvania, 591 U.S. 657 (2020), the Supreme
Court held that the APA imposes no “open-mindedness test”
on agencies considering proposed rules, and reviewing courts
may not impose such atextual procedural requirements on the
agencies. Id. at 685; see also Vt. Yankee Nuclear Power Corp.
v. NRDC, 435 U.S. 519, 524–25, 549 (1978). In sum, the
SORNs likely satisfied the Privacy Act’s procedural
requirements of notice and an opportunity to comment.
Whether styled as an injunction or vacatur, forward-
looking relief must rest on ongoing or threatened unlawful
conduct, not past violations. See Little Sisters, 591 U.S. at 686
& n.14; City of Los Angeles v. Lyons, 461 U.S. 95, 102–03
(1983). Here, there was likely no ongoing procedural violation
when the district court entered summary judgment. Once 30
days elapsed from each SORN’s publication, the requisite
notice and opportunity to comment had been provided. With
no ongoing or imminent procedural violation to remedy, the
prospective vacatur of modified SAVE was likely erroneous.
C
The government is likely to succeed in showing that the
adoption of modified SAVE was not arbitrary. As explained
above, that program is manifestly reasonable: It advances
important government interests such as complying with
IIRIRA, enforcing eligibility restrictions for federal benefits,
and ensuring election integrity. The district court’s only basis
19
for claiming arbitrariness was that the government did not
engage with comments. Add. 62–63. That conclusion rested
on the legal premise that the government could not establish
the close of the comment period as the effective date. Id. As
that premise is likely mistaken, the court likely had no basis on
which to rest a holding of arbitrariness.
IV
The government will suffer irreparable harm absent a stay.
Its “inability to enforce its duly enacted plans clearly inflicts
irreparable harm on” it. Abbott v. Perez, 585 U.S. 579, 602
n.17 (2018); see also Make the Rd. N.Y. v. Mullin, 179 F.4th
16, 25 (D.C. Cir. 2026) (“the Government is harmed by an
improper intrusion by a federal court into the workings of a
coordinate branch of the Government” (cleaned up)). Vacatur
of the bulk-process and SSN-lookup functions of modified
SAVE makes it much more difficult for DHS to carry out its
IIRIRA duties effectively, which no one disputes are
legitimate. Cf. Maryland v. King, 567 U.S. 1301, 1303 (2012)
(Roberts, C.J., in chambers). And the dueling judicial orders
put the government in an impossible position: To comply with
the order under review here, the government must violate an
order of the Northern District of Florida.
V
The balance of equities tilts in the government’s favor. In
analyzing that balance, we consider both the parties’ interests
and the public interest. See Allen v. Milligan, 146 S. Ct. 1377,
1381 (2026) (per curiam).
The district court’s order inflicts significant harm on the
government. Without modified SAVE, it is much more
difficult to protect the “integrity of the electoral process,”
which is an “interest[] of the highest importance.” First Nat’l
20
Bank of Bos. v. Bellotti, 435 U.S. 765, 788–89 (1978).
Electoral integrity is also a priority of the administration, see
Exec. Order No. 14248, 90 Fed. Reg. 14005, and of the states
that sued to compel effective performance of DHS’s legal
obligations under IIRIRA, Florida v. DHS, 2026 WL 1968339,
at *1. The order also creates security vulnerabilities for the
government, which uses SAVE to control “access [to] sensitive
government functions—such as employment in government
positions, entry to secure facilities,” and “government-issued
licenses and credentials.” Add. 88. And it frustrates eligibility
determinations for a wide array of federal programs, ranging
from SNAP benefits and Medicaid to Department of Housing
and Urban Development eligibility determinations for federal
housing programs. See 42 U.S.C. § 1320b-7(b)(1)–(4), (d)(3);
id. § 1436a(d)(3), (f). Finally, the order hamstrings the states’
ability to effectively police eligibility for state professional
licenses and for voting in state elections. See States’ Br. at 5–
7. For example, appearing as a defendant-intervenor below,
the State of Texas explained that modified SAVE helps it
“maintain[] accurate voter rolls, prevent[] illegal votes, and
ensur[e] fair and accurate elections.” State of Texas’s
Emergency Motion to Intervene, ECF Doc. 43, at 7. 4
4
The majority notes that the National Voter Registration Act
(NVRA) prohibits states from conducting “any program the purpose
of which is to systematically remove the names of ineligible voters”
from official lists within 90 days of a federal primary or general
election. 52 U.S.C. § 20507(c)(2)(A); see ante, at 28. But the
plaintiffs did not invoke the NVRA to downplay the immediate
harms to the federal government and the states from enjoining
modified SAVE. And it is unclear to me whether the NVRA covers
modified SAVE. For one thing, the “purpose” of modified SAVE,
which is run by a federal agency, is to generate information for a
wide variety of federal and state agencies seeking the information for
a wide variety of purposes. Moreover, even for requesting agencies
21
On the other side of the ledger, granting a stay would
impose relatively little harm on the plaintiffs and their
members. Individuals who were issued SSNs before they
became citizens, but who have not updated the SSA with their
citizenship status, will not lose the right to vote. Instead, they
will simply have to provide proof of citizenship to remain on
the voter rolls of state or local governments. That burden might
qualify as a concrete injury for purposes of Article III standing,
ante, at 8, but it is not an especially substantial one. The
alleged privacy harms are also modest: At worst, an
individual’s SSN will be known by one more federal agency
(DHS), but never will be disclosed to the requesting agency or
the public. Unsurprisingly, the record contains no evidence of
significant harm to the plaintiffs’ members during the period
between the denial of an APA stay in November 2025 and the
grant of summary judgment in June 2026. And even if the
public interest in using SSNs for modified SAVE were
undercut by privacy considerations, the public interest at a
minimum would still favor allowing states to do bulk searches
without SSNs, which the district court has also effectively
enjoined.
focused on voter qualifications, SAVE itself makes no final
eligibility determinations. See 42 U.S.C. § 1320b-7(d)(5). And
states may use information from modified SAVE to make decisions
regarding voter eligibility individually rather than “systematically.”
Regardless, states always may run programs to systematically
remove the names of voters who have died—another piece of
information that modified SAVE can provide. 52 U.S.C.
§ 20507(c)(2)(B)(i), (a)(4)(A); Add. 18. And the NVRA imposes no
restriction on the efforts of state and federal agencies to assess
eligibility in contexts other than voting.
22
VI
For these reasons, I would grant the government’s motion
for a stay pending appeal. As my colleagues deny the motion,
I respectfully dissent.