Emergency Application — Department of Homeland Security, et al., Applicants v. League of Women Voters, et al.

Supreme Court briefSep 8, 2026

Ask Donna

What actually matters in this document.

Text

No. 26A

In the Supreme Court of the United States

───────────

U.S. DEPARTMENT OF HOMELAND SECURITY, ET AL., APPLICANTS

LEAGUE OF WOMEN VOTERS, ET AL.

───────────

APPLICATION TO STAY THE ORDER

OF THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

───────────

D. JOHN SAUER

Solicitor General

Counsel of Record

Department of Justice

Washington, D.C. 20530-0001

SupremeCtBriefs@usdoj.gov

(202) 514-2217

TABLE OF CONTENTS

Statement ....................................................................................................................... 5

Legal and factual background ................................................................. 5

Proceedings below .................................................................................... 7

Parallel proceedings in Florida v. DHS .................................................. 9

Argument ..................................................................................................................... 11

Respondents lack Article III standing ................................................... 11

Section 1373 establishes that DHS has statutory authority to

adopt the modified SAVE system .......................................................... 18

Respondents’ Privacy Act and APA claims lack merit.......................... 23

Respondents’ Social Security Act claim lacks merit ............................. 30

The remaining factors support a stay ................................................... 33

Conclusion .................................................................................................................... 37

(i)

PARTIES TO THE PROCEEDING

Applicants (defendants-appellants below) are the United States Department of

Homeland Security; Markwayne Mullin, in his official capacity as Secretary of Homeland Security; the Social Security Administration; and Frank Bisgnano, in his official

capacity as Commissioner of Social Security. Respondents (plaintiffs-appellees below) are the League of Women Voters, League of Women Voters of Texas, League of

Women Voters of Louisiana, League of Women Voters Louisiana Education Fund,

League of Women Voters of Virginia, and the Electronic Privacy Information Center

(plaintiffs-appellees below). The State of Texas intervened as a defendant in the district court but has not participated in the appeal.

RELATED PROCEEDINGS

United States District Court (D.D.C.):

League of Women Voters v. DHS, No. 25-cv-3501 (June 22, 2026)

United States Court of Appeals (D.C. Cir.):

League of Women Voters v. DHS, No. 26-5243 (Sept. 4, 2026)

In the Supreme Court of the United States

───────────

No. 26A

U.S. DEPARTMENT OF HOMELAND SECURITY, ET AL., APPLICANTS

LEAGUE OF WOMEN VOTERS, ET AL.

───────────

APPLICATION TO STAY THE ORDER

OF THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

───────────

Pursuant to Rule 23 of the Rules of this Court and the All Writs Act, 28 U.S.C.

1651, the Solicitor General—on behalf of applicants U.S. Department of Homeland

Security (DHS), et al.—respectfully requests that this Court stay the order issued by

the U.S. District Court for the District of Columbia (App., infra, 76a-77a) pending

further proceedings in the D.C. Circuit and this Court.

The district court has issued an indefensible order that threatens the integrity

of upcoming elections by vacating the federal government’s authority to internally

use Social Security data when fulfilling its duty to respond to requests by States to

verify the citizenship of individuals for voting and other purposes. The court’s order

exceeds its jurisdiction, as the organizations challenging the government’s policy lack

Article III standing. The court’s order also fails on the merits, as the policy is consistent with all applicable federal statutes. The order will irreparably harm the federal government, the States, and the public by depriving the government of an effective tool to verify the eligibility of registered voters and benefits applicants under

various state and federal programs.

(1)

Congress has directed DHS to “implement a system for the verification of immigration status” that is “available to all the States,” 42 U.S.C. 1320b–7 note, and

also to “respond to an inquiry by a Federal, State, or local government agency, seeking

to verify or ascertain the citizenship or immigration status of any individual within

the jurisdiction of the agency * * * by providing the requested verification or status

information,” 8 U.S.C. 1373(c). DHS fulfills those obligations through Systematic

Alien Verification for Entitlements, or SAVE, an online service that enables users to

verify a person’s citizenship status, often within seconds. Yet, until recently, SAVE

suffered from serious limitations: Among other things, it could verify a person’s citizenship status only if the user supplied that person’s alien registration number (or

other DHS number)—which States often do not know, and which natural-born citizens do not have.

In May 2025, DHS updated SAVE so that a user could enter a person’s Social

Security number, rather than his alien registration number, as a numeric identifier

(and so that requests could be made in bulk, rather than one at a time). Those updates made SAVE significantly more responsive. The updated system processed more

than a million requests each day, for purposes such as verifying eligibility to register

to vote and to receive public benefits. But in the decision below, the district court—

at the behest of several voting-rights and privacy-rights organizations, who are respondents here—universally vacated both the notices articulating the SAVE updates

and the modified SAVE system itself. The court concluded that the modified system

violates statutory restrictions on the sharing of data within and by the federal government. The district court and the D.C. Circuit both denied a stay pending appeal.

This Court should stay the district court’s order, which is unlikely to withstand

appellate review. To start, respondents lack standing to challenge the updated SAVE

system. The district court reasoned that respondents’ members face voter injury (because States might revoke voters’ registrations if SAVE cannot confirm their citizenship), privacy injury (because of the sharing of information about respondents’ members), and reputational injury (because gaps in Social Security records might sometimes leave SAVE unable to confirm the citizenship of individuals who are in fact

citizens). But SAVE does not disqualify any voter; instead, it merely notifies the

States whether the federal government can confirm citizenship. Thus, any voter injury is caused by the States, not by the federal government, and would not be redressed by the relief the court entered against the federal government. SAVE also

does not invade any judicially cognizable privacy interest: The information it discloses to the States—whether the federal government can confirm that a person is a

citizen—is not the type of private information traditionally protected by privacy torts,

and the sharing of Social Security data within the government is not a cognizable

injury at all. Nor does SAVE cause reputational harm; it never asserts that anyone

is not a citizen, only that it sometimes cannot confirm citizenship.

Respondents’ claims also fail on the merits. When a State “seek[s] to verify or

ascertain the citizenship or immigration status of any individual,” Section 1373 commands DHS to “provid[e] the requested verification or status information.” 8 U.S.C.

1373(c). Section 1373 also specifies that, “[n]otwithstanding any other provision” of

federal law, other federal entities may not prohibit or restrict the exchange of information regarding citizenship or immigration status. 8 U.S.C. 1373(a)-(b). By requiring DHS to provide citizenship verification, Section 1373 authorizes DHS to take

steps—such as checking Social Security records—that are reasonably necessary to

perform that duty. And by twice using the word “notwithstanding,” Section 1373

overrides restrictions that the Privacy Act and Social Security Act might otherwise

impose on such sharing.

Even putting aside Section 1373, respondents’ claims fail. The district court

concluded that SAVE’s use of Social Security records violates the Privacy Act, 5

U.S.C. 552a, but that statute expressly limits when prospective (rather than monetary) relief is available, and courts cannot end-run those limits by invoking the Administrative Procedure Act (APA), 5 U.S.C. 551 et seq., 701 et seq. In any event, the

federal government has complied with the Privacy Act’s substantive and procedural

requirements. The court also concluded that SAVE’s use of Social Security records

violates a provision of the Social Security Act, 42 U.S.C. 405(c)(2)(C)(viii)(I), but that

clause applies only to records obtained or maintained “pursuant to any provision of

law enacted on or after October 1, 1990.” The Social Security Administration (SSA)

obtains Social Security numbers pursuant to a law enacted long before that date, and

DHS does not share Social Security numbers at all. The court of appeals concluded

that the government forfeited its arguments under the Social Security Act, but that

is incorrect; in any event, the government’s remaining arguments, which were indisputably preserved, suffice to establish the government’s likelihood of success.

The remaining factors favor a stay. The district court’s order warrants review

because it universally vacates an important governmental policy—the improvement

of a system that has processed millions of citizenship-verification requests every week

and that is used for purposes ranging from maintaining voter rolls to ensuring that

ineligible aliens do not wrongly receive federal benefits. The federal government, the

States, and the public face irreparable harm from the court’s sudden upending of the

updated system and from being required to return to an older, more cumbersome, and

less reliable version of the system. Those harms dwarf any harms faced by respondents, who cannot show even an Article III injury, much less irreparable injury.

STATEMENT

Legal And Factual Background

In 1986, Congress required the federal government to “implement a sys-

tem for the verification of immigration status * * * so that the system is available to

all the States.” 42 U.S.C. 1320b–7 note; see Immigration Reform and Control Act of

1986, Pub. L. No. 99-603, § 121, 100 Stat. 3391. In 1996, in a provision captioned

“OBLIGATION TO RESPOND TO INQUIRIES,” Congress required the Immigration and Naturalization Service—whose functions have since been transferred to DHS—to “respond to an inquiry by a Federal, State, or local government agency, seeking to verify

or ascertain the citizenship or immigration status of any individual within the jurisdiction of the agency for any purpose authorized by law, by providing the requested

verification or status information.” 8 U.S.C. 1373(c); see Illegal Immigration Reform

and Immigrant Responsibility Act of 1996 (IIRIRA), Pub. L. No. 104-208, § 642(c), 110

Stat. 3009–707; 8 U.S.C. 1551 note. To ensure DHS can satisfy this duty, the statute

twice provides that “[n]otwithstanding any other provision of Federal, State, or local

law,” no federal entity or official (among others) may “prohibit, or in any way restrict,”

the sharing with or by DHS of “information regarding” citizenship or immigration status. 8 U.S.C. 1373(a)-(b). Separately, each State has a federal statutory duty to “ensure that voter registration records in the State are accurate and are updated regularly.” 52 U.S.C. 21083(a)(4).

To fulfill the federal government’s statutory obligations, and to help the States

fulfill theirs, DHS operates Systematic Alien Verification for Entitlements, or SAVE.

SAVE is an “online service * * * that provides point in time immigration status and

U.S. citizenship information to federal, state, local, territorial, and tribal agencies.”

USCIS, About SAVE (Oct. 7, 2025), https://perma.cc/5888-TH46. SAVE can verify a

person’s “immigration status or U.S. citizenship * * * within seconds.” Ibid. But

SAVE does not “[d]etermine [a person’s] eligibility for a specific benefit.” Ibid. That

determination is instead made by the agency responsible for issuing the benefit, most

often a state or local agency. Ibid.

Since 2005, States have entered into agreements with DHS to use SAVE to

verify putative voters’ citizenship status. See D. Ct. Doc. 77-2, ¶ 20 (Apr. 2, 2026).

Yet, until recently, SAVE suffered from significant limitations. Most importantly, it

could not verify citizenship status without a DHS-specific immigration identifier,

such as an alien registration number (or “A-number”)—which States do not always

know, and which natural-born citizens do not have. See USCIS, Guide to Understanding SAVE Verification Responses 3 (Apr. 2022) (SAVE Guide), https://perma.cc/BW9MWJUT. SAVE could also accept only one verification request at a time. See USCIS,

Optimizing SAVE (May 22, 2025), https://perma.cc/LM3N-RB76.

In April 2025, DHS began a comprehensive update to SAVE. In May

2025, it announced the two changes relevant here: users may now make requests

using Social Security numbers, and they may enter multiple requests at once. See

Optimizing Save.

Under the updated system, a SAVE user manually enters the following data

into a spreadsheet: first name; last name; date of birth; full or partial Social Security

number, A-number, or other DHS numeric identifier; and the reason for verification.

DHS A.R. 1443. The user uploads the spreadsheet, and SAVE then checks SSA databases to determine whether the supplied information matches Social Security records, whether the individual is a citizen, and whether the individual is deceased. 90

Fed. Reg. 48,948, 48,950 (Oct. 31, 2025).

If that check matches SSA records but does not confirm that the individual is

a living U.S. citizen, and a DHS numeric identifier is available either from the user’s

initial input or from Social Security records, SAVE automatically checks 16 additional systems across the federal government. DHS A.R. 1450-1458. If that check,

too, does not confirm that the individual is a U.S. citizen, the case is referred to an

analyst for manual review. D. Ct. Doc. 77-2, ¶ 15. That manual review includes a

variety of searches in systems available to DHS, including, if necessary, physical records. Id. ¶ 16.

If the search identifies the individual as a citizen, SAVE returns that result to

the user, and no further steps are required. DHS A.R. 1507-1508. But if the search

fails to confirm that the individual is a citizen, the user is prompted to “contact the

[individual] to obtain proof of U.S. citizenship” (or to provide further information to

continue the SAVE search). DHS A.R. 762. SAVE never definitively asserts that a

person is not a U.S. citizen.

Proceedings Below

In September 2025, the League of Women Voters and other advocacy

organizations (respondents here) challenged the modified SAVE system in the United

States District Court for the District of Columbia. App., infra, 12a. The court denied

respondents’ motion for a preliminary injunction, finding that they had failed to show

irreparable harm. See D. Ct. Doc. 55, at 11 (Nov. 17, 2025). The district court later

granted summary judgment to respondents. App., infra, 1a-75a. The court held that

respondents’ members face several types of injuries that give rise to Article III standing. First, it concluded that respondents’ members face “voter injuries” because

States might ask them to prove citizenship, and might cancel their voter registrations, if inaccuracies in Social Security records prevent SAVE from confirming their

citizenship. Id. at 31a; see id. at 31a-38a. Second, the court concluded that respond-

ents’ members face “privacy injuries” from the disclosure of private information contained in their Social Security records. Id. at 24a; see id. at 25a-29a. Third, the court

concluded that respondents’ members suffer “reputational injuries” if SAVE fails to

confirm their citizenship. Id. at 24a; see id. at 29a-31a. Finally, the court concluded

that respondents have suffered “procedural injuries” from the government’s alleged

violation of their procedural rights under the Privacy Act and the APA. App., infra,

23a; see id. at 38a-40a.

Turning to the merits, the district court concluded that the modified SAVE

system is unlawful. The court first concluded that the updated system violates a

restriction in the Social Security Act on the disclosure of Social Security numbers and

related records. App., infra, 43a-44a. The court also concluded that the updated

system violates the Privacy Act and the APA, reasoning that DHS and SSA had not

complied with applicable substantive and procedural limits on the sharing of information. Id. at 44a-65a. Last, the court rejected the contention that 8 U.S.C. 1373

overrides the limits that the Social Security Act and the Privacy Act might otherwise

impose on SAVE. Id. at 65a-72a.

As a remedy, the district court “vacate[d] and se[t] aside” two notices issued

under the Privacy Act—one by DHS, the other by SSA—articulating the modifications to SAVE. App., infra, 76a. The court also “vacate[d] and se[t] aside the SAVE

‘modified system’ described in” DHS’s notice. Ibid. Applicants moved for a stay pending appeal, which the court denied. Id. at 78a-100a.

A divided panel of the D.C. Circuit denied applicants’ motion for a stay

pending appeal, after considering it for nearly two months. App., infra, 102a-154a.

The panel majority concluded that applicants had not shown a likelihood of

success on appeal. App., infra, 110a-130a. The majority first endorsed the district

court’s conclusion that respondents’ members faced voter injuries. Id. at 110a-112a.

On the merits, it concluded that the government had forfeited its arguments that the

modified SAVE system complies with the Social Security Act, id. at 113a-120a; concluded in the alternative that those arguments lack merit, id. at 122a-130a; and rejected the argument that Section 1373 overrides any limits that statute might otherwise impose on SAVE, id. at 120a-122a. The majority did not consider the district

court’s remaining merits holdings. Id. at 132a.

Because the majority found that applicants were unlikely to succeed on the

merits, it had “no occasion to consider the remaining stay factors.” App., infra, 130a.

It nonetheless “briefly note[d]” its view that the equities do not support granting interim relief here. Ibid.; see id. at 130a-132a.

Judge Katsas dissented. App., infra, 133a-154a. Observing that a court may

consider standing and the merits in either order at the stay stage, he concluded that

applicants are likely to prevail on the merits and so did not consider standing. Id. at

139a (citing Mullin v. Doe, 146 S. Ct. 2121, 2137 (2026) (plurality opinion)). Judge

Katsas opined that the modified SAVE system likely complies with the Social Security Act, id. at 139a-142a, and that any forfeiture of that argument should be excused,

id. at 142a-145a. He further opined that the district court’s remaining rationales on

the merits are unlikely to withstand appellate review. Id. at 148a-151a. Finally, he

concluded that the equities favor a stay. Id. at 151a-153a.

Parallel Proceedings In Florida v. DHS

In 2024 and 2025, before the update to SAVE, five States filed suits claiming

that the federal government was violating 8 U.S.C. 1373 because the old SAVE system

could not provide meaningful responses to most of their verification requests. One suit

was filed by Florida and later joined by Iowa, Indiana, and Ohio, see Florida v. DHS,

No. 24-cv-509 (N.D. Fla.) (filed Oct. 16, 2024); the other suit was brought by Texas,

see Attorney General of Texas v. Noem, No. 24-cv-49 (W.D. Tex.) (filed Oct. 22, 2024).

After DHS updated SAVE, the federal government entered into a settlement

agreement that resolved Florida. 24-cv-509 D. Ct. Doc. 30-1 (N.D. Fla. Nov. 28, 2025).

In the settlement, DHS agreed that SAVE would maintain certain minimum capabilities, such as “allow[ing] searches with full Social Security Numbers (SSNs) to be used

as a non-DHS enumerator” and “[t]he capacity to process bulk upload verification

requests so that users of the system will not need to input verification requests oneby-one.” Id. ¶ 10. In light of the settlement, the U.S. District Court for the Northern

District of Florida issued an order dismissing Florida’s suit. 24-cv-509 D. Ct. Doc. 31

(Dec. 1, 2025). The order stated that the Florida court “retains jurisdiction * * * for

the purpose of enforcement of the parties’ settlement agreement, which is approved

by and incorporated by reference into this order.” Id. at 1-2.

Months later, the district court in this case entered its final judgment, and the

federal government immediately came into compliance by disabling the modified

SAVE system, while promptly seeking a stay pending appeal. See D. Ct. Doc. 126, at

3 (July 10, 2026). But the Florida court then issued a conflicting order, over the

government’s objection, requiring DHS to “immediately comply” with the settlement

“by reinstating [the plaintiff States’] access” to certain features of the updated SAVE

system. 24-cv-509 D. Ct. Doc. 45, at 9 (N.D. Fla. July 7, 2026). To comply with both

courts’ orders to the greatest extent possible, the government has restored certain

features of the updated SAVE system for the four States in Florida, while continuing

to disable those features for everyone else. Respondents then intervened in Florida

and appealed to the Eleventh Circuit. See 24-cv-509 D. Ct. Doc. 54 (N.D. Fla. Jul. 19,

2026); 24-cv-509 D. Ct. Doc. 55 (N.D. Fla. Jul. 20, 2026).

ARGUMENT

Under Rule 23 of the Rules of this Court and the All Writs Act, 28 U.S.C. 1651,

to obtain a stay of a vacatur order pending review in the court of appeals and in this

Court, an applicant must show a likelihood of success on the merits, a reasonable

probability of obtaining certiorari, and a likelihood of irreparable harm. See NRCC

v. Brown, No. 26A274, slip op. 4 (Sept. 4, 2026) (per curiam). In “close cases,” the

Court balances the equities and weighs the relative harms. Ibid.

All those factors warrant a stay here. The government is likely to succeed on

appeal because respondents lack Article III standing; because the district court’s order contravenes 8 U.S.C. 1373; and because respondents’ Privacy Act, Social Security

Act, and APA claims lack merit. And the government, the States, and the public will

suffer irreparable harm from the district court’s order, which undermines the government’s ability to fulfill its duty to verify an individual’s citizenship upon request by a

State, and thereby impairs determinations of an individual’s eligibility to vote and to

qualify for various federal benefits.

Respondents Lack Article III Standing

To establish the existence of an Article III case or controversy, a plaintiff must

show that it has standing—i.e., that it suffered a judicially cognizable injury, that the

injury was likely caused by the defendant’s challenged action, and that the injury

would likely be redressed by judicial relief. See TransUnion LLC v. Ramirez, 594

U.S. 413, 423 (2021). The district court credited multiple theories of standing, of

which the court of appeals majority endorsed only the first. None is sound.

Voter injury. The lower courts concluded that respondents have standing be-

cause their members face “voter injuries.” App., infra, 31a; see id. at 112a. The district court found that, after using SAVE, Texas asked four of respondents’ members—

naturalized citizens who had not updated their Social Security records—to confirm

their citizenship. Id. at 25a, 32a-33a. Two provided the requested citizenship information and remain registered; the other two failed to do so, and their voter registrations remain revoked. Id. at 33a. The district court concluded that respondents have

standing because two members’ registrations remain revoked. Id. at 34a-35a. The

district court and court of appeals also found standing because other States could ask

other members for proof of citizenship in the future. Id. at 35a-36a, 110a-112a.

Even setting aside several objections to treating those “voter injuries” as injuries in fact, respondents lack standing because they cannot show that the injuries

were likely “caused by the defendant’s conduct.” FDA v. Alliance for Hippocratic

Medicine, 602 U.S. 367, 382 (2024). That requirement is usually “easy” to satisfy

where, unlike here, the challenged governmental action “require[s] or forbid[s] some

action by the plaintiff.” Ibid. But where, as here, the federal government has neither

required nor forbidden the plaintiff to act, and the claimed injury “hinges on the response of [a] third party to the government action,” standing is “substantially more

difficult to establish.” Id. at 382-383. This Court has often rejected “standing theories

that rest on speculation about the decisions of independent actors.” Clapper v. Amnesty International USA, 568 U.S. 398, 414 (2013); see, e.g., Alliance for Hippocratic

Medicine, 602 U.S. at 383; Lujan v. Defenders of Wildlife, 504 U.S. 555, 561-562

(1992).

SAVE does not require respondents or their members “to do anything or to

refrain from doing anything.” Trump v. New York, 592 U.S. 125, 134 (2020) (per

curiam). SAVE instead provides information to States. DHS’s standard agreement

with States specifies that a SAVE response “is not intended to be, and should not be

construed as, an opinion on the part of DHS-USCIS or the United States regarding

any right or benefit or any program administered by the User Agency.” DHS A.R.

767. The agreement further specifies that States must obtain “additional verification” for any “voter that does not verify as a U.S. citizen on initial verification,” must

provide “notice and hearing or other due process available under State or other applicable law” before “any removal from a voter roll,” and must comply with all other

applicable federal and state laws. DHS A.R. 762, 764. Reflecting those limitations,

SAVE never asserts that an individual is not a citizen, instead prompting users to

seek additional verification.

Any injuries to the four Texas voters were thus caused by Texas, not the federal

government. It was Texas, applying Texas law and acting through Texas officials,

that asked those individuals to provide proof of their citizenship. See App., infra,

32a-33a. And it was Texas, applying procedures set out in Texas law, that revoked

those voters’ registrations. See id. at 33a. Similarly, any future injuries to voters in

other States would be attributable to those States. The fact that respondents have

asserted actual voter injuries only with respect to four individuals in Texas—even

though 27 States have agreed to use the modified SAVE system to check the voter

rolls, and even though there have been 59.7 million voter-verification requests between January 1, 2025, and April 1, 2026, see D. Ct. Doc. 77-2, ¶¶ 21-22—confirms

the point. What produces the claimed injury is a State’s decision to act after receiving

a SAVE response, not the SAVE response itself.

Reinforcing the absence of standing, a SAVE response is neither necessary nor

sufficient for a State to demand proof of citizenship or to revoke a voter’s registration.

It is not necessary, because a State’s ability to demand proof of citizenship from any

of its registered voters, and revoke registrations under state law, does not require

any federal involvement at all. And it is not sufficient, because a SAVE response, on

its own, changes no voter’s status; only the State’s independent decision to question

or cancel a registration does that. SAVE thus provides, at most, only one input into

a determination that the State controls as it administers its own voting laws and

manages its own voter rolls. Respondents cannot establish standing through “speculation” about the States’ “ ‘unfettered choices.’ ” Amnesty International, 568 U.S. at

415 n.5.

Making the causal connection even more dubious, respondents cannot tie their

asserted voter injuries to the specific conduct they challenge, the modifications to the

SAVE system made in May 2025. Under both the old and the improved system, a

State could ask SAVE to verify citizenship. Under both the old and the improved

system, gaps in government records might sometimes leave SAVE unable to verify a

person’s citizenship, even when the person is a citizen—in fact, the old system’s input

restrictions made it much less able to confirm the citizenship of actual citizens. See

p. 6, supra. And under both the old and the improved system, a State can decide for

itself whether to act on that non-response by demanding proof of citizenship. Respondents cannot establish standing given that they would have faced the same injury both before and after the May 2025 update.

Notably, the lower courts never found that the May 2025 update somehow

made SAVE less accurate. The voter-injury theory instead boils down to the notion

that the government has injured respondents by making SAVE more accurate and

easier to use. Before the May 2025 update, the theory seems to go, SAVE was so

outdated, incomplete, and cumbersome that most States made little or no use of it.

But after the update, the theory continues, the system verifies more voters as citizens,

leaving a smaller pool of putative voters for States to scrutinize. Neither respondents

nor the lower courts have cited any authority for the counterintuitive proposition that

a voter-verification system can injure someone by working better.

For similar reasons, respondents cannot establish that the relief entered

against the federal government would likely redress the asserted voter injuries. Respondents complain that Texas sought proof of citizenship from four voters and revoked the registrations of two of those voters, but nothing in the district court’s judgment requires Texas to reinstate those registrations. Respondents likewise complain

that other States could seek proof of citizenship from voters or revoke their registrations, but the States remain free to take those steps even after the court’s judgment.

Because the judgment “would not give [respondents] legally enforceable protection

from the [asserted voter injuries],” “they cannot satisfy Article III.” Haaland v.

Brackeen, 599 U.S. 255, 293-294 (2023).

The D.C. Circuit majority concluded that “the threatened injuries are fairly

traceable and redressable because setting aside modified SAVE removes the federal

response that sets the [States’ citizenship-verification] process in motion.” App., infra, 112a. But the district court’s remedy does not “remov[e] the federal response.”

Ibid. To the contrary, the old SAVE system would provide the same (non-)response—

that the federal government cannot confirm a person’s citizenship—for an even larger

pool of people. See p. 6, supra. The majority also found it “predictable” that States

would react to SAVE by demanding proof of citizenship from voters. App., infra, 112a.

But as to respondents’ members, that prediction appears to have panned out for only

four voters in one State, out of tens of millions of verification requests in 27 States.

See p. 13, supra. That just underscores that any voter injury is caused by the States,

not the federal government.

The district court, meanwhile, sought to paper over those shortcomings by emphasizing that Texas has intervened as a defendant in this case. See App., infra, 36a-

37a. But that does not change the reality that respondents have sued and obtained

relief against the federal government—even though the federal government has not

caused their injuries and even though relief against the federal government would

not redress those injuries. Texas’s participation as an intervenor does not create

standing to sue and obtain a judgment against the United States.

Privacy injury. The district also concluded that respondents face “privacy in-

juries” because SAVE discloses “their members’ private information in SSA records

(including their [Social Security numbers] and citizenship status)” to the States.

App., infra, 24a. But the asserted privacy injury is not concrete; it lacks the requisite

“close historical or common-law analogue.” TransUnion, 594 U.S. at 424.

As for SAVE’s limited disclosure of information to the States, that does not

cause any cognizable privacy injury. SAVE never reveals anyone’s Social Security

number to the States; instead, a State must already have a person’s partial or full

Social Security number if it wishes to include that information as part of a SAVE

request. All SAVE discloses to the State is whether the federal government can confirm that the individual in question is a citizen. See pp. 6-7, supra. The district court

viewed a person’s “citizenship status” as the type of “private information” whose disclosure can give rise to “privacy injuries,” but it cited no authority for that extraordinary claim. App., infra, 24a. Putative voters must attest that they are citizens when

registering to vote; stating whether the federal government can confirm such attestations does not somehow reveal the type of information that the law has traditionally

treated as private. In fact, far from treating citizenship status as private, federal law

affirmatively requires DHS to verify citizenship status in response to requests from

States. See 8 U.S.C. 1373(c).

As for the disclosure of information within the Executive Branch, that too does

not cause any cognizable privacy injury. When a SAVE user makes a request containing a partial Social Security number, and that partial number matches other information in the request, SSA discloses the full Social Security number to DHS. See

90 Fed. Reg. at 48,950. Such intra-governmental information sharing lacks a “close

relationship to harms traditionally recognized as providing a basis for lawsuits in

American courts.” TransUnion, 594 U.S. at 425. The district court noted that the

common law provides redress for torts such as intrusion upon seclusion and breach

of confidence, see App., infra, 25a-29a, but those torts involve disclosures to the public, not the sharing of information within the government. The court sought to cabin

its novel holding to the “unauthorized” sharing of information, App., infra, 26a, but

injury in fact does not depend on legal authorization. See TransUnion, 594 U.S. at

427 (“[A]n injury in law is not an injury in fact.”). The court’s rationale thus implies,

illogically, that an individual suffers an Article III injury whenever the government

internally shares Social Security numbers in a perfectly lawful manner—for instance,

when using the numbers to confirm the identity of an individual seeking entry to a

secure facility.

Reputational injury. The district court next held that respondents’ members

face “reputational injuries” when SAVE identifies them as “potential non-citizens.”

App., infra, 23a, 25a. But SAVE never definitively asserts that a putative voter is

not a citizen. Instead, it informs the user that it cannot verify a person’s citizenship

and prompts the user to seek further proof. See pp. 6-7, supra. The statement that

SAVE cannot confirm a person’s citizenship—which is factually true—does not cause

cognizable reputational harm. The court analogized the alleged harm here to the

harm caused by the tort of defamation, see App., infra, 29a-31a, but true statements

are not defamatory, see Cox Broadcasting Corp. v. Cohn, 420 U.S. 469, 489 (1975).

Respondents also cannot show that the asserted reputational harms were

fairly traceable to, or would be redressed by the relief entered against, the challenged

updates to SAVE. As discussed, the district court did not find that the update reduced

SAVE’s accuracy. See p. 14, supra. Instead, the update increased the number of

individuals whose citizenship the system could verify. Respondents thus cannot identify any individual whose citizenship would have been verified under the old system—

thus avoiding the putative reputational injury—but would not be verified under the

improved system. That, too, defeats standing on this theory.

Procedural injury. Finally, the district court held that respondents face “pro-

cedural injury” because they claim that the government has violated their procedural

rights under the Privacy Act and the APA. App., infra, 38a. “But deprivation of a

procedural right without some concrete interest that is affected by the deprivation—

a procedural right in vacuo—is insufficient to create Article III standing.” Summers

v. Earth Island Institute, 555 U.S. 488, 496 (2009); see Department of Education v.

Brown, 600 U.S. 551, 562 (2023). Procedural injury suffices only when a person “has

been accorded a procedural right to protect his concrete interests.” Defenders of Wildlife, 504 U.S. at 572 n.7. Because respondents lack cognizable concrete interests for

the reasons discussed above, their procedural-injury theory also fails.

Section 1373 Establishes That DHS Has Statutory Authority To

Adopt The Modified SAVE System

On the merits, respondents primarily contended below that DHS lacks the

statutory authority to verify citizenship status through SAVE. See, e.g., C.A. Stay

Opp. 16. The district court declined to rely on that theory, instead principally holding

that the Privacy Act and the Social Security Act prohibit the sharing of Social Security data under the modified SAVE system. See App., infra, 43a-56a. But 8 U.S.C.

1373 forecloses that rationale. Section 1373 authorizes DHS to verify citizenship

through SAVE after obtaining relevant information from other agencies, and it also

expressly displaces any prohibition on such information-sharing that other federal

statutes may impose. As even the D.C. Circuit majority acknowledged, that argument is “properly preserved” for appeal. App., infra, 120a. And the lower courts’

rejection of the argument, see id. at 69a-72a, 120a-122a, was manifestly erroneous.

Statutory authority.

Section 1373 consists of three subsections.

Section

1373(a) provides that, “[n]otwithstanding any other provision” of law, a “government

entity or official may not prohibit, or in any way restrict, any government entity or

official from sending to, or receiving from, [DHS] information regarding the citizenship or immigration status * * * of any individual.” 8 U.S.C. 1373(a). Section

1373(b), captioned “ADDITIONAL AUTHORITY OF GOVERNMENT ENTITIES,” provides that,

“[n]otwithstanding any other provision” of law, “no person or agency may prohibit, or

in any way restrict,” a government entity from sending, requesting, exchanging, or

maintaining “information regarding the immigration status * * * of any individual.”

8 U.S.C. 1373(b). Finally, Section 1373(c), captioned “OBLIGATION TO RESPOND TO INQUIRIES,” provides that DHS “shall respond to an inquiry” by a State “seeking to verify

or ascertain the citizenship or immigration status of any individual within [its] jurisdiction * * * by providing the requested verification or status information.” 8 U.S.C.

1373(c).

Section 1373(c) thus unambiguously requires, and so authorizes, DHS to “verify or ascertain the citizenship or immigration status of any individual.” 8 U.S.C.

1373(c). That provision is framed as a command, and “[c]ommand includes permission.” Antonin Scalia & Bryan A. Garner, Reading Law 193 (2012). “If you must do

something, then you are necessarily allowed to do it.” Ibid.

Sections 1373(a) and (b), too, authorize the update to SAVE. By prohibiting

interference with DHS’s sending and receiving of information regarding citizenship

status, Section 1373(a) necessarily implies that DHS possesses the authority to send

and receive that information. And Section 1373(b)’s caption, “ADDITIONAL AUTHORITY

OF GOVERNMENT ENTITIES,” shows that it grants governmental entities the authority

to engage in the activities it lists—sending, requesting, exchanging, and maintaining

information regarding immigration status.

The district court questioned whether obtaining information from SSA is “absolutely necessary” to verify citizenship, App., infra, 69a, but that absolute-necessity

standard is too strict. Section 1373 authorizes SSA to share with DHS “information

regarding [an individual’s] citizenship status,” 8 U.S.C. 1373(a), and SSA information

qualifies whether or not it is absolutely necessary to verify citizenship. See Patel v.

Garland, 596 U.S. 328, 339 (2022) (the word “regarding” “generally has a broadening

effect, ensuring that the scope of a provision covers not only its subject but also matters relating to that subject”). Moreover, under a principle known as the predicateact canon, the authorization of an act also authorizes a “reasonably” necessary “predicate act.” Scalia & Garner 192-193 (emphasis omitted). In other words, when a legal

text grants a power, it also authorizes the recipient of the power to use any “ordinary

and appropriate means” of exercising it. Free Speech Coalition, Inc. v. Paxton, 606

U.S. 461, 478 (2025). It makes no difference that “some other approach” is “less restrictive” or “equally or more effective.” Id. at 497-498.

The update to SAVE satisfies that test. Section 1373 requires and authorizes

DHS to verify the citizenship status of “any individual.” 8 U.S.C. 1373(c) (emphasis

added); see 8 U.S.C. 1373(a) (“any individual); 8 U.S.C. 1373(b) (“any individual”).

Yet the old SAVE could not verify the citizenship of natural-born citizens, both be-

cause they lack alien registration numbers and because individuals who never had

any encounters with DHS did not appear in DHS records. See SAVE Guide 3. The

updated SAVE overcomes the former problem by allowing users to enter Social Security numbers rather than alien registration numbers as numeric identifiers, and the

latter problem by using SSA records (which do cover natural-born citizens). That is

an ordinary, appropriate, and reasonably necessary means of fulfilling DHS’s obligation to verify the citizenship status of any individual. Indeed, neither of the lower

courts explained how DHS can reasonably comply with its obligation under Section

1373 to verify the citizenship of any individual a State asks about without obtaining

SSA information.

Interaction with other statutes. Section 1373 does not just authorize DHS to

verify citizenship (and to use SSA records to do so). For two reasons, it also precludes

courts from relying on other statutes, such as the Privacy Act and the Social Security

Act, to block citizenship-verification responses based on the sharing of Social Security

information.

First, statutes “should be interpreted in a way that renders them compatible,

not contradictory. There can be no justification for rendering provisions in conflict if

they can be interpreted harmoniously.” Maracich v. Spears, 570 U.S. 48, 68 (2013)

(quoting Scalia & Garner 180) (brackets and ellipsis omitted). As explained in more

detail below, the government’s reading of the Privacy Act and Social Security Act

enables it to comply with those laws while still fulfilling its obligations under Section

1373(c). See pp. 23-33, infra. On the district court’s reading, by contrast, the Privacy

Act and the Social Security Act effectively prevent the government from complying

with Section 1373(c).

Second, even if the Privacy Act or the Social Security Act did prevent the shar-

ing of SSA information that DHS uses to verify citizenship status under Section 1373,

the latter statute would prevail. Section 1373 was enacted in 1996—after the Privacy

Act (1976) and the Social Security Act provision at issue (1990). In general, later

statutes take precedence over earlier ones. See EC Term of Years Trust v. United

States, 550 U.S. 429, 435 (2007). Moreover, Section 1373 applies “notwithstanding

any other provision” of law. 8 U.S.C. 1373(a)-(b). The word “notwithstanding” “shows

which provision prevails in the event of a clash.” NLRB v. SW General, Inc., 580 U.S.

288, 301 (2017) (quoting Scalia & Garner 126-127).

The district court reasoned that reading Section 1373 to override the Privacy

Act and the Social Security Act would violate the presumption against implied repeals. App., infra, 65a-66a. But that presumption does not apply where, as here, a

statute includes a notwithstanding clause. See PLIVA, Inc. v. Mensing, 564 U.S. 604,

621-623 (2011) (opinion of Thomas, J.). Such a clause—also known as a non obstante

clause, after the Latin for “notwithstanding”—“acknowledge[s] that the statute might

contradict prior law and instruct[s] courts not to apply the general presumption

against implied repeals.” Id. at 622. When Congress enacts such a clause, a court

“need look no further than ‘the ordinary meaning’ ” of the new statute; it “should not

distort [the statute] to accommodate” other laws. Id. at 623. For the reasons discussed above, the ordinary meaning of Section 1373 permits the update to SAVE.

The D.C. Circuit majority, for its part, saw “little basis to read § 1373(c)’s general instruction to answer citizenship inquiries as * * * silently displacing an otherwise applicable confidentiality restriction.” App., infra, 121a (emphasis added). But

the majority entirely ignored Section 1373(a) and (b), which specify that Section 1373

applies “notwithstanding any other provision.” 8 U.S.C. 1373(a) and (b). The whole

point of the phrase “notwithstanding any other provision,” ibid., is to expressly “dis-

plac[e]” other laws, App., infra, 121a.

Respondents’ Privacy Act And APA Claims Lack Merit

Even putting aside Section 1373, the district court erred in holding that the

update to SAVE violates the Privacy Act (and, as a result, also violates the APA).

App., infra, 44a-65a. Respondents lack a right of action to seek prospective relief for

violations of the Privacy Act, and their substantive and procedural contentions under

that Act are incorrect regardless. While the court of appeals majority expressly declined to address those issues, see App., infra, 132a, Judge Katsas’s dissent agreed

with the government on the merits arguments (without reaching the right-of-action

argument), see id. at 146a.

Right of action. The Privacy Act contains a comprehensive remedial scheme

for violations of its provisions. See 5 U.S.C. 552a(g). That scheme permits suit only

by an “individual,” 5 U.S.C. 552a(g)(1), a term defined to mean a citizen or lawful

permanent resident, 5 U.S.C. 552a(a)(2). For two types of violations—refusals to

amend records or to provide access to records—the Act authorizes individuals to seek

prospective relief. See 5 U.S.C. 552a(g)(2)-(3). For all other violations, the Act authorizes individuals to seek only damages, and only if the violation was intentional

or willful. See 5 U.S.C. 552a(g)(4). Because respondents are all organizations rather

than individuals, the Act does not authorize them to sue at all. And because the

violations alleged here fall in the catchall category for which the Act provides only

damages, the Act does not authorize prospective relief. Respondents accordingly have

no right of action under the Act to seek vacatur of the modified SAVE system. The

district court did not suggest otherwise.

Nevertheless, the district court held that respondents could invoke the APA to

obtain prospective relief for violations of the Privacy Act. See App., infra, 45a-49a.

But respondents may not invoke the general right of action conferred by the APA to

evade the restrictions imposed by the Privacy Act’s specific remedial scheme.

In statutory interpretation, “the specific governs the general,” and where “a

general authorization and a more limited, specific authorization exist side-by-side,”

“[t]he terms of the specific authorization must be complied with.” RadLAX Gateway

Hotel, LLC v. Amalgamated Bank, 566 U.S. 639, 645 (2012). Otherwise, the “specific

provision [would be] swallowed by the general one, ‘violating the cardinal rule that,

if possible, effect shall be given to every clause and part of a statute.’ ” Ibid. (brackets

omitted). As a result, “a precisely drawn, detailed statute pre-empts more general

remedies.” Hinck v. United States, 550 U.S. 501, 506 (2007). Consistent with that

principle, this Court has repeatedly held that plaintiffs may not use the APA “to

evade limitations on suit contained in other statutes.” Match-E-Be-Nash-She-Wish

Band of Pottawatomi Indians v. Patchak, 567 U.S. 209, 215 (2012). For instance, a

plaintiff may not use the APA to end-run a specific statute’s limits on who may sue,

see Block v. Community Nutrition Institute, 467 U.S. 340, 345-348 (1984); its exhaustion requirement, see ibid.; or its limitations period, see Block v. North Dakota ex rel.

Board of University & School Lands, 461 U.S. 273, 286 n.22 (1983). By the same

logic, respondents may not invoke the APA here to end-run the Privacy Act’s limits

on the available relief.

Confirming that conclusion, the APA does not authorize review where other

“statutes preclude judicial review,” 5 U.S.C. 701(a)(1), or where “any other statute

* * * expressly or impliedly forbids the relief which is sought,” 5 U.S.C. 702. The

Privacy Act “impliedly forbids the relief which is sought” here, ibid., because it explicitly authorizes suit only by individuals and prospective relief only for two specific

categories of violations, see 5 U.S.C. 552a(g)(1)-(3). It thus necessarily denies author-

ization for suits by organizations and prospective relief for other categories.

The same conclusion follows from the provisions stating that the APA permits

review only of final agency action “for which there is no other adequate remedy in a

court,” 5 U.S.C. 704, and that a plaintiff may sue under the APA only if “the special

statutory review proceeding relevant to the subject matter” is “inadequa[te],” 5 U.S.C.

703. The Privacy Act provides an adequate remedy: It expressly authorizes individuals to seek damages for “intentional or willful” violations. 5 U.S.C. 552a(g)(4). Damages are the classic example of an adequate remedy at law that forecloses equitable

relief. See, e.g., Schoenthal v. Irving Trust Co., 287 U.S. 92, 95 (1932). And damages

are the traditional remedy for the privacy torts to which the district court analogized

the Privacy Act violations here. See App., infra, 25a-31a. In all events, the Privacy

Act’s reticulated remedial scheme reflects Congress’s own judgment about what remedies are adequate for Privacy Act violations, and courts cannot second-guess that

legislative choice through the APA.

The district court concluded that the D.C. Circuit had already rejected those

arguments in Doe v. Stephens, 851 F.2d 1457 (D.C. Cir. 1988). See App., infra, 46a.

But Stephens permitted an APA action to enforce a different statute—a law governing

veterans’ records—that borrowed some of the Privacy Act’s substantive standards but

contained no remedial scheme of its own. See 851 F.2d at 1465-1467. In any event,

the D.C. Circuit’s decision does not bind this Court.

The district court also found it significant that Congress has codified both the

APA and the Privacy Act in Title 5 of the U.S. Code. See App., infra, 47a. But when

Congress codified Title 5, it expressly instructed that “[a]n inference of a legislative

construction is not to be drawn by reason of the location in the United States Code of

a provision enacted by this Act.” Act of Sept. 6, 1966, Pub. L. No. 89-554, § 7(e), 80

Stat. 631. Such “interpretation clauses are to be carefully followed.” Scalia & Garner

225; see United States v. Dixon, 347 U.S. 381, 385-386 (1954). Regardless, the codification of both the APA and the Privacy Act in Title 5 does not affect the crucial

point: Respondents may not invoke a general provision (whether labeled the APA or

5 U.S.C. 702) to circumvent and nullify the limits of a specific provision (whether

labeled the Privacy Act or 5 U.S.C. 552a).

Substantive requirements. Even if respondents had a right of action, their

Privacy Act claim would still fail. The district court held that SSA’s disclosure of SSA

records under the updated SAVE system violates a provision of the Privacy Act that

prohibits an agency from disclosing a record without the consent of the individual

concerned. 5 U.S.C. 552a(b). But that provision is subject to exceptions, and the

disclosures here fit within the exception for “routine use.” 5 U.S.C. 552a(b)(3).

The Privacy Act defines “routine use” as the “use of [a] record for a purpose

which is compatible with the purpose for which it was collected.” 5 U.S.C. 552a(a)(7).

A core “purpose” of Social Security numbers, ibid., is to identify a particular individual. “Social Security numbers are unique numerical identifiers and are used pervasively in [federal] programs” for “keep[ing] track” of people and “matching” data with

the right people. Bowen v. Roy, 476 U.S. 693, 710-711 (1986). The use of Social Security numbers in the updated SAVE system is “compatible” with that purpose, 5

U.S.C. 552a(a)(7), because SAVE uses those numbers to ensure that the citizenship

information returned by SSA is matched with the correct individual. See 90 Fed. Reg.

at 48,950.

The district court rejected that argument because it believed that the “purpose”

of Social Security numbers is limited to verifying “work authorization and eligibility

for SSA benefits.” App., infra, 51a. But that cramped understanding of the purpose

of Social Security numbers is flawed. Social Security numbers are used in many contexts besides employment and Social Security benefits: tax returns, bank accounts,

Selective Service System registration forms, passport applications, and driver’s license applications, to name just a few. Social Security numbers are thus all-purpose

numeric identifiers—which is why most Americans remember their Social Security

numbers, but not, say, their driver’s license numbers. SAVE’s use of Social Security

numbers is entirely compatible with that broad purpose. The district court wrongly

“fram[ed] the collection purpose at too low a level of generality, which is at odds with

both the statute’s forgiving text (‘compatible’) and * * * the SSN’s long-established

role as a ‘nearly universal identifier.’ ” Id. at 148a (Katsas, J., dissenting).

Procedural requirements. The district court separately concluded that the

government failed to comply with the Privacy Act’s notice-and-comment procedures,

see App., infra, 56a-61a, and that those procedural defects rendered the update to

SAVE arbitrary and capricious under the APA, see id. at 61a-65a. These procedural

objections are baseless.

The Privacy Act provides that, to invoke the routine-use exception, an agency

must first “publish in the Federal Register notice of any new use or intended use of

the information in the system, and provide an opportunity for interested persons to

submit written data, views, or arguments to the agency.” 5 U.S.C. 552a(e)(11). There

is no dispute that DHS and SSA published notices about the updated SAVE system

in the Federal Register. See 90 Fed. Reg. 48,948 (Oct. 31, 2025); 90 Fed. Reg. 50,879

(Nov. 12, 2025). There is also no dispute that the agencies solicited public comment

for the 30-day period required by statute. See 5 U.S.C. 552a(e)(11). Both agencies

then certified that they received and considered the comments submitted. See D. Ct.

Doc. 64-1 (Mar. 2, 2026); D. Ct. Doc. 65-1 (Mar. 11, 2026). The Privacy Act requires

no more.

The district court observed that the agencies updated SAVE in May 2025 but

published the notices in October and November 2025. See App., infra, 57a. In doing

so, the court overlooked that respondents have sought only prospective relief to redress alleged future harm, not damages to redress past harm. See City of Los Angeles

v. Lyons, 461 U.S. 95, 111-113 (1983) (distinguishing future from past harm). The

court’s observation about the timing of the notices shows at most that the past operation of the updated SAVE system may have violated the Privacy Act’s procedural

requirements. But as to the current and future operation of the system—the only

conduct respondents seek to prohibit through this suit and the only purported harm

redressed by the district court’s vacatur order—the statutory notice-and-comment requirements have been satisfied. In other words, “now that the agencies have provided

the requisite notice and opportunity to comment, any past procedural violations cannot justify forward-looking relief against modified SAVE.” App., infra, 149a (Katsas,

J., dissenting).

The district court also concluded that the agencies were insufficiently “openminded” when reviewing comments. App., infra, 58a. But this Court has rejected

the open-mindedness test in the context of APA notice-and-comment procedures, see

Little Sisters of the Poor Saints Peter & Paul Home v. Pennsylvania, 591 U.S. 657,

685 (2020), and its reasons for doing so apply equally to the Privacy Act, see App.,

infra, 149a-150a (Katsas, J., dissenting). Like the APA, the Privacy Act requires an

agency to satisfy certain “objective criteria”—namely, providing notice and providing

an opportunity to comment. Little Sisters, 591 U.S. at 685. It does not require an

agency to satisfy subjective criteria, such as maintaining a particular level of “openmindedness.” Ibid. In nonetheless applying such a criterion, the district court vio-

lated “the general rule against inquiring into ‘the mental processes of administrative

decisionmakers,’ ” Department of Commerce v. New York, 588 U.S. 752, 781 (2019),

and disregarded the “presumption of regularity” owed to the agencies’ certifications

that they considered the comments, United States v. Chemical Foundation, Inc., 272

U.S. 1, 14 (1926).

The district court next faulted the agencies for not issuing written responses

to the comments, see App., infra, 63a, but that rationale ignores the differences between the APA’s and the Privacy Act’s notice-and-comment procedures. The APA

requires an agency to provide “notice,” to provide an opportunity to submit “written

data, views, or arguments,” and then to issue “a concise general statement of [the

rule’s] basis and purpose” reflecting “consideration of the relevant matter presented.”

5 U.S.C. 553(c). The Privacy Act, by contrast, requires only “notice” and opportunity

to submit “written data, views, or arguments”; it says nothing about issuing a statement reflecting consideration of the comments. 5 U.S.C. 552a(e)(11). This Court

“do[es] not lightly assume that Congress has omitted from its adopted text requirements that it nonetheless intends to apply, and [its] reluctance is even greater when

Congress has shown elsewhere * * * that it knows how to make such a requirement

manifest.” Jama v. ICE, 543 U.S. 335, 341 (2005); see App., infra, 149a (Katsas, J.,

dissenting). Moreover, it is a “basic tenet of administrative law” that agencies may

“fashion their own rules of procedure” and that courts are “not free to impose” “procedural requirements” beyond those legislated by Congress. Vermont Yankee Nuclear

Power Corp. v. NRDC, Inc., 435 U.S. 519, 524, 544 (1978). Confirming that reading,

agencies ordinarily do not provide responses to comments under the Privacy Act.

Finally, the district court erred in holding that the agencies’ lack of a response

to the comments rendered their actions arbitrary and capricious. See App., infra,

61a-65a. The obligation to respond to comments in APA rulemakings arises not from

the APA’s arbitrary-and-capricious standard but from its notice-and-comment

clauses—which, as just explained, do not apply here. To be sure, an agency acts arbitrarily if it “entirely fail[s] to consider an important aspect of the problem” (whether

or not raised in comments). Motor Vehicle Manufacturers Ass’n v. State Farm Mutual

Automobile Insurance Co., 463 U.S. 29, 43 (1983). The court suggested that the agencies had committed such an error because they did not consider “the reliance interests

of persons who had provided information to SSA,” App., infra, 62a, but no such reliance interests exist. Social Security numbers are issued by SSA to individuals—not

provided to the agency by individuals who have reliance interests in how the numbers

are used. There is no plausible argument that any of respondents’ members would

not have sought issuance of Social Security numbers if they had known that SSA

would share information with DHS under the modified SAVE system. Indeed, lacking any Social Security number would make it far more likely that the voter and reputational injuries they allege would occur, given that the lack of a Social Security

number would strongly suggest that they were not citizens.

Respondents’ Social Security Act Claim Lacks Merit

The Social Security Act provides that “[s]ocial security account numbers and

related records that are obtained or maintained * * * pursuant to any provision of law

enacted on or after October 1, 1990, shall be confidential.” 42 U.S.C. 405(c)(2)(C)(viii)(I).

Without any meaningful analysis, the district court concluded that the “modified

SAVE system violates this prohibition,” App., infra, 43a, because the provision forbids both SSA’s disclosure of information “to DHS” and DHS’s later disclosure of information “to SAVE users,” id. at 44a. That is wrong.

SSA’s disclosure of information to DHS does not violate Section 405(c)(2). The

cited clause, by its plain terms, protects only numbers and related records that were

“obtained or maintained * * * pursuant to any provision of law enacted on or after

October 1, 1990.” 42 U.S.C. 405(c)(2)(C)(viii)(I) (emphasis added). But SSA has issued Social Security numbers since 1936 and has required proof of citizenship or immigration status to obtain such numbers since October 1972. See Carolyn Puckett,

SSA, The Story of the Social Security Number (July 2009), https://perma.cc/8Z3ZDDB3. The agency thus “obtains and maintains its relevant records pursuant to laws

enacted well before 1990.” App., infra, 140a (Katsas, J., dissenting).

DHS’s disclosure of information to SAVE users likewise does not violate Section 405(c)(2), for two independent reasons. For one, as the D.C. Circuit majority

noted, DHS provides citizenship information through SAVE pursuant to Section

1373. See App., infra, 125a. As discussed, that statute applies “[n]otwithstanding

any other provision” of law. 8 U.S.C. 1373(a)-(b), see p. 22, supra. Even the majority

recognized that the government had preserved that argument, see App., infra, 120a,

and it provides a complete defense to respondents’ Social Security Act claim.

For another, responses to SAVE users do not violate the requirement that

“[s]ocial security account numbers and related records” be kept “confidential.” 42

U.S.C. 405(c)(2)(C)(viii)(I). DHS, again, does not share Social Security numbers with

SAVE users. See App., infra, 141a (Katsas, J., dissenting). Nor does it share “related

records,” a term defined to mean records that “indicat[e], directly or indirectly, the

identity of any individual” whose Social Security records are maintained. 42 U.S.C.

405(c)(2)(C)(viii)(IV); see App., infra, 141a (Katsas, J., dissenting). The only information that DHS discloses to the SAVE user is whether the person identified by the

user is a citizen (and whether he is deceased)—not information that reveals anyone’s

identity. Identifying information flows the other way; it is supplied by the SAVE user

to DHS when making a SAVE request. Thus, DHS does preserve the confidentiality

of the Social Security records that it obtains from SSA.

The lower courts asserted that the government had forfeited its argument

about the meaning of the Social Security Act—though not its argument about Section

1373—in its summary-judgment briefing. See App., infra, 81a-85a, 114a. But that

briefing just reflects how respondents have litigated this case. The D.C. Circuit majority’s assertion that respondents “squarely invoked § 405(c)(2)(C)(viii)(I),” App., infra, 115a (citing D. Ct. Doc. 66-1, at 32-33 (Mar. 12, 2026)), is an overstatement. Respondents’ summary-judgment brief primarily argued over the course of ten pages

that the statutes establishing SAVE did not authorize its use for voter verification at

all, see D. Ct. Doc. 66-1, at 26-35, and relegated the Social Security Act provision on

which the district court ultimately relied to a single paragraph in the pages cited by

the D.C. Circuit majority, see id. at 32-33. For that reason, the government appropriately focused its response on the argument that the use of SAVE for voter verification is statutorily authorized, while just as briefly invoking Section 1373 to refute

respondents’ cursory invocation of Section 405(c)(2). See D. Ct. Doc. 77-1, at 45-52

(Apr. 2, 2026). Applicants cannot be faulted for failing to preemptively address an

argument that was not meaningfully raised in respondents’ briefing and that took on

prominence only in the district court’s opinion.

Regardless, “[o]nce a federal claim is properly presented, a party can make any

argument in support of that claim; parties are not limited to the precise arguments

they made below.” Yee v. City of Escondido, 503 U.S. 519, 534 (1992). Relatedly,

“[w]hen an issue or claim is properly before the court, the court * * * retains the

independent power to identify and apply the proper construction of governing law.”

Kamen v. Kemper Financial Services, Inc., 500 U.S. 90, 99 (1991). The question

whether the updated SAVE system complies with the Social Security Act is properly

before this Court. The government may therefore raise, and this Court may consider,

any arguments that it does. Addressing those arguments “would n[ot] prejudice the

plaintiffs”; the government, at a minimum, “made its likely winning argument in stay

motions before the district court and [the court of appeals],” and respondents “thoroughly responded on the merits.” App., infra, 145a (Katsas, J., dissenting).

In all events, contrary to the D.C. Circuit majority’s suggestion, the government’s arguments under the Social Security Act are not its “central ground for a stay.”

App., infra, 114a. The government’s stay motion in the court of appeals, like its application here, primarily argued that respondents lack standing, see Gov’t C.A. Stay

Mot. 10-15, and that Section 1373 overrides the statutory provisions on which respondents rely, see id. at 17-18, 23. Those concededly preserved contentions independently justify a stay.

The Remaining Factors Support A Stay

In deciding a stay application, this Court also considers the applicant’s likelihood of obtaining certiorari; its likelihood of suffering irreparable harm; and, in close

cases, the balance of the equities. See p. 11, supra. Those factors support a stay here.

Certworthiness. If the D.C. Circuit affirms the district court’s judgment, its

decision would warrant this Court’s review. Instead of granting individualized relief

to particular litigants, the district court “vacate[d] and se[t] aside the SAVE ‘modified

system’ ” universally. App., infra, 76a. The order’s universal scope weighs in favor of

this Court’s review. See Labrador v. Poe, 144 S. Ct. 921, 931 & n.3 (2024) (Kavanaugh, J., concurring). The order’s universal scope also limits percolation in other

courts and hampers the development of a circuit conflict. See Trump v. Hawaii, 585

U.S. 667, 713 (2018) (Thomas, J., concurring). This Court often grants review when

lower courts universally vacate important agency actions, even absent a circuit conflict. See, e.g., Bondi v. VanDerStok, 604 U.S. 458, 467 (2025); Department of Education v. Career Colleges & Schools of Texas, 145 S. Ct. 1039 (2025); United States v.

Texas, 599 U.S. 670, 675 (2023).

SAVE’s importance underscores the need for this Court’s review. Around 1350

federal, state, local, and tribal agencies nationwide use SAVE for a range of purposes,

such as checking eligibility to vote, to receive public benefits, and to obtain licenses.

See D. Ct. Doc. 116-2, ¶ 4 (July 1, 2026); D. Ct. Doc. 77-2, ¶ 7. In Fiscal Year 2025,

SAVE completed 198.9 million verifications. See D. Ct. Doc. 77-2, ¶ 19. And before

the district court’s vacatur order, the updated SAVE system processed more than one

million verification requests every day. See D. Ct. Doc. 116-2, ¶ 5.

Irreparable harm. The district court’s order causes irreparable harm to the

government and the public (including the States), whose interests merge here. See

Nken v. Holder, 556 U.S. 418, 435 (2009). The government has a statutory obligation

to verify citizenship upon request by a State. See 8 U.S.C. 1373(c). The district

court’s order precludes the government from using the system best suited to that task

and instead forces the government to use an older, slower, more cumbersome, and

less capable process. As noted above, that older system could not verify citizenship

status without a DHS-specific immigration identifier (which States often do not

know, and which natural-born citizens do not have) and required users to enter requests one by one rather than in bulk. See p. 6, supra.

By making SAVE more difficult to use, the district court’s order impairs the

proper administration of federal elections. Many States rely on SAVE to help fulfill

their federal statutory obligation to “ensure that voter registration records in the

State are accurate and are updated regularly.” 52 U.S.C. 21083(a)(4). Since May

2025, the updated SAVE system has verified more than 65 million voters across 26

States as U.S. citizens, while flagging 28,635 potential non-U.S. citizens on state

voter lists. See D. Ct. Doc. 116-2, ¶ 12. The district court’s order, however, makes it

harder to detect ineligible voters, undermining the integrity of federal elections and

public confidence in the results of those elections. Because reversal of the district

court’s judgment “would come too late for the 2026 midterms,” those harms are irreparable. Trump v. California, No. 26A124, slip op. 9 (Aug. 24, 2026) (per curiam).

The court of appeals majority discounted those election-related harms on the

ground that “federal law constrains systematic voter-list maintenance * * * within

the 90-day period preceding a federal primary or general election.” App., infra, 131a

(citing 52 U.S.C. 20507(c)(2)(A)). But that assumes that the cited provision restricts

States’ authority to remove aliens from the voter rolls. While two circuits have read

the provision that way, another circuit has read it the opposite way, and it is for now

an open question in the remaining circuits—one that this Court is poised to decide in

the coming Term. See Gov’t Cert. Br. at 14-16, RNC v. Mi Familia Vota, No. 25-1017.

Accordingly, a stay would not come too late for most of the States in the country to

use the modified SAVE system insofar as they agree with the government’s position

that the 90-day provision does not apply to noncitizens who were never properly registered in the first place. See Gov’t Br. at 31-44, Mi Familia Vota, supra (No. 251017); see also Beals v. Virginia Coalition for Immigrant Rights, No. 24A407, 2024

WL 4608863, at *1 (Oct. 30, 2024) (staying injunction restricting removal of noncitizens from the voter rolls within the 90-day period). In addition, even if it is now too

late for States to conduct “systematic” voter-list maintenance, App., infra, 131a, the

district court’s order inflicts irreparable harm by preventing the use of the modified

SAVE system for individualized decisions that all agree are not covered by the 90-

day provision, see id. at 152a n.4 (Katsas, J., dissenting).

Adding to the irreparable harm caused by the district court’s order, SAVE is

used for a variety of purposes beyond verifying voter eligibility. The President has

ordered executive agencies to take appropriate action to ensure that federal public

benefits are not provided to ineligible aliens. See Exec. Order 14,159, § 20, 90 Fed.

Reg. 8443, 8447 (Jan. 29, 2025); Exec. Order 14,218, § 2, 90 Fed. Reg. 10,581, 10,581

(Feb. 25, 2025). Consistent with those orders, “multiple federal agencies have submitted over 298 million verification requests through SAVE, mostly using a combination of the SSNs and the bulk upload tool.” D. Ct. Doc. 116-2, ¶ 6. Further, the

Department of Transportation requires States to use the updated SAVE system to

verify eligibility for commercial driver’s licenses, see 91 Fed. Reg. 7044 (Feb. 13,

2026), and the Department of Housing and Urban Development had planned to require States to use the updated system to verify applicants’ eligibility for certain

housing programs, see 91 Fed. Reg. 8151 (Feb. 20, 2026). Many States also use SAVE

to verify eligibility for state-provided benefits. See D. Ct. Doc. 116-2, ¶ 7.

The irreparable harm caused by the district court’s order does not end there.

By preventing DHS from updating its own records with more current citizenship and

immigration information held by SSA, the order creates gaps in the government’s

ability to verify identity and status. See D. Ct. Doc. 116-2, ¶ 8. Malicious actors could

exploit those gaps to obtain benefits fraudulently or to gain government employment,

entry into secure facilities, or government-issued licenses or credentials. See id. ¶ 11.

In addition, the court’s order has forced DHS, at substantial cost, to maintain both

the old SAVE system and the upgraded SAVE system in parallel. See id. ¶ 10. And

the order interferes with the government’s ability to comply with another federal

court’s order enforcing an earlier settlement that resolved several States’ challenges

to the old SAVE system. See App., infra, 151a (Katsas, J., dissenting).

Balance of the equities. Respondents would not suffer any irreparable harm

from a stay. See App., infra, 153a (Katsas, J., dissenting). The updated SAVE system

does not cause respondents even an Article III injury, see pp. 11-18, supra, much less

irreparable harm. Moreover, the district court denied respondents’ motion for a preliminary injunction, finding that they had failed to establish irreparable harm at that

time. See D. Ct. Doc. 55, at 11 (Nov. 17, 2025). A stay would therefore preserve the

status quo that had existed for over a year (from the May 2025 update until the court’s

June 2026 order), not inflict some new injury on respondents. In all events, this is

not the type of “close cas[e]” where the balance of equities matters in considering a

stay application, see Brown, No. 26A274, slip op. 4 (citing Hollingsworth v. Perry, 558

U.S. 183, 190 (2010) (per curiam)), because, as demonstrated above, the government

has shown a high likelihood of success on the merits and serious irreparable harm,

which are the “most critical” factors, California, No. 26A124, slip op. 3 (quoting Nken,

556 U.S. at 434).

CONCLUSION

This Court should stay the order of the district court pending further proceedings in the D.C. Circuit and this Court.

Respectfully submitted.

D. JOHN SAUER

Solicitor General

SEPTEMBER 2026

APPENDIX

District court opinion granting summary judgment

(D.D.C. June 22, 2026) .................................................................................... 1a

District court order granting summary judgment

(D.D.C. June 22, 2026) .................................................................................. 76a

District court opinion denying stay (D.D.C. July 8, 2026) ................................. 78a

District court order denying stay (D.D.C. July 8, 2026) ................................... 101a

Court of appeals opinion denying stay

(D.C. Cir. Sept. 4, 2026) .............................................................................. 102a

UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

LEAGUE OF WOMEN VOTERS, et al.,

Plaintiffs,

Civil Action No. 25 - 3501 (SLS)

Judge Sparkle L. Sooknanan

U.S. DEPARTMENT OF HOMELAND

SECURITY, et al.,

Defendants.

MEMORANDUM OPINION

This case implicates two fundamental rights that protect Americans from government

overreach: the right to privacy and the right to vote. In the past year, several federal agencies have

joined forces to create a centralized federal database that contains the private information of United

States citizens, including Social Security numbers, citizenship status, and other sensitive data. But

decades ago, Congress put protections in place to prevent precisely this type of centralized data

bank. And the record in this case shows that the federal agencies that created this database knew

that the database violates those statutory protections. The agencies were scrambling to comply

with an Executive Order aimed at reshaping federal elections, which directed them to create a

system for mass voter verification. So they haphazardly combined and repurposed the private

information of millions of Americans, including citizenship data that they knew to be unreliable.

Since then, states have partnered with the federal government to access the database and are

actively removing United States citizens from voter rolls based on inaccurate information. All in

all, the federal government has knowingly trampled on the privacy rights of American citizens in

a manner that threatens the sacred right to vote. This Court cannot stand idly by while that happens.

(1a)

Last March, President Donald J. Trump signed a sweeping Executive Order directing

actions related to the administration of elections. Exec. Order No. 14248 of March 25, 2025,

Preserving and Protecting the Integrity of American Elections, 90 Fed. Reg. 14,005 (Mar. 28,

2025) (DHS AR 334–39). Several lawsuits followed, and courts across the country have since

enjoined various aspects of that Executive Order. As relevant here, the Executive Order instructed

certain federal agencies, including the Department of Homeland Security (DHS) and the Social

Security Administration (SSA), to put systems in place for state and local authorities to verify the

citizenship or immigration status of registered voters or individuals registering to vote. The

Executive Order triggered an overhaul of a system maintained by DHS to verify citizenship and

immigration status—the Systematic Alien Verification for Entitlements (SAVE) system. The 2025

SAVE overhaul modified the system in three major ways: (1) to include the records of naturalborn citizens, (2) to access SSA records, including Social Security numbers, and (3) to permit bulk

searches of records by SAVE users.

The League of Women Voters, its local affiliates, and the Electronic Privacy Information

Center sued DHS, SSA, and other federal governmental actors (collectively, the Federal

Defendants) to challenge the overhaul of SAVE, including the establishment of the modified

system and two related notices published by DHS and SSA. They allege that the modifications

transformed the system’s functionality, increased the scope of covered individuals, made SAVE

less accurate, violated statutory procedures, and were contrary to law. The Plaintiffs originally

moved for an Administrative Procedure Act (APA) stay, which this Court denied for failure to

show irreparable harm. Since then, states have run their voter rolls through the modified SAVE

system, and some of the Plaintiffs’ members have been wrongfully identified as non-citizens by

SAVE, resulting in the cancellation of their voter registrations. Meanwhile, the Court permitted

the State of Texas to intervene as a Defendant in this action.

The Plaintiffs now move for summary judgment. The Court agrees that the establishment

of the SAVE modified system and the notices that followed are unlawful in several respects. First,

they violate a prohibition in the Social Security Act against the disclosure of Social Security

numbers and other related SSA records. Second, they violate both substantive and procedural

protections in the Privacy Act, which prevent the non-consensual disclosure of certain information

(both by federal agencies and between federal agencies) and require notice and comment for

certain actions relevant here. Third, they violate the APA. The Court therefore sets aside and

vacates the 2025 SAVE modified system and the related notices because they were contrary to

law, arbitrary and capricious, in excess of statutory authority, and without observance of procedure

required by law.

BACKGROUND

Social Security Act

The Social Security Act of 1935 creates financial assistance benefit programs for certain

Americans. Pub. L. No. 74–271, 49 Stat. 620 (codified at 42 U.S.C. § 301 et seq.). Soon after its

enactment, the Social Security Board established the Social Security number (SSN) as an identifier

for “U.S. workers, enabling employers to submit accurate reports of covered earnings for use in

administering benefits under the new Social Security program.” Carolyn Puckett, The Story of the

Social Security Number, Soc. Sec. Bull., Vol. 69, No. 2 (July 2009), https://www.ssa.gov

/policy/docs/ssb/v69n2/v69n2p55.html [https://perma.cc/ H96G-835X]. This “is still the primary

purpose for the SSN.” Id.

Privacy was central to the newly formed regulatory scheme. In 1937, the Social Security

Board enacted its very first regulation, which “governed privacy and disclosure of Social Security

records.”

Social

Security

History:

Regulation

No. 1,

SSA,

https://www.ssa.gov

/history/reg1.html [https://perma.cc/NGU4-FPM6]. That regulation prohibited any “member,

officer, or employee of the Board” from producing or disclosing “any record . . . or any information

acquired therefrom . . . pertaining to any person.” Disclosure of Official Records & Information,

2 Fed. Reg. 1,256, 1,256 (June 18, 1937). In 1939, Congress codified the language of that

regulation into the Social Security Act, prohibiting the disclosure of “any file, record, report, or

other paper, or any information” obtained by the Board except as the agency’s regulations

prescribe. Social Security Act Amendments of 1939, Pub. L. No. 76–379, title VIII, § 1106, 53

Stat. 1360, 1398 (codified as amended at 42 U.S.C. § 1306(a)). Today, the Social Security Act

expressly prohibits federal employees from disclosing the “[s]ocial security account numbers and

related records . . . obtained or maintained . . . pursuant to any provision of law enacted on or after

October 1, 1990.” 42 U.S.C. § 405(c)(2)(C)(viii)(I).

Privacy Act

The Privacy Act of 1974 establishes “certain safeguards for an individual against an

invasion of personal privacy by requiring Federal agencies” to “collect, maintain, use, or

disseminate any record of identifiable personal information in a manner that assures that such

action is for a necessary and lawful purpose.” Pub. L. No. 93–579, § 2(b)(4), 88 Stat. 1896, 1896

(codified at 5 U.S.C. § 552a note). The Act “was passed largely out of concern over ‘the impact of

computer data banks on individual privacy.’” U.S. DOJ v. Reps. Comm. for Freedom of the Press,

489 U.S. 749, 766 (1989) (quoting H.R. Rep. No. 93–1416, at 7 (1974)).

Statutory Background

The Privacy Act’s animating concern is that “the increasing use of computers and

sophisticated information technology, while essential to the efficient operations of the

Government, has greatly magnified the harm to individual privacy that can occur from any

collection, maintenance, use, or dissemination of personal information.” Privacy Act of 1974

§ 2(a)(2), 88 Stat. at 1896 (codified at 5 U.S.C. § 552a note). Indeed, the Act was precipitated by

proposals in the 1960s for a computerized “data center” maintained by the Executive Branch that

would bring “the data collected by various agencies into a single consistent body” and “identify

individual respondents in some way, [likely] by social security number.” Computer Privacy:

Hearings Before the Subcomm. on Admin. Prac. and Proc. of the S. Comm. on the Judiciary, 90th

Cong. 4–5 (1967) (statement of Carl Kaysen, Dir., Inst. for Advanced Study, Princeton Univ.).

Rather than garner support, these proposals “immediately caused a public outcry,” necessitating a

congressional response. Dongsheng Zang, The Privacy Act of 1974: The American Bill of Rights

on Data and Its Unfinished Business, 86 U. Pitt. L. Rev. 85, 100 (2024) (detailing the legislative

background of the Privacy Act of 1974).

Congress reacted by holding high-profile hearings on “The Computer and Invasion of

Privacy” and “Federal Data Banks,” where extensive criticism ensured that “the National Data

Center [idea was] probably dead.” Id. at 114–121 (citations omitted); see also Sampson v. Murray,

415 U.S. 61, 96 n.2 (1974) (Douglas, J., dissenting) (recognizing that the hearings reflected a

“congressional concern” that “we live in an Orwellian age in which the computer has become ‘the

heart of a [national] surveillance system’” (quoting Arthur R. Miller, Computers, Data Banks and

Individual Privacy: An Overview, 4 Colo. Human Rights L. Rev. 1, 2 (1972))). At the time, it

became evident that there was a grave “threat to privacy implicit in the accumulation of vast

amounts of personal information in computerized data banks or other massive government files,”

and that “[t]he right to collect and use such data for public purposes is typically accompanied by a

concomitant statutory or regulatory duty to avoid unwarranted disclosures.” Whalen v. Roe, 429

U.S. 589, 605 (1977).

Congress enacted the Privacy Act to address this “growing awareness that governmental

agencies were accumulating an ever-expanding stockpile of information about private individuals

that was readily susceptible to . . . inaccuracies that the citizen would never know of, let alone have

an opportunity to rebut or correct.” Londrigan v. FBI, 670 F.2d 1164, 1169 (D.C. Cir. 1981). It

responded with a detailed statutory scheme to prevent “the creation of secret information systems

or data banks” by the federal government that would result in “the wrongful disclosure and use, in

some cases, of [such] personal files held by Federal agencies.” Id. (quoting S. Rep. No. 1183, at 1,

2 (1974)). Thus, the Privacy Act “was designed to provide individuals with more control over the

gathering, dissemination, and accuracy of agency information about themselves,” Greentree v.

U.S. Customs Serv., 674 F.2d 74, 76 (D.C. Cir. 1982) (emphasis omitted), and to “establish

safeguards to protect individuals against the disclosure of confidential records ‘which could result

in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom

information is maintained,’” FAA v. Cooper, 566 U.S. 284, 294–95 (2012) (quoting 5 U.S.C.

§ 552a(e)(10)).

The statute’s provisions work together “to prevent the creation of formal or de facto

national data banks,” “centralized Federal information systems[,]” or “interagency computer data

banks”—by making it “legally impossible for the Federal Government in the future to put together

anything resembling a ‘1984’ personal dossier on a citizen, and [ensuring] proper regard for

individual privacy, the confidentiality of data, and the security of [any] system” of records

maintained by the federal government. See United States v. Weber, 816 F. Supp. 3d 1168, 1194

(C.D. Cal. 2026) (cleaned up) (quoting S. Comm. on Gov’t Operations & H.R. Comm. On Gov’t

Operations, 94th Cong., Source Book on Privacy 168, 217, 884 (Joint Comm. Print 1976)). The

Act accomplishes its goal through both substantive and procedural “safeguards . . . against an

invasion of personal privacy.” Cooper, 566 U.S. at 294–95 (quoting Privacy Act of 1974 § 2(b),

88 Stat. at 1896).

Substantive Safeguards

The Privacy Act’s substantive safeguards provide robust protections related to significant

governmental use and retention of identifiable personal information. See 5 U.S.C. § 552a. For

instance, the statute instructs federal agencies to “collect information to the greatest extent

practicable directly from the subject individual” when use of the information can adversely affect

the individual’s rights. Id. § 552a(e)(2). It requires agencies to maintain records “with such

accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to

the individual.” Id. § 552a(e)(5). And it provides various mechanisms to give individuals notice of

what records are maintained by the federal government as well as to correct any inaccuracies in

those records. Id. § 552a(d)–(g). Importantly, the Act prohibits both inter-agency and extra-agency

disclosure of government records except in limited circumstances. Id. § 552a(b). One such

circumstance is a “routine use,” which is defined as “the use of such record for a purpose which is

compatible with the purpose for which it was collected.” Id. § 552a(a)(7), (b)(3).

The statute also has special provisions governing the use of Social Security numbers. The

Act provides that “[i]t shall be unlawful for any Federal, State or local government agency to deny

to any individual any right, benefit, or privilege provided by law because of such individual’s

refusal to disclose his social security account number.” Privacy Act of 1974 § 7(a)(1), 88 Stat.

at 1909 (codified at 5 U.S.C. § 552a note). The Act further requires that “[a]ny Federal, State, or

local government agency which requests an individual to disclose his social security account

number shall inform that individual whether that disclosure is mandatory or voluntary, by what

statutory or other authority such number is solicited, and what uses will be made of it.” Id. § 7(b),

88 Stat. at 1909.

In 1988, Congress amended the Privacy Act with the Computer Matching and Privacy

Protection Act of 1988. Pub. L. No. 100–503, 102 Stat. 2507 (codified at 5 U.S.C. § 552a note).

That statute prohibits federal agencies from disclosing records to other federal agencies, state

governments, or local governments through a “computer matching program” without a written

agreement. 5 U.S.C. § 552a(o)(1). The Act establishes various statutory procedures and

requirements governing such agreements. Id. § 552a(o). And it prohibits state or local governments

from duplicating or disclosing federal records received pursuant to such an agreement “except

where required by law or essential to the conduct of the matching program.” Id. § 552a(o)(1)(H).

That same prohibition applies to federal agencies with respect to records provided by “any State

or local government, or agency thereof, which discloses records to be used in a matching program.”

Id. § 552a(a)(11), (o)(1)(H).

Congress further provided that nothing in the 1988 Act “shall be construed to authorize

(1) the establishment or maintenance by any agency of a national data bank that combines, merges,

or links information on individuals maintained in systems of records by other Federal agencies;

(2) the direct linking of computerized systems of records maintained by Federal agencies”; or

“(3) the computer matching of records not otherwise authorized by law.” Computer Matching and

Privacy Protection Act of 1988 § 9, 102 Stat. at 2514.

Procedural Safeguards

The Privacy Act also prescribes procedural safeguards that apply when records maintained

by a federal agency—a so-called “system of records”—are changed or used in a new way. 5 U.S.C.

§ 552a(a)(5), (e). Congress enacted these safeguards to “permit an individual to determine what

records pertaining to him are collected, maintained, used, or disseminated by [federal] agencies”

and to ensure “adequate safeguards are provided to prevent misuse of such information.” Privacy

Act of 1974 § 2(b)(1), (4), 88 Stat. at 1896.

In relevant part, the statute establishes strict notice and comment requirements in these

circumstances. 5 U.S.C. § 552a(e)(4), (11). When an agency “establish[es] or revis[es]” any

“system of records,” it must “publish in the Federal Register . . . a notice of the existence and

character of the system of records,” i.e., a System of Records Notice (SORN). Id. § 552a(e)(4).

Each SORN “shall include” nine categories of information:

(A) the name and location of the system;

(B) the categories of individuals on whom records are maintained in the system;

(D) each routine use of the records contained in the system, including the categories

of users and the purpose of such use;

(E) the policies and practices of the agency regarding storage, retrievability, access

controls, retention, and disposal of the records;

(F) the title and business address of the agency official who is responsible for the

system of records;

(G) the agency procedures whereby an individual can be notified at his request if

the system of records contains a record pertaining to him;

(H) the agency procedures whereby an individual can be notified at his request how

he can gain access to any record pertaining to him contained in the system of

records, and how he can contest its content; and

(I) the categories of sources of records in the system.

Id. To publish a statutorily compliant SORN, a federal agency must provide at least thirty days

prior “notice of any new use or intended use of the information in the system, and provide an

opportunity for interested persons to submit written data, views, or arguments to the agency.” Id.

§ 552a(e)(11). And the agency must provide notice to Congress as well. Id. § 552a(r).

10a

Factual Background

SAVE System of Records

SAVE is a system administered by DHS that is “designed to help federal, state, tribal, and

local government agencies confirm citizenship and immigration status prior to granting benefits

and licenses, as well as for other lawful purposes.” DHS AR 195. SAVE users “formalize the

purpose and use in which they use SAVE through a Memorandum of Agreement (MOA) or

Computer Matching Agreement (CMA)” establishing “the terms and conditions for the user

agency’s participation in SAVE.” DHS AR 195–96. One purpose for which states can enter into

such an agreement is to verify the citizenship of registered voters. Notice of a Modified System of

Records, 90 Fed. Reg. 48,948, 48,951 (Oct. 31, 2025) (DHS AR 117) (DHS 2025 SORN). Prior

to May 2025, SAVE users could access the immigration status of individuals with information

stored in the SAVE system, and SAVE’s response was based on the limited records maintained by

DHS, the State Department, and the Justice Department. See Notice of Modified System of

Records, 85 Fed. Reg. 31,798, 31,802 (May 27, 2025) (DHS AR 112) (2020 SORN). Also prior

to May 2025, DHS recognized SAVE as a system of records subject to the Privacy Act—which

means that DHS appeared to comply with the statute’s notice-and-comment requirements and

issued SORNs for changes to SAVE.1

See Notice of Modified System of Records, 85 Fed. Reg. 31,798, 31,798 (May 27, 2020)

(DHS AR 108); DHS USCIS–004 SAVE Program System of Records, 81 Fed. Reg. 78,619,

78,619 (Nov. 8, 2016); DHS USCIS—004—SAVE Program System of Records, 77 Fed.

Reg. 47,415, 47,415 (Aug. 8, 2012); USCIS–004 Verification Information System (VIS) System

of Records Notice, 73 Fed. Reg. 75,445, 75,445–46 (Dec. 11, 2008); USCIS VIS System of

Records Notice, 73 Fed. Reg. 10,793, 10,793 (Feb. 28, 2008); Privacy Act: VIS Records Notice,

72 Fed. Reg. 17,569, 17,569 (Apr. 9, 2007); Privacy Act of 1974 System of Records, 67 Fed.

Reg. 64,134, 64,134 (Oct. 17, 2002); Privacy Act of 1974 System of Records, 66 Fed. Reg. 46,812,

46,812 (Sep. 7, 2001).

11a

Establishment of the Modified SAVE

On March 25, 2025, President Trump signed a sweeping Executive Order directing federal

agencies to take various actions related to the administration of federal elections. Exec. Order

No. 14248, 90 Fed. Reg. at 14,006–09 (DHS AR 335–38). The Executive Order instructs that for

the purpose of “identify[ing] unqualified voters registered in the States,” “the Secretary of

Homeland Security shall, consistent with applicable law, ensure that State and local officials have,

without the requirement of the payment of a fee, access to appropriate systems for verifying the

citizenship or immigration status of individuals registering to vote or who are already registered.”

Id. at 14,006 (DHS AR 335). The Executive Order further requires DHS to “share database

information with States upon request” under 8 U.S.C. § 1373(c) for voter list maintenance, and it

directs DHS, in coordination with the Department of Government Efficiency, to compare voter

records with “Federal immigration databases.” Id. at 14,005–06 (DHS AR 334–35). And the

Executive Order specifically directs SSA to make its databases available “to all State and local

election officials” for verifying voter eligibility. Id. at 14,007 (DHS AR 336).

The Executive Order prompted a flurry of action by the Federal Defendants charged with

its implementation. SSA AR 1–2; DHS AR 39–68. On May 15, 2025, DHS and SSA executed a

letter agreement to overhaul the SAVE system, which authorized “information sharing” between

DHS and SSA “by matching data submitted through SAVE to SSA records in SSA’s Master Files

of Social Security Number (SSN) Holders and SSN Applications.” DHS AR 423 (citation

omitted); SSA AR 9 (citation omitted). The “SSA Master Files” (or NUMIDENT)—which would

be linked to SAVE under the new information sharing agreement—contains SSNs, names, dates

and places of birth, citizenship indicators, death records, and information obtained while

processing requests for SSNs. SSA AR 170–71; DHS AR 253. On May 22, 2025, the Federal

12a

Defendants publicly launched the expanded SAVE system. DHS AR 493; DHS AR 1385. But no

agency published a SORN or otherwise provided an opportunity for the public to comment on the

modifications prior to publication. Mot. Hr’g Tr. 71:15–22, ECF No. 48. At that juncture, the

operative SORN for SAVE was published on May 27, 2020. Notice of Modified System of

Records, 85 Fed. at 31,798 (DHS AR 108).

Present Litigation and Promulgation of New SORNs

In September 2025, the Plaintiffs filed this action challenging the modified SAVE as

unlawful, see Compl., ECF No. 1, and moved for an emergency stay under Section 705 of the

APA, Mot. Stay, ECF No. 16. During those emergency proceedings, the Federal Defendants would

not say one way or the other whether the Privacy Act applies to modifications to SAVE—despite

DHS’s prior practice of publishing SORNs for modifications to the system. Mot Hr’g Tr. 69:18–

24. But the Federal Defendants conceded that the then-recent modification to SAVE was

substantial enough that the Privacy Act would require a SORN if it applied. Id. The Court

ultimately denied the Plaintiffs’ emergency motion for failure to show irreparable harm. See

League of Women Voters v. DHS., No. 25-cv-3501, 2025 WL 3198970, at *5 (D.D.C. Nov. 17,

2025).

The administrative record provides a window into DHS’s understanding of the SAVE

“modified system.” Notice of a Modified System of Records, 90 Fed. Reg. at 48,948

(DHS AR 114). Internal “Privacy Threshold Analysis” documents from July and September 2025

show that DHS was aware that the modification of SAVE was “not in compliance” with the Privacy

Act, DHS AR 277; DHS AR 319, and that “[s]hortfalls in data accuracy” in SSA citizenship data

integrated into the new SAVE system “could cause incomplete or false results,” DHS AR 260;

DHS AR 302. This was in part because “[t]here is no obligation for an individual to report to SSA

13a

a change in their citizenship or immigration status until they request a replacement card or file a

claim for a Social Security benefit.” SSA AR 103. Thus, a naturalized citizen who applied for a

Social Security card or otherwise interacted with SSA prior to naturalization may be incorrectly

identified as a non-citizen in SSA records. Id.

After the hearing on the Plaintiffs’ emergency motion, DHS and SSA both published

SORNs (2025 SORNs) for the modifications made to their respective systems. Notice of a

Modified System of Records, 90 Fed. Reg. at 48,948–55 (DHS AR 114–21); Notice of a Modified

System of Records, 90 Fed. Reg. 50,879 (Nov. 12, 2025) (SSA AR 206) (SSA 2025 SORN); Fed.

Defs.’ Suppl. Resp. 8, ECF No. 51; Fed. Defs.’ Notice of Publication of SORN, ECF No. 54. The

2025 SORNs outlined the “modified system” that resulted from the modification of SAVE in May

2025. Notice of a Modified System of Records, 90 Fed. Reg. at 48,949 (DHS AR 115); see also

Notice of a Modified System of Records, 90 Fed. Reg. at 50,880 (SSA AR 207). The DHS 2025

SORN established a new “Routine Use L” to enable DHS to disclose records to SSA “and other

federal, state, tribal, territorial, local, governments and other authorized entities to assist [SAVE]

user agencies [to] determine U.S. citizenship and immigration status of an individual when a DHS

approved agreement is in place between DHS and the entity.” Notice of a Modified System of

Records, 90 Fed. Reg. at 48,954 (DHS AR 120). The SSA 2025 SORN added a new “Routine Use

No. 49” for disclosures of “citizenship and immigration status” to DHS “pursuant to 8 U.S.C.

[§] 1373(a).” Notice of a Modified System of Records, 90 Fed. Reg. at 50,883 (SSA AR 210). The

2025 SORNs solicited comments from the public—but they also provided that the modified SAVE

system outlined in the 2025 SORNs would be effective immediately (i.e., before the public could

submit comments). See Notice of a Modified System of Records, 90 Fed. Reg. at 48,949

(DHS AR 115); Notice of a Modified System of Records, 90 Fed. Reg. at 50,880 (SSA AR 207)

14a

(recognizing immediate effect except for new routine uses which would automatically take effect

after thirty days). The modified system that resulted from the Federal Defendants’ self-described

“overhaul” of SAVE differed from SAVE’s prior functionality (authorized by DHS’s 2020 SORN)

in three primary ways. See DHS AR 493.

First, the old SAVE did not previously have access to the records of natural-born citizens

unless those individuals had some other interaction with DHS, e.g., as a sponsor of a non-citizen.

See Notice of Modified System of Records, 85 Fed. Reg. at 31,801 (DHS AR 111). But the new

SAVE includes records about “U.S. citizens by birth.” Notice of a Modified System of Records,

90 Fed. Reg. at 48,949–51 (DHS AR 115–17).

Second, the old SAVE only accessed records stored in DHS systems, along with certain

immigration-related records systems at the State Department and the Department of Justice

identified in the 2020 SAVE SORN. See Notice of Modified System of Records, 85 Fed Reg.

at 31,802 (DHS AR 112). The old SAVE did not access SSA databases and SAVE users could not

run initial SAVE searches using an individual’s SSN or partial SSN. Notice of Modified System

of Records, 85 Fed Reg. at 31,798–99, 31,802 (DHS AR 108–09, 112). Instead, users had to

provide an individual’s DHS numeric identifier (e.g., an alien registration number or A-Number).

Notice of Modified System of Records, 85 Fed Reg. at 31,799 (DHS AR 09); DHS AR 248; DHS

AR 399. The old SAVE only had access to Social Security numbers “in very limited

circumstances” when benefits applicants submitted that number through DHS’s Form G-845, a

form used to document a person’s immigration status and verify their identity. Notice of Modified

System of Records, 85 Fed Reg. at 31,802 (DHS AR 111). Previously, “[i]f SAVE display[ed] an

‘Institute Additional Verification’ message,” SAVE users could require completion of the form

“G-845 with the applicant’s knowledge and consent,” which could include a social security

15a

number. DHS AR 192; see also DHS AR 205–06, 278. But beyond this circumstance, SAVE did

not have access to social security numbers. See Notice of Modified System of Records, 85 Fed

Reg. at 31,802 (DHS AR 112); DHS AR 278. Because most U.S.-born citizens do not have DHS

numeric identifiers, before 2025 SAVE generally did not query the records of natural-born U.S.

citizens. See DHS AR 248.

Meanwhile, the new SAVE “update[d] the categories of records in the system to include

collecting both full and truncated (last four digits) Social Security number[s]” and added the SSA

Master File as a “record source” for SAVE. Notice of a Modified System of Records, 90 Fed. Reg.

at 48,949 (DHS AR 115). The result is that SAVE users may use the modified system to query any

non-citizen, naturalized citizen, and natural-born citizen who have Social Security numbers in the

SSA Master File. See DHS AR 248.

Third, the old SAVE could only conduct individual searches; SAVE users could not

conduct bulk searches of more than one person’s data at a time. See DHS AR 247. But the new

SAVE added “the capability to create cases in SAVE by uploading a file with a list of multiple

cases” for a bulk search. Notice of a Modified System of Records, 90 Fed. Reg. at 48,951

(DHS AR 117).

Modified SAVE’s User Experience

The SAVE “modified system” operates as follows. Id. at 48,948 (DHS AR 114). After user

agencies execute an MOA or CMA with USCIS, which establish “the terms and conditions for the

user agency’s participation in SAVE,” DHS AR 195–96; see also DHS AR 223; DHS AR 1344,

those users may conduct bulk searches.

A SAVE user first downloads a spreadsheet and manually enters some or all the following

data: first name, last name, date of birth, either a full or partial SSN, and the reason for verification

16a

(e.g., voter verification). DHS AR 1443. The SAVE user can also provide voters’ DHS numeric

identifiers (e.g., an A-number). DHS AR 225; DHS AR 2. The user then uploads the completed

file into the SAVE interface. DHS AR 1444. Once that happens, SAVE automatically discloses

the voters’ uploaded data to SSA and uses it to search the SSA Master File. See DHS AR 224–25;

DHS AR 253; DHS AR 1525. SSA automatically discloses the SSA Master File search results to

DHS, including the following fields:

•

SSN Match (True/False);

•

Full SSN for all matches (when a partial SSN is provided);

•

Name Match (True/False);

•

Date of Birth Match (True/False);

•

Citizenship/Foreign Indicator:

o Blank – Citizenship code is blank and foreign-born indicator is blank;

o “A” – U.S. citizen;

o “B” – Legal alien, eligible to work;

o “C” – Legal alien, not eligible to work;

o “D” – Other;

o “E” – Alien student, restricted work authorized; and

o “F” – Conditionally legalized alien;

•

Foreign Born indicator (citizenship code is not present, but voter was foreign

born);

•

State/Country Code;

•

American Samoa indicator (True/False);

•

Alien Registration number (where applicable);

•

Death indicator (Yes Deceased/Not Deceased); and

•

Error code descriptions (transaction and record levels).

Notice of a Modified System of Records, 90 Fed. Reg. at 48,950 (DHS AR 116);

DHS AR 225–26; DHS AR 233; DHS AR 424; DHS AR 437–38.

If the search identifies a potential non-U.S. citizen and a DHS numeric identifier is

available (either from the user’s initial input or SSA records), SAVE automatically queries

17a

additional systems across the federal government, DHS AR 1450–58; DHS AR 1525; Notice of a

Modified System of Records, 90 Fed. Reg. at 48,953–54 (DHS AR 119–20); DHS AR 227–30.

After a manual review of responses, SAVE may then return a response that will either include the

voter’s citizenship status—e.g., “U.S. Citizen” or “Lawful Permanent Resident”—or request

additional actions by the SAVE user, including requesting the submission of additional documents.

DHS AR 1525; DHS AR 1507; DHS AR 1378–79; DHS AR 1530.

If the match to SSA records is inconclusive, the SSA records confirm that a voter is a

citizen or is deceased, or SAVE identifies a potential non-U.S. citizen status and no DHS numeric

identifier is available, then SAVE ends the automated query, DHS AR 254–55; DHS AR 297, and

generates one of the following responses:

•

U.S. Citizen (per SSA Record);

•

Deceased (per SSA record);

•

Immigration Enumerator [i.e. DHS identifier] Required – Resubmit with

Additional Information;

•

Unable to Return Record from SSA – Resubmit with Additional Information;

•

Full SSN Required – Resubmit with Additional Information.

DHS AR 1379.

If SAVE identifies a voter as a citizen, then the SAVE user need not take any further steps

or gather “additional information.” See DHS AR 1507–08. If SAVE identifies the individual as

anything else, then the template SAVE MOA directs the SAVE user to “contact the registrant or

registered voter to obtain proof of U.S. citizenship.” DHS AR 762. And if the SAVE result is

inconclusive (e.g., SAVE provides an “Immigration Enumerator Required – Resubmit with

Additional Information” response), then (1) the SAVE user must provide the voter’s DHS numeric

identifier (which state and local agencies likely do not possess), and/or (2) the SAVE user must

18a

“contact the registrant or registered voter to obtain proof of U.S. citizenship.” See DHS AR 762;

DHS AR 1526.

Procedural Background

On January 21, 2026, after the comment period expired for the 2025 SORNs, the

Plaintiffs—the League of Women Voters, League of Women Voters of Texas, League of Women

Voters of Louisiana, League of Women Voters of Louisiana Education Fund, League of Women

Voters of Virginia, and the Electronic Privacy Information Center (EPIC)—filed an Amended and

Supplemental Complaint challenging the three major modifications to the SAVE system outlined

in those SORNs. Am. Compl., ECF No. 61. On April 6, 2026, the Court permitted the State of

Texas, a SAVE user, to intervene as a Defendant in this action. Order, ECF No. 86. The Plaintiffs

moved for summary judgment, asking this Court to set aside and vacate the modified SAVE system

and 2025 SORNs as unlawful under the APA and the Constitution. Pls.’ Mem. Supp. Summ. J.

Mot., ECF No. 66-1 (Pls.’ Mot.). The Federal Defendants cross-moved for either dismissal of this

action for lack of subject matter jurisdiction and failure to state a claim or for summary judgment.

Fed. Defs.’ Combined Mem. Supp. Mot. Dismiss/Mot. Summ. J. and Opp’n to Pls.’ Mot. (Fed.

Defs.’ Mot.), ECF No. 77-1. And the State of Texas moved to dismiss for lack of subject matter

jurisdiction and failure to state a claim. Texas Mot. Dismiss (Texas Mot.), ECF No. 97. These

motions are fully briefed and ripe for review. Pls.’ Combined Reply & Opp’n to Fed. Defs.’ Mot.

(Pls.’ Reply), ECF Nos. 99 & 100; Pls.’ Opp’n to Texas Mot. (Pls.’ Opp’n), ECF No. 104; Texas

Reply, ECF No. 105; Fed. Defs.’ Reply, ECF No. 106.2

The Court has received and considered amicus briefs in support of the Plaintiffs filed by Travis

County, Travis County Tax Assessor-Collector Celia Israel, and Travis County Clerk Dyana

Limon-Mercado; Campaign Legal Center, Center for Media and Democracy, Common Cause, and

Protect Democracy Project; Texas Civil Rights Project; Lawyers Defending American

19a

LEGAL STANDARD

A court “shall grant summary judgment if the movant shows that there is no genuine

dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R.

Civ. P. 56(a). In the context of an APA challenge, summary judgment “serves as a mechanism for

deciding, as a matter of law, whether the administrative record supports the agency action and

whether the agency action is consistent with the APA standard of review.” Int’l Swaps &

Derivatives Ass’n v. U.S. CFTC, 887 F. Supp. 2d 259, 266 (D.D.C. 2012) (citing Richards v. INS,

554 F.2d 1173, 1177 & n.28 (D.C. Cir. 1977)).

“A motion under Rule 12(b)(1) ‘presents a threshold challenge to a court’s [subject-matter]

jurisdiction.’” Ctr. for Biological Diversity v. U.S. Int’l Dev. Fin. Corp., 585 F. Supp. 3d 63, 69

(D.D.C. 2022) (quoting Ctr. for Biological Diversity v. Jackson, 815 F. Supp. 2d 85, 89 (D.D.C.

2011)). The plaintiff “bears the burden of proving by a preponderance of the evidence that the

Court has subject-matter jurisdiction over her claims.” Schmidt v. U.S. Capitol Police Bd., 826

F. Supp. 2d 59, 69 (D.D.C. 2011). When evaluating a motion under Rule 12(b)(1), “the court may

consider documents outside the pleadings to assure itself that it has jurisdiction.” Sandoval v. U.S.

DOJ, 322 F. Supp. 3d 101, 104 (D.D.C. 2018).

Under Rule 12(b)(6), a court must dismiss a complaint that does not “contain sufficient

factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v.

Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)).

Courts “must construe the complaint ‘in favor of the plaintiff, who must be granted the benefit of

all inferences that can be derived from the facts alleged.’” Hettinga v. United States, 677 F.3d 471,

476 (D.C. Cir. 2012) (quoting Schuler v. United States, 617 F.2d 605, 608 (D.C. Cir. 1979)). But

Democracy, Inc.; Service Employees International Union; and the American Civil Liberties Union.

ECF Nos. 68, 89, 91, 87, 88 & 94.

20a

courts need not accept as true “a legal conclusion couched as a factual allegation,” nor an

“inference[] . . . unsupported by the facts set out in the complaint.” Trudeau v. FTC, 456 F.3d 178,

193 (D.C. Cir. 2006) (first quoting Papasan v. Allain, 478 U.S. 265, 286 (1986); and then quoting

Kowal v. MCI Commc’ns Corp., 16 F.3d 1271, 1276 (D.C. Cir. 1994)).

DISCUSSION

The Plaintiffs contend that the Federal Defendants have unlawfully established a modified

SAVE system of records in violation of the APA and the Constitution. Specifically, they argue

that the establishment of the modified SAVE and the 2025 SORNs (1) violated the APA because

of substantive provisions in the Social Security Act and the Privacy Act, (2) violated certain

procedural protections in the Privacy Act and are arbitrary and capricious under the APA, and

(3) violated the constitutional separation of powers. The Plaintiffs seek summary judgment on their

claims, asking the Court to hold unlawful, vacate, and set aside the modified SAVE system and

the accompanying 2025 SORNs.

The Federal Defendants and the State of Texas (collectively, the Defendants) seek

dismissal of the Plaintiffs’ claims. They first raise threshold arguments in support of dismissal—

arguing that the Plaintiffs lack standing, that the challenged activity is not a final agency action,

and that the Plaintiffs have an adequate remedy elsewhere. They also defend the establishment of

the modified SAVE and the 2025 SORNs on the merits, asserting that they did not violate the APA

or the Constitution and were otherwise authorized by immigration laws.

Having reviewed the comprehensive briefing in this case, the Court is convinced that the

Plaintiffs have the better of the arguments. The Defendants’ threshold arguments are easily

dispensed with. And on the merits, the Court holds that the establishment of the modified SAVE

system and the 2025 SORNs are unlawful for at least three reasons. First, they violated the Social

Security Act. Second, they violated both substantive and procedural protections in the Privacy Act.

21a

And third, they are arbitrary and capricious in violation of the APA. Because relief is warranted

on these claims alone, the Court declines to address the Plaintiffs’ remaining claims.3

Standing

Standing leads off. Recall that the Plaintiffs are non-profit organizations. An organization

may demonstrate standing by either (1) asserting associational “standing solely as the

representative of its members,” or (2) identifying an organizational injury “in its own right.”

Students for Fair Admissions, Inc. v. President & Fellows of Harvard Coll., 600 U.S. 181, 199

(2023) (quoting Warth v. Seldin, 422 U.S. 490, 511 (1975)). To establish associational standing,

an organization must show that: “(1) at least one of its members has standing to sue in her or his

own right, (2) the interests it seeks to protect are germane to its purpose, and (3) neither the claim

asserted nor the relief requested requires the participation of an individual member in the lawsuit.”

Institutional S’holder Servs., Inc. v. SEC, 142 F.4th 757, 764 (D.C. Cir. 2025) (quoting Wash. All.

of Tech. Workers v. DHS, 50 F.4th 164, 175 (D.C. Cir. 2022)). The first two prongs are rooted in

Article III of the Constitution, but the “third prong is a prudential one” focused on “matters of

administrative convenience and efficiency.” United Food & Com. Workers Union Loc. 751 v.

Brown Grp., Inc., 517 U.S. 544, 555–57 (1996).

Here, the Defendants do not appear to challenge the final two prongs. The League of

Women Voters and their state affiliates seek to protect the voting rights of their members, which

is germane to the League’s purpose to “empower voters and defend democracy, including by

registering voters and increasing voter participation.” Stewart Decl. ¶¶ 2, 7, ECF No. 16-5; see

also LeBombard Decl. ¶¶ 2, 5, 14, ECF No. 66-7; Suppl. Green Decl. ¶¶ 2, 6, ECF No. 66-8; Porte

The Court need not address the Plaintiffs’ constitutional claims; Privacy Act accuracy claims,

5 U.S.C. § 552a(e)(5), (6), (10); claims under Section 1306(a)(1) of the Social Security Act; and

mandamus claims to enforce the Computer Matching and Privacy Protection Act.

22a

Decl. ¶¶ 2, 3, 11, 14, ECF No. 16-6. And EPIC seeks to protect the privacy rights of its members,

which is germane to its “mission . . . to secure the fundamental right to privacy in the digital age.”

Butler Decl. ¶ 3, ECF No. 66-10. Furthermore, individual member participation is not necessary

where an organization seeks APA vacatur on behalf of its members. See Powder River Basin Res.

Council v. U.S. Dep’t of Interior, 749 F. Supp. 3d 151, 162 (D.D.C. 2024); Sierra Club v. Perry,

373 F. Supp. 3d 128, 135 (D.D.C. 2019).

Standing thus turns on whether “at least one of [the Plaintiffs’] members has standing to

sue in her or his own right.” Institutional S’holder Servs., 142 F.4th at 764 (quoting Wash. All. of

Tech. Workers, 50 F.4th at 175). “To establish Article III standing, a plaintiff must show (1) injury

in fact that is concrete and particularized and actual or imminent rather than conjectural or

hypothetical, (2) causation fairly traceable to the defendant’s challenged action and

(3) redressability by a favorable decision that is likely as opposed to merely speculative.” Am.

Whitewater v. FERC, 125 F.4th 1139, 1150 (D.C. Cir. 2025) (citing Lujan v. Defs. of Wildlife, 504

U.S. 555, 560–61 (1992)). The “plaintiff[] must demonstrate standing for each claim that they

press and for each form of relief that they seek.” TransUnion LLC v. Ramirez, 594 U.S. 413, 431

(2021). And where an action involves only non-monetary relief, “[o]nly one plaintiff . . . needs

standing in order for a particular claim to go forward. . . . That is, if constitutional standing ‘can

be shown for at least one plaintiff, [the Court] need not consider the standing of the other plaintiffs

to raise that claim.’” Whitman-Walker Clinic v. U.S. HHS, 485 F. Supp. 3d 1, 18 (D.D.C. 2020)

(quoting Carpenters Indus. Council v. Zinke, 854 F.3d 1, 9 (D.C. Cir. 2017)).

Here, the Court concludes that the League of Women Voters and the League of Women

Voters of Texas have standing to proceed. See Nel Decl., ECF No. 66-3; A. Doe Decl., ECF

23a

No. 66-4; B. Doe Decl., ECF No. 66-5; J. Doe 4 Suppl. Decl., ECF No. 16-3.4 Their members

suffered three types of injuries: privacy or reputational injuries, voter injuries, and procedural

injuries. Pls.’ Mot. 13.5 The Court addresses each in turn.

Privacy or Reputational Injuries

The Plaintiffs first argue that the disclosure of their members’ personal information in

violation of the Social Security Act and the Privacy Act has caused privacy or reputational injuries

that are sufficiently concrete to confer Article III standing. See id. The Court agrees.

“[F]or Article III purposes, an injury is ‘concrete’ if it is similar to a type of harm

cognizable at common law.” Pileggi v. Washington Newspaper Publ’g Co., 146 F.4th 1219, 1226

(D.C. Cir. 2025) (quoting TransUnion, 594 U.S. at 424). Of course, “Article III does not require

‘an exact duplicate in American [common-law] history and tradition’”—“an injury is concrete if

it has ‘a close historical or common-law analogue’” and there is a “close relationship” between the

harm that Congress sought to remedy and that analogue. Id. (quoting TransUnion, 594 U.S.

at 424–25). In providing a private cause of action, Congress may even “identif[y] a modern relative

of a harm with long common law roots,” Gadelhak v. AT&T Servs., Inc., 950 F.3d 458, 462 (7th

Cir. 2020) (Barrett, J.), and “elevate to the status of legally cognizable injuries [those] concrete,

de facto injuries that were previously inadequate in law,” TransUnion, 594 U.S. at 425–26

(quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016)). Thus, the injury-in-fact requirement

is satisfied if a party brings a “private right of action to remedy” a harm recognized in common

law or “a harm that is a lesser form of a harm recognized at common law.” Pileggi, 146 F.4th

Members of local and state Leagues of Women Voters are also members of the League of Women

Voters. Stewart Decl. ¶ 6, ECF No. 16-5; Supp. Stewart Decl. ¶ 10, ECF No. 66-5.

Because the Plaintiffs’ injuries suffice to confer standing for their claims, the Court does not

address the Plaintiffs’ argument that organizational or informational standing can also support

some of their claims. See Pls.’ Mot. 13.

24a

at 1227. “Th[e]se include, for example, reputational harms, disclosure of private information, and

intrusion upon seclusion.” TransUnion, 594 U.S. at 425.

The Privacy Act “provide[s] certain safeguards for an individual against an invasion of

personal privacy.” Cooper, 566 U.S. at 294–95 (quoting Privacy Act of 1974 § 2(b), 88 Stat.

at 1896). “[T]he Act serves interests similar to those protected by defamation and privacy torts”—

“there is good reason to infer that Congress relied upon those torts in drafting the Act” and

“parallel[ed]” those “common-law torts” in its statutory scheme. Id. at 295–96.

Here, the Plaintiffs have established privacy injuries because of the modified SAVE

system. They claim that the Federal Defendants have disclosed their members’ private information

in SSA records (including their SSNs and citizenship status) without their consent through bulk

SAVE queries. Specifically, they allege that Texas, Louisiana, and other SAVE users have

accessed and continue to have access to this private information through SAVE in violation of the

Social Security Act and the Privacy Act. See Nel Decl. ¶¶ 27–43; A. Doe Decl. ¶¶ 18, 23–24; B.

Doe Decl. ¶¶ 32–44, 46–47; C. Doe Decl. ¶¶ 19–25, ECF No. 66–6. The Plaintiffs further allege

that their members provided this private information to SSA when they applied for SSNs, and that

they reasonably expected the agency to keep that information confidential and use it only for that

purpose. See Nel Decl. ¶ 33; A. Doe Decl. ¶ 18; B. Doe Decl. ¶ 38; C. Doe Decl. ¶ 25; Kisselburgh

Decl. ¶ 15, ECF No. 66-11; Suppl. Green Decl. ¶ 49; J. Doe 4 Suppl. Decl. ¶ 9; J. Doe 6 Decl.

¶¶ 10, 20, ECF No. 16-8.

The Plaintiffs establish reputational injuries, too. As they tell it, their members include

individuals who applied for SSNs when they were non-citizens but have since naturalized. Nel

Decl. ¶ 34; A. Doe Decl. ¶¶ 4–6; B. Doe Decl. ¶¶ 4–6; Suppl. Green Decl. ¶¶ 32, 35; J. Doe 4

Suppl. Decl. ¶¶ 2, 8; C. Doe Decl. ¶¶ 4–5; J. Doe 6 Decl. ¶¶ 2, 9. For those individuals, their Social

25a

Security files are outdated and incorrectly list them as non-citizens. Nel Decl. ¶ 34; B. Doe Decl.

¶ 39; Suppl. Green Decl. ¶ 11; J. Doe 4 Suppl. Decl. ¶ 14; C. Doe Decl. ¶ 26; J. Doe 6 Decl. ¶ 15.

The Plaintiffs state that their members had no reason to believe that failure to update their

citizenship status with SSA would have any impact on their lives. Nel Decl. ¶ 34; A. Doe Decl.

¶ 19; B. Doe Decl. ¶ 39; C Doe Decl. ¶ 26. But because of the Federal Defendants’ disclosure of

their citizenship status through the modified SAVE, these individuals were identified as potential

non-citizens by the State of Texas based on a “comparison of the information in [their] voter

registration records with the United States Citizenship and Immigration Services SAVE records.”

Nel Decl., Ex. 1; A. Doe Decl., Ex. 1; B. Doe Decl., Ex. 2; C. Doe Decl., Ex. 1. And they have

had to provide proof of citizenship within thirty days to avoid cancellation of their voter

registrations. A. Doe Decl. ¶¶ 11–14 & Ex. 1; C. Doe Decl. ¶¶ 12–14, 18 & Ex. 1. Some of the

Plaintiffs’ members have had their voter registrations wrongfully cancelled for failure to provide

documentation within thirty days of these notices. See Nel Decl. ¶¶ 19–21, 24, 26 & Exs. 1, 2; B.

Doe Decl. ¶¶ 11–17, 21–22, 24–27, 30–31 & Exs. 1, 2.

The Plaintiffs argue that statutory claims challenging the disclosure of their private

information to both DHS and SAVE users have three common-law analogues: intrusion upon

seclusion, breach of confidence, and defamation. Pls.’ Mot. 14–16. The Court agrees that all three

analogues fit the bill. Therefore, it concludes that the Plaintiffs have established concrete injuries

that serve as a basis for standing in this Court.

a. Intrusion Upon Seclusion

The first analogue is intrusion upon seclusion. Pls.’ Mot. 14. An “injury . . . closely

analogous to the harm of intrusion upon seclusion” is cognizable under Article III. Pileggi, 146

F.4th at 1228. Intrusion upon seclusion is an “intentional[] intrusi[on], physical or otherwise, upon

26a

the solitude or seclusion of another or his private affairs or concerns . . . if the intrusion would be

highly offensive to a reasonable person.” Id. (quoting Restatement (Second) of Torts § 652B

(A.L.I. 1977)). Various courts across the country, see, e.g., Am. Fed. of State, Cnty. & Mun. Emps.

v. SSA, 172 F.4th 361, 369 (4th Cir. 2026) (en banc), and nearly “every court in this circuit” have

held that the unauthorized disclosure of Social Security and other “private information” by

government employees is the exact type of injury protected by the tort of intrusion upon seclusion,

AFL-CIO v. Dep’t of Lab., No. 25-cv-339, 2026 WL 879518, at *10 (D.D.C. Mar. 31, 2026)

(collecting cases). And the Plaintiffs are challenging just that—an unauthorized disclosure of

Social Security and other private information. This supports Article III standing.

The Defendants urge the contrary. They say that intrusion upon seclusion has an additional

requirement: “knowledge that a third party is engaged in” the invasion of privacy, relying on the

Fourth Circuit’s abrogated opinion in Am. Fed’n of Teachers v. Bessent, 152 F.4th 162, 172 (4th

Cir. 2025), abrogated by 172 F.4th 361 (4th Cir. 2026). See Fed. Defs.’ Mot. 19; Texas Mot. 11–

12. That decision reasoned that intrusion upon seclusion is targeted to privacy injuries “that

invade[] one’s space or disrupt[] one’s daily activities,” while “[u]nauthorized knowledge of

sensitive information” like Social Security information without a “feeling of unease” or “trespass”

stemming from knowledge of that disclosure is more akin to “defamation.” Bessent, 152 F.4th

at 172 (citation omitted). Bessent’s rationale is both unconvincing and inapposite for three reasons.

First and foremost, Bessent was decided on an emergency basis and therefore on an

expedited timeline, and it thus concluded only that the plaintiffs there likely lacked standing. Id.

at 171. With more time to consider the issue, the en banc Fourth Circuit concluded that Bessent

misread the Second Restatement of Torts and held instead that disclosure of SSA data is akin to

27a

the tort of intrusion upon seclusion irrespective of knowledge of the disclosure. Am. Fed. of State,

Cnty. & Mun. Emps., 172 F.4th at 370–71.

Second, Bessent is inapposite. In Bessent, none of the plaintiffs alleged that “any particular

row of information [in the database] belonging to any particular Plaintiff [was] examined” by a

third party. 152 F.4th at 172. In stark contrast, the record here abounds with declarations that SSA

handed over individuals’ private information to state authorities, that those authorities revoked or

threatened to revoke voter registrations based on the unauthorized and inaccurate disclosures, and

that the unauthorized and inaccurate disclosures disrupted the individuals’ daily lives when they

were forced to correct the inaccuracies. See, e.g., A. Doe Decl. ¶¶ 11–14; C. Doe Decl. ¶¶ 12–14,

18. These facts—United States citizens receiving notices from state authorities threatening

revocation of their voter registration and possible criminal sanctions based on the unauthorized

disclose of inaccurate, private information—undoubtedly create a “feeling of unease when and

where one should ideally be at peace.” Bessent, 152 F.4th at 172.

Third, Bessent is unpersuasive on its own terms. Most glaringly, it did not grapple with

TransUnion’s instruction that Article III does not “require an exact duplicate” to a harm cognizable

in common law and that Congress “may ‘elevate to the status of legally cognizable injuries

concrete, de facto injuries that were previously inadequate in law.’” TransUnion, 594 U.S.

at 425–26, 433 (quoting Spokeo, 578 U.S. at 341). Courts considering this instruction have held

that the disclosure of SSA data is undoubtedly the “same kind of harm that common law” privacy

torts, like intrusion upon seclusion, protect. See All. for Retired Ams. v. Bessent, 770 F. Supp. 3d

79, 104 (D.D.C. 2025) (quoting Gadelhak, 950 F.3d at 462). Indeed, TransUnion itself made clear

that “retention of information lawfully obtained, without further disclosure, traditionally has not

provided the basis for a lawsuit in American courts,” but a different analysis is necessary in

28a

equitable suits where (1) private information is “provided” to third parties, (2) there is a “serious

likelihood of disclosure” of that information, or (3) when plaintiffs are “aware of . . . misleading

information” provided about them. 594 U.S. at 434, 436 n.7, 438 (emphases added) (cleaned up).

Courts have long held that the “unlawful” “collection, storage, and use” of private data “qualifies

as an invasion of a ‘private domain, much like an act of trespass would be’” and “is closely

analogous to historical claims for invasion of privacy.” Fox v. Dakkota Integrated Sys., LLC, 980

F.3d 1146, 1155 (7th Cir. 2020) (emphasis added) (cleaned up) (collecting cases and holding that

a plaintiff’s claim that her workplace unlawfully retained and shared her biometric data with a

third-party was sufficiently analogous to historical claims for invasion of privacy to establish an

Article III injury).

Accordingly, the Court concludes that the tort of intrusion upon seclusion is a sufficient

analogue for the disclosure claims under the Privacy and Social Security Acts. The Plaintiffs have

suffered a concrete injury for purposes of Article III standing.

b. Breach of Confidence

The Parties next dispute whether the tort of breach of confidence provides an analogue.

Pls.’ Mot. 14; Fed. Defs.’ Mot. 20–21; Texas Mot. 14–15. The tort of breach of confidence—“a

harm that has traditionally been regarded as providing a basis for a lawsuit in English or American

courts”—“‘lies where a person offers private information to a third party in confidence and the

third party reveals that information’ to another.” Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059,

1064 (D.C. Cir. 2019) (first quoting Spokeo, 578 U.S. at 340–41; and then quoting Muransky v.

Godiva Chocolatier, Inc., 922 F.3d 1175, 1190–91 (11th Cir. 2019)). Importantly, breach of

confidence bears a close resemblance to the Privacy Act’s prohibition on “disclosure” or “use of

[a] record for a purpose which is [in]compatible with the purpose for which it was collected.”

29a

5 U.S.C. § 552a(a)(7), (b)(3). “[T]here is good reason to infer[, then,] that Congress relied upon

[this] tort[] in drafting the Act,” Cooper, 566 U.S. at 295, and that a violation of this provision in

the Privacy Act is a close “analogue” to breach of confidence, TransUnion, 594 U.S. at 424.

Accordingly, the Court agrees that the Plaintiffs’ Privacy Act claim challenging the “wrongful

sharing of sensitive information” through SAVE “bears a close relationship to the harms

traditionally redressable through . . . breach of confidence” as well. League of United Latin Am.

Citizens v. Exec. Off. of the President, 818 F. Supp. 3d 34, 110 (D.D.C. 2026).

c. Defamation

Finally, the Plaintiffs also rely on the common law tort of defamation as an analogue for

their disclosure injuries. Pls.’ Mot. 16. “Under longstanding American law, a person is injured

when a defamatory statement ‘that would subject him to hatred, contempt, or ridicule’ is published

to a third party.” TransUnion, 594 U.S. at 432 (quoting Milkovich v. Lorain Journal Co., 497 U.S.

1, 13 (1990)) (citing Restatement (First) of Torts § 559 (A.L.I. 1938)). “Any act whereby the

defamatory matter is intentionally or negligently communicated to a third person is a publication.”

Restatement (First) of Torts § 577 cmt. a (A.L.I. 1938). Thus, when a plaintiff is “injured by [the]

dissemination of allegedly inaccurate information” to a third party—that injury “bears a close

relationship to the common-law tort of defamation” and constitutes an Article III injury. Ranjan v.

U.S. DHS, 747 F. Supp. 3d 192, 199–200 (D.D.C. 2024). As another judge in this District has

explained:

To understand this [harm], it is useful to begin with the Supreme Court’s decision

in TransUnion. The plaintiff class sued TransUnion, a credit reporting agency,

arguing that it had “failed to use reasonable procedures to ensure the accuracy of

their credit files.” 594 U.S. at 417. For about 1,800 class members, TransUnion had

disseminated misleading credit reports to businesses, “label[ing] the class members

as potential terrorists, drug traffickers, or serious criminals.” Id. at 432. The Court

analogized that injury to the tort of defamation . . . [where] “a person is injured

when a defamatory statement ‘that would subject him to hatred, contempt, or

30a

ridicule’ is published to a third party.” Id. (quoting [Milkovich, 497 U.S. at 13]).

Because those class members had “suffered a harm with a ‘close relationship’ to

the harm associated with the tort of defamation,” the Court had “no trouble

concluding” that they had experienced a concrete harm sufficient to confer

standing. Id. . . . [But] the Court held that the roughly 6,000 [other] class members

whose inaccurate reports had never been disseminated could not satisfy the

concrete-harm requirement. Id. at 434–35[.]

Ranjan, 747 F. Supp. 3d at 199–200.

Similarly, here, the undisputed record shows that the Plaintiffs’ members have been injured

by “dissemination of . . . inaccurate information” falsely indicating that they are non-citizens. Id.

at 199. Such publication is defamatory not only because it resulted in the revocation or threatened

revocation of their voter registrations but because it carries an implication that those members are

“serious criminals.” TransUnion, 594 U.S. at 432; see 18 U.S.C. § 611 (criminalizing non-citizen

voting); id. § 1015 (criminalizing voter registration by non-citizens); Press Release, Tex. Sec’y of

State, Texas Completes Citizenship Verifications in the SAVE Database (Oct. 20, 2025),

https://www.sos.state.tx.us/about/newsreleases/2025/102025.shtml

[https://perma.cc/9WZ2-

XVDA] (stating that “individuals who are deemed non-citizens” under SAVE and “that voted in a

Texas election will be referred to the Office of the Attorney General” of Texas for investigation).

Undoubtedly then, the Plaintiffs have suffered injuries with “a sufficiently close relationship to the

harm[s] from . . . false and defamatory statement[s].” TransUnion, 594 U.S. at 433.

The Defendants’ arguments to the contrary border on the absurd. The Defendants argue

that “a former non-citizen being described as a current non-citizen—even if mistakenly and

inaccurately, after naturalization—does not come close to” defamation and “is nothing like being

labeled a ‘potential terrorist.’” Fed. Defs.’ Mot. 22; see also Texas Mot. 15. The Defendants’ view

on the importance of citizenship bears little resemblance to reality. See Schneiderman v. United

States, 320 U.S. 118, 122 (1943) (“[I]t is safe to assert that nowhere in the world today is the right

of citizenship of greater worth to an individual than it is in this country. It would be difficult to

31a

exaggerate its value and importance. By many it is regarded as the highest hope of civilized men.”);

Kennedy v. Mendoza-Martinez, 372 U.S. 144, 159 (1963) (“Citizenship is a most precious right.”);

Fedorenko v. United States, 449 U.S. 490, 506–07 (1981) (citizenship is a “priceless treasure”

(quoting Johnson v. Eisentrager, 339 U.S. 763, 791 (1950) (Black, J., dissenting))). As evidenced

by the actions taken by state authorities in this case, even the mere suggestion of non-citizenship

can cause grievous consequences. See Klapprott v. United States, 335 U.S. 601, 616 (1949)

(Rutledge, J., concurring in judgment) (“To take away a man’s citizenship deprives him of a right

no less precious than life or liberty, indeed of one which today comprehends those rights and

almost all others.”). This remains as true for a naturalized citizen as any other. See Luria v. United

States, 231 U.S. 9, 22 (1913) (“Under our Constitution, a naturalized citizen stands on an equal

footing with the native citizen in all respects, save that of eligibility to the Presidency.”). Suffice

it to say that in the context of voting—where citizenship status can distinguish an engaged voter

from a criminal—accusing a registered voter of being a non-citizen counts as, at the very least, “a

lesser form” of defamation. Pileggi, 146 F.4th at 1227.

Having found that the Plaintiffs have suffered privacy and reputational injuries, the

remaining standing inquiries are easily satisfied. The Defendants do not contest that those injuries

are the result of the SAVE modified system, and a favorable decision by this Court would

undoubtedly redress those injuries.

Voter Injuries

The Plaintiffs next argue that they have suffered cognizable Article III voter injuries that

can alternatively provide standing for all their claims. Pls.’ Mot. 16. The Court agrees.

32a

It goes without saying that voting is “a process ‘of the most fundamental significance under

our constitutional structure.’” Bost v. Ill. State Bd. of Elections, 607 U.S. 71, 77 (2026) (quoting

Ill. Bd. of Elections v. Socialist Workers Party, 440 U.S. 173, 184 (1979)). Thus, “[t]here is no

doubt that the right to vote is a legally protected interest” cognizable under Article III of the

Constitution. Am. Encore v. Fontes, 152 F.4th 1097, 1111 (9th Cir. 2025). And “[a] plaintiff need

not have the franchise wholly denied to suffer injury” to this concrete interest. Charles H. Wesley

Educ. Found., Inc. v. Cox, 408 F.3d 1349, 1352 (11th Cir. 2005). Voters are injured when “they

[a]re wrongly identified as non-citizens” and their franchise is burdened as a result. Arcia v. Fla.

Sec’y of State, 772 F.3d 1335, 1341 (11th Cir. 2014). Even an “increased risk” of

disenfranchisement can make an injury “sufficiently ‘imminent’ for standing purposes.”

Richardson v. Trump, 496 F. Supp. 3d 165, 179 (D.D.C. 2020) (quoting Attias v. Carefirst, Inc.,

865 F.3d 620, 627 (D.C. Cir. 2017)). For instance, in a challenge to an Arizona law requiring the

use of SAVE, the Ninth Circuit found that naturalized voters had standing based on evidence that

“SAVE may not” have up-to-date “naturalization records,” and the resulting “danger” that

“properly registered voters, who in fact are citizens, may have their voter registrations cancelled[,]

. . . losing their constitutional right to vote.” Mi Familia Vota v. Fontes, 129 F.4th 691, 708–09

(9th Cir. 2025). And the Eleventh Circuit similarly held that naturalized voters had “standing to

prospectively challenge” Florida’s “attempt to remove non-citizens from the voter rolls using the

SAVE database” based on “potential errors that could occur when the Secretary attempted to

confirm their immigration status in various state and federal databases.” Arcia, 772 F.3d at 1341.

Here, as the Federal Defendants admit, the “Plaintiffs have found four people who were

apparently asked to confirm their citizenship to Texas officials.” Fed. Defs.’ Mot. 24 (citing Nel

Decl.; A. Doe Decl.; B. Doe Decl.; C. Doe Decl.). Sworn declarations from those individuals

33a

establish that they were naturalized citizens with inaccurate SSA records; that Texas threatened to

revoke their voter registrations because of information obtained through the modified SAVE

system; and that they were required to confirm their citizenship to maintain their voter

registrations. See, e.g., Nel Decl. ¶¶ 19–21, 24–26, 34 & Exs. 1, 2; A. Doe Decl. ¶¶ 11–14 & Ex. 1;

B. Doe Decl. ¶¶ 11–17, 21–22, 24–28, 30–31, 39; C. Doe Decl. ¶¶ 12–14, 18 & Ex. 1. Two

members had to provide proof of citizenship to maintain their registered voter status. A. Doe Decl.

¶¶ 11–14; C. Doe Decl. ¶¶ 12–14, 18. One member had her voter registration revoked without her

knowledge and was asked to submit new documentation to restore her registration. B. Doe Decl.

¶¶ 11–17, 21–22, 24–27, 30–31. And two members’ voter registrations remained revoked at the

time that they filed their declarations in this case. Nel Decl. ¶¶ 19–26; B. Doe Decl. ¶¶ 30–31. The

Defendants have neither disputed this sworn testimony nor challenged their introduction. See Fed.

R. Civ. P. 56(c) (requiring a party opposing summary judgment to point to a contrary portion of

the record, assert the presence of a dispute, or argue evidence is inadmissible in order to show a

genuine dispute of material fact).6 On this record, the Plaintiffs’ voter injuries are sufficient to

confer standing.

The Defendants’ arguments do not alter this conclusion. First, the Defendants ask this

Court to “infer[] . . . that, after denial of their preliminary-injunction motion,” the “Plaintiffs went

searching for affected individuals, found a few, and signed them up for membership.” Fed. Defs.’

Mot. 13. If the Defendants are arguing that the Plaintiff organizations engaged in improper

solicitation, they cite no record evidence whatsoever to support that claim. And they never asked

Although Rule 56 operates differently with respect to a court’s review of an administrative

record, Rule 56(c), alongside that rule’s other provisions, governs the consideration of declarations

in support of standing at the summary judgment posture, even in APA cases. See, e.g., Teva

Pharms. USA, Inc. v. U.S. FDA, 514 F. Supp. 3d 66, 89 n.3 (D.D.C. 2020).

34a

this Court for discovery on this issue. See Fed. Defs.’ Mot. 13 n.6 (noting that the Federal

Defendants requested this information, did not receive it, but never raised the issue before the

Court); Fed. R. Civ. P. 56(e)(2) (permitting the Court to “consider [a] fact undisputed” if the

opposing party fails to properly address it). Regardless, the Court can think of no reason why this

is relevant to the standing inquiry, and the Defendants certainly do not explain why.

Next, the Defendants characterize the voting-related injury suffered by the member whose

voter registration was cancelled because of the modified SAVE as a “past injury.” Fed. Defs.’

Mot. 24; Texas Mot. 12. They are wrong. This member was facing “continuing, present adverse

effects” when the Plaintiffs filed this lawsuit by virtue of her voter registration being cancelled—

which is more than enough to satisfy Article III. O’Shea v. Littleton, 414 U.S. 488, 495–96 (1974).

And nothing in the record suggests that this injury has been redressed. Nel Decl. ¶ 26.

Relatedly, the Federal Defendants suggest that no Article III injury exists because the

identified members “hav[e] now had the opportunity to correct their records” and have not claimed

“any paperwork issues” preventing them from doing so. Fed. Defs.’ Mot. 24–25; Fed. Defs.’

Reply 10. But it is well established that the need to take “affirmative steps to avoid the risk of

harm” is itself an Article III injury. Meese v. Keene, 481 U.S. 465, 475 (1987). And the “disruption

of daily activities” to correct one’s citizenship information to vote is an injury-in-fact under

Article III. Env’t Def. Fund v. FERC, 2 F.4th 953, 971 (D.C. Cir. 2021) (quoting Sierra Club v.

FERC, 867 F.3d 1357, 1366 (D.C. Cir. 2017)); B. Doe Dec.; ¶¶ 19–23 (describing various phone

calls with Texas election officials to determine why their voter registration was cancelled and how

to fix it). The same is true of the pocket-book injury of “even a small amount of money,” such as

the cost of printing, postage, and obtaining an envelope to correct one’s voter registration.

Czyzewski v. Jevic Holding Corp., 580 U.S. 451, 464 (2017); see also Mack v. Resurgent Cap.

35a

Servs., L.P., 70 F.4th 395, 405–07 (7th Cir. 2023) (holding that the time, effort, and money for

postage that a consumer spent responding to improper debt collector communication constituted a

concrete injury); Ebaugh v. Medicredit, Inc., No. 24-1838, 2025 WL 1088077, at *1 (8th Cir. Apr.

11, 2025) (same); See B. Doe Decl. ¶ 23 (resubmitting voter registration forms was necessary when

their voter registration was cancelled due to SAVE).

In any event, “past wrongs may serve as evidence” of “a real and immediate threat of

repeated injury” as well. Jibril v. Mayorkas, 20 F.4th 804, 814 (D.C. Cir. 2021) (cleaned up)

(quoting N.B. ex rel. Peacock v. District of Columbia, 682 F.3d 77, 84 (D.C. Cir. 2012)). That risk

is particularly pronounced on this record. The Plaintiffs have produced affidavits from individuals

whose citizenship status in SSA records is incorrect and who live in states that have agreements

with the Federal Defendants to use the modified SAVE to purge voter rolls. J. Doe 4 Decl. ¶¶ 8–12;

J. Doe 6 Decl. ¶¶ 5, 14–15. The administrative record shows that DHS “assumes the accuracy of

the Social Security Administration data” in its operation of SAVE, and thus, the system runs the

risk of “incomplete or false results” when individuals with inaccurate SSA data are run through it.

DHS AR 260; DHS AR 302; see also DHS AR 760 n.2. Indeed, the State of Texas does not

dispute that an independent investigation in Travis County, Texas, found that “twenty-five percent

of the non-citizen matches” in that county were individuals who had already proven citizenship in

the United States. Texas Mot. 17 (quoting Am. Compl. ¶¶ 141–42). The administrative record also

shows that, pursuant to its template agreement, DHS requires SAVE users to “contact the registrant

or registered voter to obtain proof of U.S. citizenship” “in all cases where the User Agency receives

any SAVE response other than that of U.S. citizen.” DHS AR 762. Thus, the Plaintiffs have shown

that their members will necessarily need to take “affirmative steps to avoid the risk of harm” that

accompanies being labeled a potentially ineligible voter should the modified SAVE system

36a

continue to operate. Meese, 481 U.S. at 475. This is sufficient to demonstrate an Article III injury.

See Mi Familia Vota, 129 F.4th at 708–09; Arcia, 772 F.3d at 1341; League of Women Voters of

the U.S. v. Newby, 838 F.3d 1, 8 (D.C. Cir. 2016) (holding that the “experience of the Kansas

League” showed it was “almost certain that similar obstacles to registration will spring up in

Alabama and Georgia when those States decide to enforce their [proof-of-citizenship] laws”).

The Defendants make much of the fact that only a small proportion of the U.S. electorate

are naturalized voters with potentially inaccurate citizenship data in SSA records. This is a red

herring. The fact that only a “tiny number” of people are impacted by unlawful activity does not

mean that an Article III injury is not present. Contra Texas Mot. 16. Members of the Plaintiff

organizations are among those people—they live in States that have agreed to use SAVE data to

purge voter rolls and their SSA citizenship data is out of date. J. Doe 4 Decl. ¶¶ 8–12; Doe 6 Decl.

¶¶ 5, 15. The rule is not that an injury must be a generally shared grievance for it to be brought in

federal court. Rather, to sustain an action, an organization need only show that “one of its

members” suffered a particularized harm. Institutional S’holder Servs., 142 F.4th at 764 (quoting

Wash. All. of Tech. Workers, 50 F.4th at 175). And in this context, “even one disenfranchised

voter” is one “too many.” League of Women Voters of N.C. v. North Carolina, 769 F.3d 224, 244

(4th Cir. 2014).

Having established cognizable voter injuries, the Court turns to causation and

redressability. The Federal Defendants contend that the Plaintiffs’ voter injuries are caused by “the

independent action of some third party not before the court”—namely, states such as Texas. Fed.

Defs.’ Mot. 25–26 (citation omitted). Before addressing the Federal Defendants’ argument head

on, the Court notes that Texas is now a Defendant in this case. And “[w]hen a party intervenes, it

becomes a full participant in the lawsuit and is treated just as if it were an original party”—the

37a

Court’s decision constitutes a “complete adjudication” on the merits and “the possibility that the

plaintiff will be able to obtain relief against the intervenor-defendant is part of the price paid for

intervention.” Schneider v. Dumbarton Devs., Inc., 767 F.2d 1007, 1017 (D.C. Cir. 1985) (first

quoting United States v. Oregon, 657 F.2d 1009, 1014 (8th Cir. 1981); and then quoting District

of Columbia v. MSPB, 762 F.2d 129, 132 (D.C. Cir. 1985)); see also Food & Water Watch v. U.S.

EPA, 5 F. Supp. 3d 62, 67 n.1 (D.D.C. 2013); Donovan v. Oil, Chem., & Atomic Workers Int’l

Union & Its Loc. 4-23, 718 F.2d 1341, 1350–51 (5th Cir. 1983); United States v. Jim, 891 F.3d

1242, 1252–53 (11th Cir. 2018).

Nevertheless, the Federal Defendants’ argument about third parties does not change the

result. As the Federal Defendants recognize, Article III “requires no more than de facto causality.”

Dep’t of Com. v. New York, 588 U.S. 752, 768 (2019) (quoting Block v. Meese, 793 F.2d 1303,

1309 (D.C. Cir. 1986) (Scalia, J.)); Fed. Defs.’ Mot. 26–27. A plaintiff has standing to sue the

federal government if “‘third parties will likely react’ to the government[’s] [action] (or judicial

relief) ‘in predictable ways’ that will likely cause (or redress) the plaintiff’s injury.” Diamond Alt.

Energy, LLC v. EPA, 606 U.S. 100, 112 (2025) (quoting Alliance for Hippocratic Medicine, 602

U.S. 367, 383 (2024)). The Defendants argue that states are the true cause of the Plaintiffs’ injuries

because “[n]o voter is cancelled from the rolls based solely on a SAVE response”; rather, Texas

engages in “additional verification” before cancelling voter registration. Texas Mot. 17; see also

Fed. Defs.’ Mot 26–27. But as explained above, that additional verification is itself an Article III

injury. And the undisputed record shows that the Plaintiffs’ members suffer that injury because

“SAVE records show that [they] are not . . . United States citizen[s].” B. Doe Decl., Ex. 2. It is

hardly surprising that additional voter verification and potential voter disenfranchisement is “the

predictable effect of” the federal government incorrectly informing a state that an individual may

38a

be ineligible to vote. Hawkins v. Haaland, 991 F.3d 216, 225 (D.C. Cir. 2021) (quoting New York,

588 U.S. at 768).

Furthermore, this injury “is likely to be redressed by a favorable judicial decision.”

Students for Fair Admissions, 600 U.S. at 199 (quoting Spokeo, 578 U.S. at 338). Reverting SAVE

to its prior functionality before the recent changes—without the inaccurate SSA data labeling the

Plaintiffs’ members as non-citizens—would likely redress the Plaintiffs’ harms. Their future harms

from “potential errors” would certainly be redressed. Arcia, 772 F.3d at 1341; see also Mi Familia

Vota, 129 F.4th at 708–09.

Procedural Injuries

Finally, the Parties seem to dispute whether the Plaintiffs have standing to pursue their

procedural claims under the Privacy Act and the APA as well. See Pls.’ Mot. 22–25; Fed. Defs.’

Mot. 11–32; Texas Mot. 12–21. The Court finds that these injuries, too, are sufficient to support

standing.

Again, to demonstrate standing, a plaintiff must show: (1) that she suffered an “injury in

fact” that is concrete, particularized, and imminent, (2) that there is a fairly traceable “causal

connection between the injury and the conduct complained of,” and (3) that it is “likely” rather

than “speculative” that “the injury will be redressed by a favorable decision.” Dep’t of Educ. v.

Brown, 600 U.S. 551, 561 (2023) (quoting Lujan, 504 U.S. at 560–61). But for a procedural injury,

“courts relax—while not wholly eliminating—the issues of imminence and redressability[.]” Ctr.

for L. & Educ. v. Dep’t of Educ., 396 F.3d 1152, 1157 (D.C. Cir. 2005); see Brown, 600 U.S.

at 561. A plaintiff need only show “some concrete interest that is affected by the deprivation.”

Brown, 600 U.S. at 562 (quoting Summers v. Earth Island Inst., 555 U.S. 488, 496–97 (2009)). A

plaintiff need not demonstrate that observing proper procedure “would have led to (caused) a

39a

different substantive outcome.” Id. at 565–66. Rather, the question is whether an agency’s

“substantive decisions” have any “causal relationship” to the interests that the plaintiff seeks to

vindicate. Id. at 566.

For instance, “a plaintiff with concrete plans to observe nature in a particular area ‘would

be harmed if [a] [land-management project] went forward without incorporation of the ideas he

would have suggested’ in his comments.” Id. (second alteration in original) (quoting Summers,

555 U.S. at 494). This is true even if it is “uncertain whether public comment would alter [that]

particular land-management decision[.]” Id. “A person ‘living adjacent to the site for proposed

construction of a federally licensed dam’” similarly “has standing to challenge the licensing

agency’s failure to prepare an environmental impact statement, even though he cannot establish

with any certainty that the statement will cause the license to be withheld or altered.” Id. at 561

(quoting Lujan, 504 U.S. at 572 n.7). “In th[ese] context[s], the fact that the defendant might well

come to the same decision[s] after abiding by the contested procedural requirement does not

deprive a plaintiff of standing.” Id. at 561–62. On the other hand, a plaintiff cannot bring a

procedural challenge to an agency action that bears no relationship to the “substantive decisions”

made by that agency. Id. at 566. For instance, a plaintiff whose application for a statutory benefit

was denied cannot challenge an agency’s procedure in deciding “to give other people [that benefit]

under a different statutory scheme.” Id. at 565 (emphasis omitted). That plaintiff’s injury—denial

of the statutory benefit—cannot be “traced” because the agency’s procedures governed a different

kind of benefit altogether. Id. at 567 (quoting Simon v. Eastern Ky. Welfare Rights Org., 426 U.S.

26, 42–43 (1976)). The question is whether the “procedural right” a plaintiff seeks to vindicate has

any bearing on the “protect[ion]” of the “concrete interest[s]” of that plaintiff. Ctr. for L. & Educ.,

396 F.3d at 1157 (emphasis omitted).

40a

Here, as discussed, the Plaintiffs’ “legally protect[able] interest[s]” in privacy and voting

have been put at risk by the Federal Defendants’ failure to comply with the procedural

requirements of the Privacy Act and the APA. See Fontes, 152 F.4th at 1111. And the Federal

Defendants’ failure to follow these procedures deprived the Plaintiffs of the “adequate safeguards

. . . to prevent misuse of [their] information” that the law provides. Privacy Act of 1974 § 2(b)(1),

(4), 88 Stat. at 1896. Without these safeguards, the Plaintiffs were subject to nonconsensual

disclosure of their private information to DHS and SAVE users and the voter injuries that resulted

from inaccuracies in that data—the types of harms that these procedures were designed to remedy.

Undoubtedly then, the Plaintiffs have also shown that they have met the relaxed standard for

procedural standing based on the threat to their privacy and voting interests.

In sum, the Plaintiffs have unlocked three doors to show concrete injuries suffered by their

members. And with causation and redressability, they have sufficiently met their burden of

establishing Article III standing.

Final Agency Action

Moving to the next threshold argument, the Defendants contend that the establishment of

the modified SAVE system outlined in the DHS and SSA SORNs does not constitute a final agency

action reviewable under the APA. Texas Mot. 21–23; Fed. Defs.’ Mot. 36–38. This does not pass

muster.

The APA only permits review of “final agency action.” 5 U.S.C. § 704. An agency action

is final if it is (1) “the consummation of the agency’s decision-making process,” and (2) an action

“by which rights or obligations have been determined, or from which legal consequences will

flow.” Rhea Lana, Inc. v. Dep’t of Lab., 824 F.3d 1023, 1026 (D.C. Cir. 2016) (quoting Bennett v.

41a

Spear, 520 U.S. 154, 177–78 (1997)). But whether rights or obligations have been determined or

“‘legal consequences will flow’ from an agency action is a ‘pragmatic’ inquiry.” Ipsen

Biopharmaceuticals, Inc. v. Azar, 943 F.3d 953, 956 (D.C. Cir. 2019) (quoting U.S. Army Corps

of Eng’rs v. Hawkes Co., 578 U.S. 590, 599 (2016)). Courts focus on the “concrete consequences”

of the “agency action” at issue. Cal. Cmtys. Against Toxics v. EPA, 934 F.3d 627, 637 (D.C. Cir.

2019).

The D.C. Circuit has long recognized that establishing “a policy of disclosing confidential

information without notice” constitutes a final agency action—observing that “permitting [federal]

employees to disclose confidential information without notice is surely a ‘consummation of the

agency’s decisionmaking process.’” Venetian Casino Resort, L.L.C. v. EEOC, 530 F.3d 925, 931

(D.C. Cir. 2008) (quoting Bennett, 520 U.S. at 177–78). After all, such a policy both determines

“the submitter’s rights” over the information handed over “and the agency’s obligations” on how

to handle that information. Id. (cleaned up). This is the exact result of the establishment of the

SAVE “modified system” outlined in the 2025 SORNs. Notice of a Modified System of Records,

90 Fed. Reg. at 48,948 (DHS AR 114); see also Notice of a Modified System of Records, 90 Fed.

Reg. at 50,879–84 (SSA AR 206–11). Those SORNs—which “illuminate[] the nature of the

policy”—reflect that establishing the modified system constituted the adoption of “a policy of

disclosing confidential information without notice.” Venetian Casino, 530 F.3d at 931. Thus,

establishing the SAVE modified system of records, as it is described in the 2025 SORNs, is a final

agency action.

In addition, the Plaintiffs challenge the SORNs themselves, which also count as final

agency action. See Pls.’ Reply 23.The SORNs permitted new “routine use[s] of the records

contained in the system[]” that they described and laid out “the policies and practices of the agency

42a

regarding storage, retrievability, access controls, retention, and disposal of the records.” 5 U.S.C.

§ 552a(e)(4)(D)–(E); see Notice of a Modified System of Records, 90 Fed. Reg. at 48,948–49

(DHS AR 114–15); Notice of a Modified System of Records, 90 Fed. Reg. at 50,880

(SSA AR 207).7

The Defendants try to argue otherwise by relying on the D.C. Circuit’s decision in Centro

de Trabajadores U

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.