All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
The White House’s new executive order directs various federal agencies to consolidate state citizenship lists across all 50 U.S. states.[1] A centralized database of sensitive information might sound like it would make things more convenient for the government.
However, putting huge amounts of personal data in one place also creates a single, highly attractive target for hackers and significantly increases the potential damage from a data breach.
Imagine a nationwide database with details of millions of citizens, such as Social Security numbers, addresses, and dates of birth, all in one place. If it falls into the wrong hands, it could lead to mass phishing scams, identity theft, and financial fraud.
The Electronic Privacy Information Center (EPIC), represented by Protect Democracy and Citizens for Responsibility and Ethics in Washington (CREW), has filed a lawsuit challenging the legality of the Trump administration’s unprecedented directive.
Here’s what could happen if such a database comes to fruition and the steps you can take to protect yourself from the privacy risks it raises.
On March 31, 2026, the White House issued an executive order directing the Department of Homeland Security (DHS), Social Security Administration (SSA), and the State Department to create a state citizenship list of “confirmed” citizens in all 50 states who reside in those states and are entitled to vote in federal elections.
This would include collating and collecting U.S. citizens’ data, such as Social Security numbers, addresses, and citizenship information. This information is currently held by different federal agencies for privacy and data security purposes.
As per a subsequent memo from DHS, states will have only 60 days to cross-reference their voter rolls with the newly compiled state citizenship list.
EPIC, however, has challenged the legality and authority behind such an executive order from the Trump administration, alleging that the state citizenship list contradicts safeguards laid down in the Privacy Act, the Social Security Act, and the Administrative Procedure Act.
A careful reading of the lawsuit reveals certain provisions that the executive order seems to be violating, according to EPIC.
For instance, the Privacy Act states that an agency cannot disclose someone’s records to another agency or to any third party without that person’s written consent, unless one of 12 specific statutory exceptions applies.
The lawsuit highlights that DHS, the SSA, and the State Department are about to share citizenship data, including SSNs, all without individual consent. Further, none of the said 12 exceptions apply in this case.
Additionally, the proposed citizenship list also overlooks the procedural requirement laid down in the Privacy Act. As per the law, an agency must publish a System of Records Notice (SORN) in the Federal Register at least 30 days before putting data to new use, giving the public a chance to comment.
However, the lawsuit alleges that the DHS’s implementation timeline is such that it is virtually impossible to stick to this 30-day prior-notice rule. The portal was supposed to go live 22 days after the internal memo was signed, without any SORN being published in the first place.
“In the United States, we have limits on how government agencies can collect and use sensitive personal data – limits this administration is blatantly ignoring,” said John Davisson, deputy director and director of enforcement at EPIC.
Another major issue with the citizenship list is that DHS is allegedly using the Systematic Alien Verification for Entitlements (SAVE) system for this purpose. SAVE is known to be prone to blatant errors. As per the lawsuit, the error rates could be as high as 81% in some localities.
ProPublica and The Texas Tribune’s own examination of SAVE’s rollout shows that it could make persistent mistakes, particularly in assessing the status of people born outside the U.S. but who later became U.S. citizens.
According to communications between federal officials and the states, DHS had to correct information that was provided to at least five states after the SAVE system misidentified many voters as non-citizens. The same examination shows that at least 87 voters across 29 counties were misreported as non-citizens.
While the Trump administration claims that this exercise has been undertaken so that non-citizens cannot become eligible U.S. voters, The Texas Tribune’s examination of almost 35 million registered voter records showed that only 0.01% of registered voters were identified as non-citizens, which doesn’t seem to be in line with the administration’s claim.
Jules Torti, counsel at Protect Democracy, said: “Without any legal authority to do so, the Trump administration is pressuring states into making rapid changes to their voter rolls based on an error-ridden database on a dangerously compressed timeline.”
The lawsuit also alleges that the SSA is not the custodian of U.S. citizenship records. Citizens provide the SSA with their SSNs to administer Social Security benefits, and not to determine their voter eligibility.
The lawsuit also highlights the privacy risks of such data collection.
Consolidating personally identifiable information such as addresses, dates of birth, Social Security numbers, and citizenship records in a central database creates a lucrative target for threat actors who may try to access these records through unauthorized means.
If such data falls into the hands of a malicious party after a data breach, it could be misused against millions of people to run various kinds of scams.
The consolidation of citizenship records at the federal level is something that ordinary citizens cannot have a say in, at least as of now.
This means you need to be proactive about protecting your digital privacy and focus on measures that can help detect and mitigate the misuse of your data, rather than trying to stop the collection itself.
Our number one piece of advice would be to get an identity theft protection service. These tools scan known data-breach databases as well as the dark web to look for your personally identifiable information.
They alert you if they find any of your data leaked on such forums, allowing you to take action before criminals can use it against you. Many of them also offer professional identity restoration services, which could help you mitigate the damage from such identity breaches.
The Trump administration has directed the consolidation of citizen data, such as SSNs, dates of birth, addresses, and citizenship information, into state citizenship lists to allegedly identify non-U.S. citizens registered as voters.
However, the lawsuit by EPIC alleges that such a directive is beyond the administration’s authority and triggers various privacy and constitutional risks.
Although the matter is now with the court, it’s up to you to take proactive measures to reduce the risk of your information being misused should it become part of a data breach.
Consider using a reliable third-party antivirus program that can flag suspicious links before you interact with them. Furthermore, an identity theft protection service can alert you if your data is exposed, allowing you to take steps to prevent it from being misused.
ID theft protection that monitors your SSN, bank accounts, credit cards, and brokerage and retirement accounts for suspicious activity
Every plan includes the full feature set, so no additional cost to unlock monitoring, insurance, or restoration
Bundles data removal with identity theft protection, antivirus, VPN, and a password manager in one subscription
/images/2023/12/05/aura-vs.-lifelock.png)
/images/2023/06/09/aura-review.png)
/images/2026/09/03/trump-citizen-database-epic-lawsuit_1.png)
/images/2026/09/02/ai-chatbot-conversations-privacy-court.jpeg)
/images/2026/09/01/mckesson-data-breach.jpeg)
/images/2026/08/31/norway-meta-smart-glasses-facial-recognition-ban.jpeg)
/images/2026/08/28/cloaked_vs._deleteme.jpg)
/images/2026/08/28/ring-take-encryption-privacy.jpeg)
/authors/krishi_chowdhary_headshot.jpg){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2023/05/25/logo-aura.png){kind=logo}
/authors/krishi_chowdhary_headshot.jpg)