27 States BLOCKED DOJ From Voter Rolls

Ballot paper with pen on wooden surface — Photo: Scott Habermann / Shutterstock

The fight over voter data is not about whether election officials should maintain accurate rolls; it is about who may demand which data, under what legal authority, and with what privacy safeguards—a distinction federal courts have repeatedly enforced against sweeping federal demands while states continue exchanging data through the ERIC consortium for list maintenance.

At a Glance

Federal courts across multiple states rejected the Department of Justice’s efforts to compel unredacted voter files, finding no statutory authority for blanket disclosure and emphasizing privacy constraints.
A nationwide ruling vacated DOJ’s collection policy under the Privacy Act and Paperwork Reduction Act, underscoring that sensitive identifiers are not fair game absent clear authorization.
States simultaneously share voter-registration and motor-vehicle data with ERIC for list maintenance, creating a credibility challenge but not a legal contradiction—contractual purpose and safeguards matter.
The core legal line: the NVRA discloses records about how lists are maintained, not carte blanche to harvest voters’ most sensitive personal data.

What courts actually decided: authority first, privacy always

Across the docket, the federal government argued that federal election statutes entitled it to states’ unredacted voter files—records that can include birth dates, residential addresses, driver’s-license numbers, and partial Social Security numbers. Courts largely disagreed. The Sixth Circuit’s Michigan case and district decisions in Utah, Oregon, and Maryland take different analytic routes but converge on the same destination: no federal law authorizes a demand for complete, unredacted voter files simply because the federal government asks. Utah’s ruling is emblematic—Judge David Barlow explained that Utah’s combined voter-registration and sensitive personal data file was not a record “in the possession” of the official in the sense the federal disclosure provision contemplated, blocking the theory of compelled production.

Two features make these outcomes durable. First, they rest on statutory construction rather than ephemeral facts. Where Congress has not clearly authorized mass disclosure of sensitive identifiers, courts will not infer it. Second, privacy functions as a backstop; judges are not blind to the risk inherent in distributing identifiers that facilitate reidentification and fraud. Maryland’s case rejected DOJ’s authority and underscored the sensitivity of the requested fields; Oregon’s court likewise declined to read federal statutes as a warrant for unredacted lists. A University of Wisconsin tracker captured the broad pattern: dozens of suits filed; the government losing repeatedly on the merits as of late 2026.

The nationwide policy loss: Privacy Act and PRA constraints

The structural defeat for the federal approach came when a court vacated DOJ’s voter-roll collection policy under the Privacy Act and Paperwork Reduction Act. That opinion did three things at once: it held that no statute supported the program’s sweep; it called the policy arbitrary and capricious; and it found violations of both the Privacy Act and the PRA. In practical terms, the court said you cannot collect personally identifiable information from millions of voters at scale without a clear legal basis, transparent purpose, and vetted burden estimates; process and privacy law are not optional formalities, they are gating requirements.

This matters for future efforts. Even a narrower, redacted, or protected-request architecture must satisfy administrative law and privacy baselines. The rulings do not say a federal investigation can never obtain voter data; they say that generalized, statute-light demands for full, unredacted files run headlong into congressionally enacted limits.

NVRA’s line: oversight of list maintenance, not a data harvest

Observers sometimes assume the National Voter Registration Act (NVRA) throws open the door to the underlying voter file. It does not. Section 8 requires public inspection of “all records concerning the implementation” of list-maintenance programs—how the state keeps rolls accurate—without converting that access into wholesale entitlement to voters’ identifiers. Multiple courts, as synthesized by legal analysts and reflected in recent decisions, have rejected readings that would transform an oversight mechanism into a mass data transfer of sensitive fields. The upshot is a stable doctrinal line: transparency about the process, restraint with the personal data it processes.

The ERIC contrast: purpose-built data sharing with contractual limits

Critics seize on an apparent inconsistency: many of the same states rebuffing DOJ transmit voter-registration and motor-vehicle data to the Electronic Registration Information Center (ERIC) on a recurring schedule, often every 60 days. ERIC’s own security materials describe one-way hashing for confidential identifiers and limited disclosure of outputs, with member agreements constraining use to list-maintenance purposes. For state election administrators, that difference in purpose, architecture, and control is the point. ERIC is a cooperative utility built to compare data across states to identify movers, duplicate registrations, and deceased records; its transmissions are structured, standardized, and bound by contract. DOJ’s demand, by contrast, was a top-down legal compulsion for full unredacted files—without the same bespoke, minimized, and bounded workflow.

The critique is not groundless: if states invoke privacy to resist federal law enforcement while transmitting rich datasets elsewhere, they must explain the differential. Some advocacy and congressional materials argue ERIC’s model contracts require broad DMV data and raise Driver’s Privacy Protection Act questions; others contend ERIC’s confidentiality provisions impede public records access under the NVRA. But independent academic descriptions emphasize ERIC’s hashing, limited external disclosures, and member-governed controls; several states left ERIC over transparency and privacy concerns, underscoring that the program itself has been contested and revised over time. The legal bottom line remains: states can authorize a purpose-built, safeguarded exchange by agreement, even while refusing an unbounded federal compulsion lacking clear statutory footing.

Where the real disagreements live

Substance, not slogans, separates the camps. The strongest state arguments focus on statutory authority and scope: absent a clear command from Congress, the federal executive cannot commandeer uniquely sensitive identifiers from state-held files. Courts have repeatedly agreed. The strongest criticism targets coherence: if privacy is the principle, why does it stop at the ERIC border? That challenge gains rhetorical force from regular, rich ERIC feeds, but it weakens when you examine legal differences—contractual purpose, data minimization, security controls, and restricted use—versus an open-ended federal demand. It also matters that the record includes outliers: some states reportedly provided or agreed to provide detailed data to DOJ, and several cases settled or remain on appeal, so this is not an absolute wall but a prevailing rule with exceptions.

Importantly, none of the litigated records assembled here identify an actual privacy breach caused by DOJ’s requested disclosures; the courts did not require a breach to enforce privacy and administrative law constraints. The question was authority and risk, not damage after the fact. That is how preventive privacy law works: it disciplines data collection at the front end, before harm crystallizes.

27 States Win Lawsuits Against DOJ Saying They Would Violate Privacy Rights If They Divulged 'Confidential' Voter Info to US Government – But Same States Give Voter Registration Data to ERIC Every 60 Days! https://t.co/4hxd0up4aQ #gatewaypundit via @gatewaypundit

— Red Snapper (@RRdunnlaw) November 1, 2026

What to watch next: authority, tailoring, and harmonization

Three developments will determine whether this equilibrium holds. First, appeals. A clean appellate endorsement of the statutory and Privacy Act analysis would cement the boundary that states have enforced in district courts; a contrary ruling could carve out tailored federal access. Second, tailoring. A narrower federal request that minimizes fields, adopts encryption and access controls comparable to ERIC, and anchors its purpose to a clear statute could present a different legal and policy case. Third, harmonization. States that remain in ERIC but refuse any federal cooperation will face continued questions about consistency; answering them with field-level comparisons, retention schedules, third-party audit results, and legal analyses would strengthen their position.

The mature position is not absolutist. States can, and should, maintain accurate rolls; the NVRA ensures public oversight of how they do so. When outsiders—federal or private—seek access to the underlying identifiers, the rule set changes: show your authority, narrow your ask, secure the data, and justify the burden. Courts have insisted on that sequence. Until Congress speaks more clearly, that is the controlling logic of voter data in the United States.