Defending State Data: Lessons from California v. USDA
Federal efforts to access sensitive state data, which has historically been held and safeguarded at the state level, have accelerated over the last few decades and dramatically increased over the last year and a half. The White House issued two executive orders that directed federal agencies to collect administrative data, leading to several agencies seeking personal data they historically have not had access to. Administrative data is information collected by federal, state, local, tribal, or territorial governments used to administer programs and deliver services and benefits. Administrative data can include sensitive, personal information that spans a variety of aspects of someone’s identity and life. Information held by public agencies is often more sensitive than what private companies have access to.
This brief focuses on one of these requests for state data: the U.S. Department of Agriculture’s (USDA) attempts to access personally identifiable information about Supplemental Nutrition Assistance Program (SNAP) recipients, and analyzes important lessons learned from the ensuing litigation that states should apply to pending and new requests for personal data of their constituents.
History
This was not the federal government’s first attempt to access administrative data. Under George W. Bush and continuing through much of the Obama administration, for example, U.S. Immigration and Customs Enforcement (ICE) sought biometric information like fingerprints from states and cities to aid in immigration enforcement. Such attempts continued under the first Trump administration, including:
seeking voter registration data from every state under the Presidential Election Integrity (Pence-Kobach) Commission, and
issuing an executive order that directed the U.S. Department of Commerce to seek state administrative records concerning citizenship in connection with the census.
This timeline follows one of the federal government’s most recent attempts to demand access to state administrative data:
February 19, 2025 — White House issues executive order: “Ending Taxpayer Subsidization of Open Borders,” directing federal agencies to tighten enforcement of existing restrictions on public benefits for undocumented immigrants and review federal payments to states in service of the same.
March 20, 2025 — White House issues executive order: “Stopping Waste, Fraud, and Abuse by Eliminating Information Silos,” directing federal agency heads to ensure that the federal government has unfettered access to comprehensive data from all State programs that receive Federal funding, including, as appropriate, data generated by those programs but maintained in third-party databases.
May 6, 2025 — The USDA sent a letter to all states demanding access to a host of sensitive information about beneficiaries including names, Social Security numbers, and addresses. In the same letter, USDA specified it was already taking steps to seek this information directly from SNAP payment processors.
May 13, 2025 — CDT joined Protect Democracy and the Electronic Privacy Information Center (EPIC) in calling on the private payment processors of SNAP payments to refuse the federal government’s unprecedented request for state program data.
May 22, 2025 — Protect Democracy, Student Legal Defense Network, EPIC, and the National Center for Law and Economic Justice filed a lawsuit challenging USDA’s requests under federal privacy statutes (Pallek v. Rollins).
May 30, 2025 — USDA acknowledged in a declaration that it needed to comply with the procedures required by these statutes prior to initiating the data collection, and then published a related System of Record Notice (SORN) to this effect on June 23, 2025.
July 9, 2025 — USDA reissued its request for state data in a demand letter sent to states with a deadline of July 30, 2025.
As it stands, at least 27 states have voluntarily turned over personal data about SNAP recipients to the USDA.
Core Legal Claims in California vs. USDA
On July 28, 2025, more than 20 states filed suit against the USDA, challenging its unprecedented demand for sensitive and personal information about state SNAP beneficiaries. On October 15, 2025, the Northern District of California granted a preliminary injunction to enjoin the USDA from withholding or disallowing SNAP funding based on the states’ failure to comply with its demands for SNAP beneficiary data. The core legal claims cited in the preliminary injunction involve three primary elements: (1) state sovereignty; (2) SNAP statutory authorizing language; and (3) the public interest.
State Sovereignty – While federal law is supreme, the federal government cannot commandeer state legislatures or impose regulations that threaten a state’s ability to exercise the self-governing power reserved by the Tenth Amendment.
State disaster response laws – States argued that the administration’s request would have a chilling effect and render states incapable of complying with and upholding responsibilities under state disaster response laws. “Disaster SNAP provides short-term food benefits and supplements to certain natural disaster victims. If Plaintiff States cannot assure disaster victims of the safety and confidentiality of their private information, they will not be able to maximize victims’ timely, adequate, and safe access to all applicable benefits during a disaster, as required by state law.” (Cal. Welf. & Inst. Code § 18917(e), N.J. Admin. Code § 10:87-9.8, Or. Admin. R. §§ 461-135-0491– 461-135- 0497, Wash. Rev. Code § 74.04.660)
SNAP Statutory Authorizing Language – SNAP as a program was established by Congress through the Food and Nutrition Act, specifically 7 U.S.C. § 2020. The language in this section governs how SNAP is to be administered by the states.
Regarding statutory language, the primary issues that contributed to the decision to grant an injunction are:
“May” vs. “shall” in enumerated exceptions
Who the data was collected from
Intended data use for non-program administration purposes
Section 2020(e) provides that “each State agency shall have a “plan of operation” that shall provide, inter alia, safeguards which prohibit the use or disclosure of information obtained from applicant households except that― (A) the safeguards shall permit— (i) the disclosure of such information to persons directly connected with the administration or enforcement of the provisions of this chapter, regulations issued pursuant to this chapter, Federal assistance programs, or federally-assisted State programs; and (ii) the subsequent use of the information by persons described in clause (i) only for such administration or enforcement.”
“Shall permit” vs. other exception language – The judge discussed that in other subsections of the SNAP Act, Congress intentionally used clear mandatory language. For example, in the “Records” section: “shall . . . be made available for inspection & audit.” The court points out that there are six exceptions in the Act, where Congress used the phrases “shall be made available” and “the safeguards shall not prevent” but did not use this same phrase in the exception the government relies on [(e)(8)(A)]. Instead, Congress used more permissive language, which reads “the safeguards shall permit” the disclosures.
Congressional intent – it is generally presumed that if Congress uses particular language in one section but omits it in another, the omission is intentional. Taking this in context, the Court used this to find the Plaintiffs are likely to succeed on the merits.
Information not obtained from applicant households
§ 2020(e)(8) pertains specifically to “the use or disclosure of information obtained from applicant households” — the court discusses that much of the information requested by the government under the (e)(8)(A) exception is beyond the scope of (e)(8), being that transactional records, SNAP usage, retailer data, and records to calculate total dollar value of SNAP benefits received over time are not records that are obtained directly from applicants.
Intent to use for non-program administration purposes
The court acknowledged that the USDA had publicly asserted its intent to use the requested information in ways that are out of (e)(8)(A)’s scope — specifically, in the SORN USDA filed, it asserted the right to disclose the information to entities that are not assistance programs, and for purposes other than the administration or enforcement of the program. As such, the states would be disclosing information knowing it will be used for purposes outside those permitted by statute, and the court finds they will likely succeed on the merits that USDA’s actions are contrary to law.
The Public Interest
The court was not persuaded by USDA’s arguments that a preliminary injunction is against the public interest, and stated that changing the status quo (USDA’s right to inspect under agreed protocols) was not warranted under these points. USDA attempted to justify the need for the data by providing a “preliminary snapshot review” of the SNAP data they had voluntarily received from non-plaintiff states, but it was unclear how the “observations” presented related to the states at issue in this case.
Lessons Learned
This litigation highlights the importance of taking a holistic approach when evaluating federal requests for state-held administrative data.
While privacy and confidentiality statutes are often the most obvious sources of legal protection, they are rarely the only state laws implicated by large-scale data sharing demands.
States should carefully review the full range of laws that govern the administration of public benefits and services, including beneficiary rights provisions, due process protections, anti-discrimination obligations, and agency-specific confidentiality mandates. As California v. USDA demonstrates, these laws can provide independent legal grounds for challenging federal actions that would interfere with a state’s ability to administer programs consistent with state law.
This case also underscores the value of closely examining the authorizing statutory language underlying a federal agency’s request. Federal agencies may point to broad statutory provisions as justification for access to state-held data, but the precise language chosen by Congress matters. Here, the court focused on the distinction between permissive and mandatory statutory language, finding that Congress’s use of the phrase “shall permit” did not impose an affirmative obligation on states to disclose information upon demand. Careful statutory analysis can reveal meaningful limitations on agency authority, particularly when read in the context of the statute as a whole and compared to other provisions where Congress used more explicit disclosure requirements.
There has also been little to no accountability to ensure the federal government reviews and seriously considers SORN comments. Agencies appear to treat the comment process as a procedural formality rather than a meaningful opportunity for public input, with indications that not all comments submitted in response to a notice are even reviewed. Even when agencies fail to meaningfully consider them, SORN comments remain important because they create a public record of concerns about federal data collection and use. This apparent disregard for public input, however, underscores the need for meaningful Privacy Act reform that ensures agencies are accountable for actually engaging with the concerns raised through the SORN process.
Finally, the litigation demonstrates the importance of looking beyond whether data sharing is technically permissible and assessing how proposed disclosures may affect program administration and beneficiary trust. States have said that compelled disclosures could undermine participation in SNAP and disaster assistance programs by discouraging eligible individuals from seeking benefits, which could interfere with states’ ability to satisfy their own mandates and provide adequate support to their constituents.
Conclusion
As the federal government increasingly seeks access to state administrative data, policymakers should consider not only legal authority and privacy implications, but also the practical effects on public confidence, program effectiveness, and states’ ability to fulfill their obligations to residents.
The Privacy Paradox: How Government Data Has Become Less Private and Less Useful
Providing ready access to information collected and maintained by the government promotes accountability, innovation, and research, making transparency a core responsibility of serving as a steward of the public’s data. Public agencies must also safeguard sensitive information when making data publicly available.
CDT, EFF, EPIC, and Upturn Submit Comments on GSA’s Updated Draft AI Terms and Conditions for Federal Contracts
Today, the Center for Democracy & Technology and allies submitted comments to the General Services Administration (GSA) in response to the request for comment regarding their updated draft AI Terms and Conditions for federal solicitations and contracts.
Bias at Scale: Understanding AI’s Impact on Student Achievement and Opportunity Gaps
Schools have an opportunity and responsibility to ensure that new technologies support, rather than undermine, their longstanding goal of expanding opportunity.
CDT Submits Comments Urging Careful Approach for Expansion of Do Not Pay System
CDT urges agencies to protect the personal data with which they have been entrusted by applying robust data minimization practices, enacting strong security protocols, limiting redisclosure, and mitigating data quality issues.
