Deep dive

State Surveillance & Privacy Violations

Documented, state-sanctioned intrusions on privacy — what happened, what authority was claimed, who was affected, and what the courts said.

Last verified October 5, 2026. Status: Documented — Key sources are named in the text with docket numbers, case names, and outlets. Primary-order PDFs are being retrieved from PACER/RECAP and will be linked as they are verified. Where the record is thin or contested, we say so. Browse all sources in the Bibliography.

What this page is

A record of documented, state-sanctioned intrusions on privacy — actions taken by or for the federal government, under claimed legal authority, that exposed Americans' personal data to new collection, sharing, or surveillance. The emphasis is on the second Trump administration (2025–2026), because that is where the documented record is thickest, but the page also covers the legal landscape that made those actions possible.

"State-sanctioned" means: the government did it under a claimed legal authority — an executive order, an agency memorandum, a contract, a statute — and the record shows it. It does not mean "alleged by an anonymous source." If the only evidence is a single anonymous claim, it does not go on this page.

What this page is not

• It is not a list of everything the government could do. Capabilities without documented use stay off.
• It is not a conspiracy file. Where the record is thin, the page says so.
• It does not speculate about motive. It records what happened, what authority was claimed, who was affected, and what courts said.

How to read the status labels

• Alleged — claimed in a filing or complaint, not yet ruled on.
• Documented — established by an official record: a contract, an agency disclosure, a court order, sworn testimony.
• Adjudicated — a court has ruled on the merits (including preliminary injunctions affirmed on appeal).

A lawsuit's claims are alleged. A court order is documented. An affirmed injunction is adjudicated.

1. DOGE access to Treasury payment systems

What happened: In late January 2025, the Treasury Department granted personnel affiliated with the Department of Government Efficiency (DOGE) access to the Bureau of the Fiscal Service — the system that processes federal payments and holds sensitive financial records, including personally identifiable and confidential financial information. Nineteen state attorneys general sued, arguing the access violated the Administrative Procedure Act, separation of powers, and the Take Care Clause.

Authority claimed: The administration argued that politically accountable leadership must be able to supervise executive agencies — in DOJ's framing, "basic democratic accountability requires that every executive agency's work be supervised by politically accountable leadership."

What courts ordered (documented):

• February 2025: U.S. District Judge Paul Engelmayer (S.D.N.Y.) issued a temporary restraining order barring access to Treasury records, payment systems, or data systems containing personally identifiable or confidential financial information, except for career civil servants with a legitimate need.
• February 2025: U.S. District Judge Jeannette Vargas (S.D.N.Y.) granted a preliminary injunction barring Treasury's DOGE team from the covered payment systems.
• Over the following months, Vargas modified the injunction to permit access for personnel who complied with specified vetting, training, hiring, reporting, and mitigation procedures — moving from a broad ban to a regulated framework.

Current legal status: In September 2026, Judge Vargas dismissed the states' access claims as moot. The executive order creating the U.S. DOGE Service Temporary Organization set a termination date of July 4, 2026; Treasury's DOGE team was disbanded and, per the government, no DOGE-affiliated employees retained the challenged access. Vargas also dismissed the states' remaining claims about an automated payment-review system, finding they had not alleged that any specific federal payment owed to them had been frozen or canceled. The dismissal was on mootness grounds — not a ruling that the original access was lawful.

Status: adjudicated (preliminary injunction granted, later narrowed, case dismissed as moot).

Key documents: Vargas dismissal order, Sept. 2026 (S.D.N.Y.); Engelmayer TRO, Feb. 2025; Vargas preliminary injunction, Feb. 2025.

Sources: multiple news reports consistent on the docket history (see e.g. reporting on the Sept. 2026 dismissal); primary orders to be pulled from PACER/RECAP.

2. DOGE access to Social Security Administration records

What happened: DOGE personnel were given access to SSA data systems holding the personal records of essentially every American — including, per the appellate record, family court and school records, mental health and medical records of disability recipients, and bank and earnings information. A coalition led by the American Federation of State, County and Municipal Employees (AFSCME) and the AFL-CIO sued, alleging violations of the Privacy Act of 1974 and the Administrative Procedure Act — including that SSA never issued the required System of Records Notice before granting access.

What courts ordered (documented):

• March 20, 2025: U.S. District Judge Ellen Hollander (D. Md.) issued a temporary restraining order.
• April 17, 2025: Hollander granted a preliminary injunction — DOGE staffers could access only redacted/anonymized data (with training and background checks); DOGE was ordered to purge non-anonymized SSA data obtained since January 20, barred from altering SSA code, and ordered to remove any software it had installed. Acting Commissioner Dudek declined to testify at the hearing about what the DOGE team was doing with the data.
• April 30, 2025: The full Fourth Circuit voted 9–6 to keep the injunction in place pending appeal. Judge Robert King, concurring, noted DOGE's access "exceeded that allowed to all but the few most experienced and trusted SSA employees." The Fourth Circuit later ordered the case heard en banc.

Authority claimed: The government argued the injunction was "an improper effort by a district judge to usurp Article II authority and to micromanage the Executive Branch," and that anonymizing data would be too burdensome and would disrupt anti-fraud work.

Current legal status: The preliminary injunction stands; the full Fourth Circuit agreed to review it en banc. The final outcome is genuinely uncertain as of October 2026 — the en banc decision had not been reported in the sources reviewed.

Status: adjudicated (preliminary injunction granted and upheld 9–6 on stay; merits/en banc review pending).

Key documents: Am. Fed'n of State, Cty., & Mun. Emps. v. Soc. Sec. Admin., 4th Cir. No. 25-1411; Hollander PI order, Apr. 17, 2025 (D. Md.).

Sources: Associated Press reporting on the TRO/PI (Apr. 2025); Fourth Circuit stay decision (Apr. 30, 2025).

3. DOGE access to OPM personnel records

What happened: After the inauguration, OPM gave DOGE affiliates administrative access to personnel databases covering current and former federal workers and job seekers — tens of millions of people's records. Federal unions and employees sued (AFGE v. OPM, S.D.N.Y., filed Feb. 11, 2025), alleging Privacy Act and APA violations. A parallel suit by EPIC and an anonymous federal employee (E.D. Va.) alleged the same disclosures at Treasury and OPM.

What courts ordered (documented):

• June 2025: U.S. District Judge Denise Cote (S.D.N.Y.) granted a preliminary injunction in a 99-page order, finding OPM had shared records with "individuals who had no legal right of access to those records" in violation of the Privacy Act. Cote wrote: "This was a breach of law and of trust. Tens of millions of Americans depend on the Government to safeguard records that reveal their most private and sensitive affairs." She found some DOGE agents "notably young and inexperienced," with no demonstrated need for the data, and that they broke OPM training and cybersecurity protocols.
• April 2026: Cote ordered the government to unredact the names of 16 DOGE workers, rejecting the claim that disclosure would endanger them: "The public interest in disclosure is substantial."
• July 2026: In EPIC v. OPM (E.D. Va.), Judge Rossie Alston Jr. denied the government's motion to dismiss, holding the plaintiffs had standing — expressly relying on the Fourth Circuit's en banc reasoning that disclosing Americans' PII to DOGE staffers inflicts a harm analogous to intrusion upon seclusion.

Current legal status: The Cote preliminary injunction stands; the scope order was still being finalized per mid-2025 reporting. The EPIC case proceeds on the merits. Final outcomes uncertain as of October 2026.

Status: adjudicated (preliminary injunction granted; motion to dismiss denied in the parallel case).

Key documents: Cote PI order, June 2025 (S.D.N.Y., 1:25-cv-01237); Alston MTD denial, July 29, 2026 (E.D. Va., 1:25-cv-00255).

Sources: FedScoop (June 2025); Bloomberg Law (Apr. 2026, July 2026); SC Media (June 2025).

4. DOGE access to IRS systems and the "mega API"

What happened: DOGE sought and obtained access to IRS systems containing taxpayer return information. The Center for Taxpayer Rights sued (Center for Taxpayer Rights v. IRS, 1:25-cv-00457-CKK, D.D.C.), seeking to halt DOGE access and the use of a "mega API" to share IRS return information outside the agency. Acting IRS Commissioner Melanie Krause resigned in protest around the time the data-sharing arrangements were signed.

Current legal status: The complaint's claims about DOGE access remain alleged — the stronger documented record in this docket is the IRS–ICE data-sharing fight (section 5), which grew out of the same period. The case is the vehicle through which courts ordered additional internal DOGE and agency communications produced as discovery.

Status: alleged (complaint claims; discovery ordered).

Key documents: Amended complaint, filed May 16, 2025 (D.D.C., Doc. 20) — downloaded: ~/workspace/your_files/ctr-v-irs-complaint.pdf (58 pp.).

5. IRS–ICE taxpayer data sharing

What happened: On April 7, 2025, Treasury Secretary Scott Bessent and DHS Secretary Kristi Noem signed a memorandum of understanding under which ICE could submit names of people suspected of remaining in the U.S. after final removal orders, and the IRS would cross-check them against tax records and disclose last-known addresses. ICE invoked 8 U.S.C. § 1253(a)(1) (failure to depart after a removal order, a federal crime) to claim the requests fell under the 26 U.S.C. § 6103(i)(2) exception for non-tax criminal investigations. In July 2025, the IRS began processing ICE requests for as many as 1.28 million people — and ICE separately asked for records on more than 7 million. By August 2025, the IRS had turned over 47,289 taxpayer records, over 90% via automated TIN matching that never checked the address ICE supplied. ICE listed the same person as the point of contact on all 1.28 million requests.

What courts ordered (documented):

• November 2025: U.S. District Judge Colleen Kollar-Kotelly (D.D.C.) granted a preliminary injunction sought by the Center for Taxpayer Rights and labor groups, staying the IRS–ICE agreement.
• February 2026: Kollar-Kotelly found the IRS had likely violated § 6103 roughly 42,695 times, calling it "facially implausible" that one ICE assistant director could be "personally and directly engaged" in 1.28 million criminal matters.
• September 8, 2026: the D.C. Circuit unanimously affirmed the injunction (Center for Taxpayer Rights v. IRS, 2026 WL 2635380; opinion by Judge Cornelia Pillard, joined by Judges Millett and Wilkins). The court held the IRS's "Data-Exchange Procedure" "indisputably contravenes" § 6103 — ICE could submit an "address" like a bare five-digit number and still receive a taxpayer's address — and dismissed the government's burden objections as "weak sauce." The court warned the IRS is "now on notice twice over," with "steep civil and criminal consequences for willful disclosure."
• Separately, U.S. District Judge Indira Talwani (D. Mass.) blocked "implementation and/or enforcement" of the MOU in a suit by immigrant-rights community groups.

Authority claimed: The administration framed the requests as criminal investigations under § 1253(a)(1), triggering the § 6103(i)(2) exception. The district court found the record raised an inference that the criminal-investigation framing was pretext for the mass-deportation agenda.

Current legal status: The injunction stands, affirmed on appeal; the underlying case continues on the merits. The agreement's future depends on that litigation.

Status: adjudicated (preliminary injunction affirmed unanimously on appeal).

Key documents: D.C. Circuit opinion, Sept. 8, 2026 (2026 WL 2635380); Kollar-Kotelly PI order, Nov. 2025, and Feb. 2026 memorandum; MOU signed Apr. 7, 2025.

Sources: Reuters (Sept. 8, 2026); Thomson Reuters Tax (Sept. 2026); Congressional Hispanic Caucus press release (Sept. 8, 2026); NILC explainer on the MOU.

6. ImmigrationOS — Palantir's deportation targeting platform

What happened (documented): On April 17, 2025, ICE awarded Palantir Technologies a $30 million sole-source (no-bid) contract to build the "Immigration Lifecycle Operating System" (ImmigrationOS), citing "urgent and compelling" need and Palantir as the "only source" capable of delivering it. A prototype was due September 25, 2025; a $29.9 million follow-on was awarded the same day, funding the system through September 2027. Per ICE's own contract justification document (first reported by Business Insider, covered by Wired), the platform is designed to give ICE "near real-time visibility" on people self-deporting and to prioritize deportation targets, with special emphasis on visa overstays. Reporting based on the contract documents and the American Immigration Council describes the system as fusing data from the IRS, Social Security, passport databases, and license plate readers, built atop ICE's Investigative Case Management platform. In January 2026, Sen. Mark Warner wrote to the DHS Inspector General regarding the contract, describing the underlying system as having access to information "from across the federal government."

Authority claimed: Federal procurement under the "urgent and compelling" / sole-source justification; immigration enforcement under existing DHS authorities and executive orders (ICE cited EO 14159 and EO 13773).

Current legal status: An active, funded federal contract. No court has ruled on the platform itself as of October 2026. Oversight requests (Warner letter to DHS IG) are pending.

Status: documented (contract records and agency justification documents). No adjudication.

Key documents: ICE contract justification for ImmigrationOS (Apr. 2025); Warner letter to DHS IG (Jan. 2026).

Sources: Wired reporting on the contract justification; American Immigration Council analysis; stateofsurveillance.org contract summary.

7. Expanded social media vetting of visa applicants

What happened (documented): The State Department has progressively expanded mandatory "online presence review" for visa applicants, requiring covered applicants to set all social media profiles to public/open before their consular interviews:

• June 2025: F, M, and J visa applicants (students, vocational trainees, exchange visitors). A June 18, 2025 State Department cable directed consular officers to vet applicants for "hostile attitudes toward the citizens, culture, government, institutions, or founding principles of the United States" and for antisemitic harassment and violence. On May 27, 2025, the Department had paused all new student-visa appointments globally to implement the screening.
• December 15, 2025: H-1B and H-4 applicants added.
• March 30, 2026: 14 more categories added (including K, R, S, T, U — covering trafficking and crime victims, among others).
• October 1, 2026: I visas (foreign journalists), TN and TD visas (Canadian/Mexican professionals) added.

Social media identifiers have been collected on visa applications since May 2019; the new policy goes further by requiring the profiles themselves be made accessible for review.

Authority claimed: Consular discretion in visa adjudication; national security and public safety screening. The Department states that "every visa adjudication is a national security decision" and that receiving a visa "remains a privilege granted at the government's discretion, not an entitlement."

Current legal status: Active official policy, announced through State Department cables and public notices. No court has struck it down as of October 2026. (Courts have historically held the government has broad discretion over visa decisions for applicants outside the U.S.)

Status: documented (official policy). No adjudication.

Sources: USA Today (Oct. 1, 2026); State Department cable of June 18, 2025 (as reported by Phillips Lytle); Boundless/Kolko & Casey immigration-law summaries.

8. The lapse of FISA Section 702

What happened (documented): Section 702 of the Foreign Intelligence Surveillance Act — the authority allowing warrantless collection of communications of non-U.S. persons abroad, which incidentally sweeps in Americans' communications that the FBI, NSA, CIA, and NCTC may then query without a warrant — expired on June 12, 2026, the first lapse since the program's creation in 2008. The timeline:

• April 2024: Congress passed the Reforming Intelligence and Securing America Act (RISAA), extending 702 for two years.
• April 20, 2026: that extension expired; Congress passed short-term extensions, the last pushing the deadline to June 12.
• June 5, 2026: Senate cloture on reauthorization failed 47–52.
• June 11, 2026: the House rejected a short-term extension 198–218 (19 Republicans joining nearly all Democrats), after President Trump named FHFA Director Bill Pulte as acting Director of National Intelligence — an appointment Democrats cited as reason to withhold reauthorization. Trump then named former SEC chair Jay Clayton as his permanent DNI nominee; the standoff continued past the deadline.

What the lapse means: No new collection may be authorized under 702. But existing year-long certifications approved by the FISA Court remain valid — reporting indicates collection under existing certifications can continue into 2027 — so the "going dark" framing is disputed. Privacy advocates (ACLU, EFF) have long sought a warrant requirement for FBI queries of Americans' communications incidentally collected under 702; the 2024 RISAA did not include one (a 2024 warrant-requirement amendment failed 212–212).

Current legal status: Lapsed as of June 12, 2026; as of fall 2026, Congress had not restored the authority (it remained on the Senate's unresolved fall agenda). Whether and in what form it returns is genuinely uncertain.

Status: documented (legislative record). Not an expansion of surveillance — a lapse — but included because the reauthorization fight will determine the next expansion or reform.

Sources: Reuters (June 5 and June 12, 2026); AP via SRN News (June 11, 2026); ODNI explainer on § 702; Brennan Center (Mar. 2026).

9. Government purchases of commercial location data — and the Chatrie ruling

What happened (documented):

• At the Senate Intelligence Committee's annual Worldwide Threats hearing in March 2026, FBI Director Kash Patel confirmed the FBI is again buying commercially available location data: "We do purchase commercially available information that's consistent with the Constitution and the laws under the Electronic Communications Privacy Act." DIA leadership confirmed its agency purchases such data as well. (Then-Director Christopher Wray had told Congress in 2023 the FBI's earlier purchases were for a pilot project that was "not active.")
• DHS recently renewed a contract with data broker Thomson Reuters, which aggregates names, photographs, social media activity, relatives and associates, financial information, and criminal history into dossiers for government use (per the Brennan Center).
• Multiple agencies — FBI, IRS, DHS, ICE, DEA, Secret Service, DoD — have purchased location or personal data from commercial brokers, exploiting the legal gray zone where purchased data is treated as "commercially available" even though Carpenter v. United States (2018) requires a warrant for historical cell-site location records obtained from carriers.
• On June 29, 2026, the Supreme Court ruled 6–3 in Chatrie v. United States, No. 25-112, that police conduct a Fourth Amendment search when they obtain detailed Google Location History through a geofence warrant — extending Carpenter to app-generated location logs, rejecting the third-party doctrine for this data, and holding that even short windows of location history trigger the Fourth Amendment. (The Court decided only that a search occurred; it remanded on whether the warrant satisfied probable cause and particularity.) Citation: 146 S. Ct. 2193 (2026).
• A bipartisan bill, the Fourth Amendment Is Not For Sale Act, would require warrants for government purchases of Americans' sensitive data. Its status as of October 2026: pending (not enacted).

Current legal status: The purchases continue under the "commercially available information" theory; Chatrie constrains geofence warrants but did not rule on warrantless purchases. Whether the Fourth Amendment Is Not For Sale Act passes is uncertain.

Status: documented (sworn congressional testimony; Supreme Court decision). The constitutionality of the purchase practice itself is not adjudicated.

Sources: Politico via 9to5Mac (Mar. 19, 2026) on the Worldwide Threats hearing; Brennan Center via Bloomberg Law on the Thomson Reuters contract and geofence ruling; Police1 and law-firm analyses of Chatrie (citing 146 S. Ct. 2193).

10. Surveillance and retaliation against ICE critics and journalists

What happened (documented):

• In September and October 2025, federal judges blocked DHS administrative subpoenas seeking identifying information about Instagram and other social media accounts that tracked or identified ICE agents and their activities (per an ACLU declaration filed in related litigation).
• The Wall Street Journal reported on a federal grand jury subpoena targeting an online critic ("Tired_Thumb"); a judge denied the motion to quash but stayed the case pending appeal.
• The Journal further reported that ICE's scrutiny of online critics covered at least 131 incidents of alleged doxxing/threats between January 2025 and March 2026, and that some individuals whose identities were obtained were visited by federal officers and asked to sign documents characterizing their posts about immigration enforcement as potentially unlawful — with criminal charges rarely filed.
• Observers of ICE operations have sued DHS alleging retaliatory revocation of Global Entry status after being observed observing agents — including suits filed in July 2025 (three women) and a September 2025 suit by a Minneapolis observer whose license plate was searched 55 times. DHS restored at least one revocation after press inquiry. These are alleged (lawsuits pending).
• NPR/The Public's Radio documented ICE/CBP use of the Mobile Fortify facial-recognition app during street operations — agents pointing phones at people's faces — with lawyers describing detentions following inaccurate scans. DHS says it uses a "deliberately high matching threshold."
• Documented official statements: DHS Secretary Kristi Noem said filming ICE agents constitutes "violence" under the department's definition (July 2025 press briefing); FCC Chair Brendan Carr opened an investigation into radio station KCBS over its reporting of ICE raid locations; "border czar" Tom Homan called for a DOJ investigation of CNN's reporting on the ICEBlock app.

Authority claimed: Administrative subpoena authority; Global Entry revocation discretion; law-enforcement operational security.

Current legal status: The social-media subpoenas were blocked by court order (documented/adjudicated as to those orders). The retaliation lawsuits are alleged (pending). The statements and investigations are documented official acts, not court rulings.

Status: mixed — documented (blocked subpoenas, official statements, reported app use) / alleged (retaliation claims in pending suits).

Key documents: ACLU FOIA/declaration materials — downloaded: ~/workspace/your_files/aclu-ice-foia.pdf.

Sources: ACLU declaration (2025); Wall Street Journal reporting on the subpoenas; Reason (Aug. 2026) on surveillance-tech spending and the subpoena fights; TechDirt/HuffPost on Global Entry suits; NPR via The Public's Radio on Mobile Fortify.

Summary table

What was excluded as unverifiable

• Claims that DOGE exfiltrated data to private servers or abroad. Widely speculated; no court finding or official record reviewed establishes this. Excluded.
• Claims about specific officials' personal financial stakes in surveillance vendors (e.g., a Medium post asserting Stephen Miller holds Palantir stock). Single-source, unverified. Excluded.
• The "$28.7 billion AI surveillance buildout" figure circulating on advocacy blogs. No primary budget document reviewed supports the number as stated. Excluded.
• Claims that ICE is systematically targeting "antifa" as a surveillance category. Thin sourcing; excluded.
• Prosecutions of critics (e.g., cases against former officials) are prosecutions, not surveillance — out of scope for this page, though they belong on a retaliation tracker if one is built.

Where the legal status is genuinely uncertain (as of October 2026)

1. SSA en banc review — the Fourth Circuit agreed to rehear the injunction en banc; no outcome found in reviewed sources.
2. IRS–ICE merits — the injunction was affirmed, but the underlying case continues; a final judgment could still go either way.
3. Section 702 — lapsed since June 12, 2026; whether Congress restores it (clean or with a warrant requirement) is an open fall-2026 fight.
4. The purchase loophole — Chatrie did not decide whether warrantless purchases of location data violate the Fourth Amendment; the Fourth Amendment Is Not For Sale Act remains pending.
5. Retaliation suits (Global Entry revocations) — pending; claims unadjudicated.
6. Treasury case mootness — the dismissal means no court ever ruled the original DOGE access lawful or unlawful on the merits.

Research notes

• The Treasury/SSA/OPM dockets should be pulled from PACER/RECAP for the primary orders before publication (Engelmayer TRO, Vargas PI + dismissal, Hollander PI, Cote 99-page PI order, Alston MTD denial).
• The D.C. Circuit opinion (Center for Taxpayer Rights v. IRS, 2026 WL 2635380) should be pulled from the court's site or CourtListener.
• The Chatrie slip opinion (No. 25-112) should be pulled from supremecourt.gov.
• ICE's ImmigrationOS contract justification document should be obtained (reported by Business Insider/Wired from a federal contracting publication).
• The State Department's June 18, 2025 cable on expanded vetting should be sourced directly if publicly available.
• Two PDFs are already local: ~/workspace/your_files/ctr-v-irs-complaint.pdf (58 pp., amended complaint, 1:25-cv-00457-CKK) and ~/workspace/your_files/aclu-ice-foia.pdf (ACLU FOIA/declaration materials on ICE surveillance of critics).
• Tone check for review: this draft avoids motive speculation throughout. The sharpest characterizations ("weak sauce," "breach of law and of trust") are direct quotes from judges, attributed as such.