California Attorney General Rob Bonta co-led a coalition of 18 attorneys general in submitting a comment letter opposing the Department of Homeland Security's expansion of the Systematic Alien Verification for Entitlements (SAVE) program to include U.S.-born citizens. The coalition argues the expansion violates the Privacy Act of 1974, creates a massive surveillance database, increases data breach risks, and will lead to inaccurate verifications and denial of benefits.
The coalition urges DHS to rescind the SAVE program expansion, arguing it violates the Privacy Act by adding records of natural-born citizens without consent and creates unacceptable privacy and security risks.
In-house legal teams should review agreements between state/local government agencies (or other entities) and the Department of Homeland Security (DHS)/USCIS that involve the Systematic Alien Verification for Entitlements (SAVE) program. Focus on clauses governing data sharing scope, consent requirements, data breach notification, data retention schedules, and accuracy guarantees. Specific changes may be needed to limit data use to verified immigration status purposes only, incorporate explicit consent mechanisms for U.S.-born citizens, enhance breach notification protocols, ensure data minimization and retention limits, and add provisions to prevent repurposing data for surveillance or unrelated federal investigations.
Entity
U.S. Department of Homeland Security
Also known as: Department of Homeland Security
Industry
OtherOfficial Press Release
https://oag.ca.gov/news/press-releases/attorney-general-bonta-slams-trump%E2%80%99s-latest-effort-feed-americans%E2%80%99-personal
SAVE SORN multistate comment letter final (12.1.25)
https://oag.ca.gov/system/files/attachments/press-docs/SAVE%20SORN%20multistate%20comment%20letter%20-%20final%20%2812.1.25%29.pdf
California Attorney General Enforcement Page
https://oag.ca.gov/privacy/privacy-enforcement-actions
"U.S. Department of Homeland Security’s (DHS)"
"violates the Privacy Act of 1974"
"massive invasion of privacy that exposes millions of individuals to possible data breaches, pools vast swaths of sensitive data, and furthers the Administration’s efforts to create a national surveillance database"
Virginia Attorney General Jay Jones joined a coalition of attorneys general in filing an amicus brief challenging DHS’s practice of conducting warrantless civil immigration arrests without determining whether individuals are likely to escape before a warrant can be obtained. The release reports that a district court had previously granted a preliminary injunction in the underlying case; it does not report a penalty or a new remedy imposed on DHS by this brief.
Connecticut Attorney General William Tong joined a coalition of 22 attorneys general in filing an amicus brief challenging DHS’s policy and practice of conducting warrantless civil immigration arrests. The press release describes a court challenge, not a privacy enforcement action or monetary penalty.
Connecticut Attorney General William Tong joined a coalition of 21 attorneys general in submitting a comment letter opposing a DHS rule that allows certain affirmative asylum applications to be referred to removal proceedings without an asylum officer interview. The coalition argues the rule violates federal law and harms asylum seekers, including unaccompanied children; this was a policy opposition letter, not a privacy enforcement action.
Attorney General Jay Jones joined a coalition of 26 states to sue the Trump administration over unlawful conditions attached to counterterrorism and emergency funding. The conditions would require states to share voter data with DHS and assist in immigration enforcement, which the coalition argues violates the Administrative Procedure Act and the Spending Clause.
Other enforcement action: Oregon Attorney General Dan Rayfield, joined by 18 other states, sued the Trump Administration over its unlawful $100,000 fee for H-1B visa petitions. The lawsuit alleges that the policy violates the Administrative Procedure Act by exceeding congressional authority and bypassing required rulemaking procedures, harming educational institutions and employers.
Governor Newsom signed the Expanding Privacy Rights Act (SB 923), expanding CCPA deletion rights to cover personal information obtained from third parties and requiring online-only businesses to offer an online method for submitting privacy requests. The law takes effect January 1, 2027, and allows businesses to maintain suppression lists to help keep deleted information from being reacquired.