On June 22, 2026, U.S. District Judge Sparkle Sooknanan in Washington, D.C., issued a sweeping ruling that blocked the Trump administration’s SAVE system—a database designed to identify noncitizens on voter rolls—finding that it violated federal law and trampled on the privacy rights of millions of Americans. The judge’s decision halted what had become one of the most ambitious voter verification efforts in decades, stopping a system that had already processed the personal data of over 60 million voters without their knowledge or consent. The ruling represents a significant legal defeat for an administration that had made voter list accuracy a cornerstone of its election integrity agenda.
The SAVE system, which stands for the Trump administration’s overhauled voter eligibility database, had operated for months before the court order, systematically cross-referencing voter registration information with citizenship data from federal agencies. By April 2026, the system had flagged 21,000 records—less than 1% of those processed—as potential noncitizens. Despite this minuscule flagging rate, the administration had continued expanding the system’s reach, combining and repurposing citizenship data from multiple federal sources in ways that even the government knew to be unreliable. Judge Sooknanan’s language was unsparing. In her ruling, she wrote: “The federal government has knowingly trampled on the privacy rights of American citizens in a manner that threatens the sacred right to vote.” Federal agencies, she found, had “haphazardly combined and repurposed private information of millions of Americans, including citizenship data that they knew to be unreliable.” The decision marked the second major judicial setback in days for the administration’s voter verification efforts, following a separate ruling by a federal judge in Boston blocking a related executive order.
Table of Contents
- How Did Federal Agencies Combine Voter Data Across Multiple Systems?
- What Legal Violations Did the Judge Identify?
- How Did This Voter Verification System Actually Work in Practice?
- What Is the Difference Between This System and Previous Voter Roll Maintenance?
- What Are the Key Problems With Citizenship Data Reliability?
- What Did the Boston Ruling Target?
- What Happens to the 21,000 Flagged Voters?
- Frequently Asked Questions
How Did Federal Agencies Combine Voter Data Across Multiple Systems?
The SAVE system worked by pulling voter registration information from state databases and cross-checking it against citizenship records held by federal agencies, primarily focusing on data from the Social Security administration and Department of Homeland Security. Instead of requesting data transparently from voters or working through established legal channels, federal agencies internally aggregated these databases, creating a comprehensive dossier on American voters without establishing clear legal authority to do so. The system operated in the background, processing millions of records monthly with no public announcement or disclosure to the individuals whose data was being scrutinized. The mechanics of data aggregation reveal why the judge found multiple legal violations. Federal agencies pulled records from Social Security, DHS, the Veterans Administration, and other sources, then used algorithmic matching to cross-reference voter names, dates of birth, and Social Security numbers. This created what officials called “consensus scores” to flag individuals suspected of being noncitizens.
However, the underlying citizenship data itself was unreliable—the administration’s own assessments acknowledged that SSA records, for example, are not collected or maintained primarily for citizenship verification and contain significant gaps and inaccuracies. Despite knowing these limitations, agencies continued to feed this compromised data into the SAVE system. The scale of this data collection operation was extraordinary. Over 60 million voter records had been processed through SAVE as of April 2026, representing coverage of roughly one-third of all registered voters in the United States. This was accomplished without legislation authorizing the effort, without regulations governing how the data would be used, and without mechanisms for individuals to challenge their classification by the system. The judge found that the administration violated not one but three different federal laws in operating this data aggregation scheme.
What Legal Violations Did the Judge Identify?
Judge Sooknanan identified three separate legal violations in her ruling, though the decision focused most heavily on violations of privacy protections and the Administrative Procedure Act, which requires agencies to follow proper rulemaking procedures before implementing major policy changes. The administration had created and deployed a system capable of disenfranchising hundreds of thousands of voters without going through the notice-and-comment process that federal law requires for significant agency actions. The agency had not published proposed rules in the Federal Register, had not allowed the public an opportunity to comment on the system’s design, and had not explained its legal basis for cross-checking voter data in this manner. A second violation involved the Privacy Act, which restricts how federal agencies can collect, maintain, and use personal information about american citizens. The SAVE system combined personal data from disparate sources—voter registrations, Social Security records, immigration files, and veterans records—in ways that the Privacy Act was designed to prevent.
Each federal database originally collected its information for a specific purpose: Social Security to administer retirement benefits, voter registration to enable voting, DHS records to manage immigration and citizenship. The repurposing of this data for mass surveillance of voters represented exactly the kind of unauthorized data aggregation the Privacy Act was enacted to prohibit. A third violation involved the constitutional right to vote itself. The judge found that the system, by flagging voters for potential removal from rolls based on unreliable citizenship data, posed an immediate threat to voting rights. Even though the system had only flagged 21,000 individuals as potential noncitizens, those individuals faced the prospect of being removed from voting rolls or subjected to provisional ballots based on a system the judge found to be legally invalid and fundamentally unreliable.
How Did This Voter Verification System Actually Work in Practice?
The SAVE system operated in phases, beginning with state-level pilots before expanding nationally. In states where the system was deployed, election officials received lists of flagged voters—individuals the algorithm identified as potentially noncitizen based on citizenship data matches. These flagged voters typically were not notified they had been flagged. Some states used the lists to send confirmation notices asking voters to prove citizenship. Others moved directly to provisional ballots. Still others attempted to remove flagged voters from rolls without explicit notification.
One of the concerning aspects of SAVE’s operation was that voters often had no meaningful opportunity to challenge their flagging. A voter might be flagged by the system based on a Social Security number mismatch, a bureaucratic error in data entry, or legitimate data inconsistencies that occur when citizens move between states, change names due to marriage or divorce, or have their information recorded differently by different agencies. The system provided no built-in mechanism for such voters to quickly and easily clear their names. Instead, they would have to work with election officials, often discovering they had been flagged only when attempting to vote. The flagging rate—21,000 out of 60 million records, or roughly 0.035%—highlights a critical problem with the system’s practical implementation. When a matching algorithm operates at this scale with such a low flag rate, small errors in the underlying data and algorithm design become enormously consequential. Even if the algorithm was 99% accurate in identifying actual noncitizens, it would also be flagging thousands of legitimate voters as noncitizens. With most flagged voters being actual citizens, the system created a significant risk of wrongful disenfranchisement.
What Is the Difference Between This System and Previous Voter Roll Maintenance?
States have long maintained voter rolls and removed registrations of individuals who have died, moved out of state, or become ineligible to vote. These processes, called list maintenance, are routine and legally authorized under the National Voter Registration Act. However, traditional list maintenance operates under a different legal framework, with transparency, notice to voters, and mechanisms for challenging removal decisions. When a state receives a death certificate indicating a voter has died, that’s a definitive, single-source fact. The state notifies the voter’s family and removes the registration. The SAVE system represented a dramatic departure from this approach. Rather than relying on definitive sources of information—death certificates, court documents showing someone moved out of state, or formal denaturalization records—it relied on probabilistic matching across multiple databases using data acknowledged to be unreliable.
Traditional list maintenance also operates under rules requiring states to notify voters before removal, allowing them to respond, and permitting them to vote provisionally if they dispute removal. The SAVE system’s implementation in many jurisdictions bypassed these protections, moving directly to flagging and removal based on algorithmic matches rather than definitive evidence. The tradeoff between efficiency and protection is significant here. The SAVE system promised to be more efficient at identifying noncitizens on voter rolls, potentially affecting thousands of voters quickly. Traditional list maintenance is slower, more cumbersome, and requires more individual attention to disputed cases. However, the traditional approach also provides protection against the kind of mass disenfranchisement that algorithmic matching across unreliable data creates. The judge’s ruling essentially held that this protection—the right to proper notice, the right to dispute the evidence, the right not to be flagged based on unreliable data—is more important than the efficiency gains the new system offered.
What Are the Key Problems With Citizenship Data Reliability?
The judge’s decision hinged partly on findings about the underlying data quality problems that made the SAVE system particularly problematic. Social Security Administration records, which formed a major component of the matching process, are not collected or maintained for citizenship verification purposes. People obtain Social Security numbers for work authorization purposes, and the SSA’s primary function is administering retirement and disability benefits. When someone’s citizenship status changes—through naturalization or denaturalization—the SSA is often not formally notified. SSA records may contain outdated citizenship information, gaps in citizenship notation, or errors in data entry. For some individuals, particularly immigrants and naturalized citizens, SSA records may be ambiguous or incomplete regarding citizenship status. Department of Homeland Security records present a different set of problems. DHS maintains records on visa holders, green card holders, and individuals with immigration proceedings pending, but it also has coverage gaps and data that can be outdated if someone’s immigration status changes.
A person may have been flagged in DHS records as a visa holder years ago but subsequently became a naturalized citizen; that naturalization may not immediately update in relevant DHS systems. Cross-matching these records with voter rolls created multiple opportunities for false positives—citizens being flagged as noncitizens due to outdated or misaligned data across systems. The judge found that federal agencies knew about these data quality problems and proceeded anyway. This is perhaps the most damaging finding from her ruling—not that the system was imperfect, which any system is, but that officials knowingly deployed a system they understood to be unreliable. The agencies did not validate the system’s accuracy before deployment. They did not establish confidence thresholds for flagging or removal decisions. They did not build in robust appeals processes for voters to challenge their flagging. Instead, they treated citizenship data as reliable enough to potentially disenfranchise voters, despite internal awareness that this data was not suitable for such consequential decisions.
What Did the Boston Ruling Target?
Days after the Washington D.C. ruling, a federal judge in Boston issued a separate blocking decision against a related executive order requiring the Department of Homeland Security to compile a federal list of eligible voters for each state using Social Security Administration data. This second ruling targeted a different legal mechanism but reflected similar judicial concerns about the administration’s approach to voter data aggregation.
The Boston judge blocked the DHS compilation order, finding it also violated administrative procedures and threatened voter access. The two rulings together demonstrate that courts were not just objecting to a specific implementation of voter verification, but to the broader framework the Trump administration had adopted for identifying and flagging noncitizens on voter rolls. Whether through the SAVE system or through DHS’s compilation of SSA data, the approach involved using citizenship data the federal government knew to be unreliable for making determinations that could remove Americans from voter rolls. Multiple judges across different jurisdictions came to the same conclusion: this approach violated federal law and constitutional voting rights protections.
What Happens to the 21,000 Flagged Voters?
Judge Sooknanan’s ruling does not automatically restore to voting rolls any individuals who had already been removed under the SAVE system. Instead, the decision blocks future use of the system and requires the administration to cease operations that relied on it. However, the practical implications for individuals already flagged or removed remain uncertain and will likely require separate litigation to resolve. States where voters were removed based on SAVE flags may need to conduct reviews to determine how many such removals occurred and whether those individuals can be reinstated before the next election cycle.
The court’s injunction essentially returns voter verification efforts to the previous legal framework, where states must follow traditional list maintenance procedures with proper notice and opportunity for voters to respond. This does not mean that noncitizens on voter rolls cannot be removed—they can be, through proper procedures. It means the removal must rely on clear, reliable evidence rather than algorithmic matching across acknowledged unreliable data sources. For the estimated 21,000 individuals flagged by SAVE as potential noncitizens, some may actually be noncitizens who should be removed, but many are almost certainly American citizens caught in false positive errors created by the system’s design.
Frequently Asked Questions
What is the SAVE system?
SAVE is the Trump administration’s voter eligibility database that cross-referenced voter registration information with citizenship records from federal agencies including Social Security Administration and Department of Homeland Security. It processed over 60 million voter records and flagged 21,000 as potential noncitizens before being blocked by a federal judge.
Why did the judge block the system?
Judge Sooknanan found that the administration violated federal privacy law, the Administrative Procedure Act, and constitutional voting rights protections. The judge determined that federal agencies knowingly combined and repurposed citizenship data they knew to be unreliable to make decisions that could disenfranchise voters.
What happens to voters who were already flagged or removed?
The court’s decision blocks future use of SAVE but does not automatically restore flagged voters. States may need to conduct separate reviews to address individuals already removed under the system, and additional litigation may be required to resolve their status.
How accurate was the system’s noncitizen identification?
The system flagged 21,000 out of 60 million voter records processed, representing less than 1% of voters. The judge found the underlying citizenship data to be unreliable, meaning many flagged individuals were likely American citizens caught by the algorithmic matching.
Can states still try to remove noncitizens from voter rolls?
Yes. States can remove noncitizens from voter rolls using traditional list maintenance procedures based on clear evidence, such as formal denaturalization records or court documents. They cannot use the SAVE system or similar algorithmic matching across unreliable federal databases.
What was the Boston ruling about?
A separate federal judge in Boston blocked an executive order requiring the Department of Homeland Security to compile a federal list of eligible voters for each state using Social Security Administration data, finding it also violated administrative procedures and threatened voter rights.