League of Women Voters v. DHS

Opinion

United States Court of Appeals FOR THE DISTRICT OF COLUMBIA CIRCUIT

____________

No. 26-5243 September Term, 2026 1:25-cv-03501-SLS

Filed On: September 4, 2026 League of Women Voters, et al.,

Appellees

v.

United States Department of Homeland Security, et al.,

Appellants

State of Texas,

Appellee

------------------------------

Consolidated with 26-5301

BEFORE: Srinivasan, Chief Judge, and Wilkins and Katsas*, Circuit Judges

ORDER

Upon consideration of the emergency motion for stay pending appeal, which includes a request for an administrative stay, the response thereto, and the reply; the motions to participate as amici curiae and the lodged amicus briefs; and the Rule 28(j) letters, it is

ORDERED that the motions to participate as amici curiae be granted. The Clerk is directed to file the lodged briefs. It is

FURTHER ORDERED that the motion for stay be denied. For the reasons discussed in the attached per curiam statement, appellants have not satisfied the stringent requirements for a stay pending appeal. See Nken v. Holder, 556 U.S. 418, 434 (2009); D.C. Circuit Handbook of Practice and Internal Procedures 33 (2025). It is

* Circuit Judge Katsas would grant the motion for stay pending appeal for the reasons discussed in the attached dissenting statement.

United States Court of Appeals FOR THE DISTRICT OF COLUMBIA CIRCUIT

____________

No. 26-5243 September Term, 2026

FURTHER ORDERED that the request for an administrative stay be dismissed as moot. It is

FURTHER ORDERED, on the court’s own motion, that these consolidated appeals be expedited and that, within 10 days of the date of this order, the parties submit a proposed expedited schedule and proposed formats for the briefing of these cases.

Per Curiam

FOR THE COURT: Clifton B. Cislak, Clerk

BY: /s/

Francis A. Walter Deputy Clerk

Page 2

PER CURIAM: A stay pending appeal is “extraordinary relief.” Citizens for Resp. & Ethics in Washington (CREW) v. FEC, 904 F.3d 1014, 1017 (D.C. Cir. 2018) (per curiam). To obtain its requested stay, the government therefore must make, among other things, a “strong showing that [it] is likely to succeed on the merits” of its appeal. Nken v. Holder, 556 U.S. 418, 434 (2009) (citation omitted).

Here, the government faces a further obstacle. Only after the district court had already granted summary judgment for plaintiffs did the government raise what are now its central arguments regarding plaintiffs’ Social Security Act claim. When the government first aired those forfeited arguments in moving for a stay pending appeal, the district court declined to consider them in that expedited posture but expressly invited the government to submit a post-judgment motion to excuse the forfeiture and receive full consideration of the late-raised arguments. The government did not do so, instead coming straight to our court and seeking a stay pending appeal based in significant part on the forfeited arguments.

To grant the extraordinary relief of a stay, we would need to elect to excuse the government’s forfeiture for purposes of this preliminary stage of the proceedings and then conclude that there is a strong showing that the forfeited arguments—yet to be considered on the merits by any court—are likely to succeed in this appeal. We decline to overlook the forfeiture for purposes of the government’s stay motion; and at any rate, even considering the forfeited arguments as they are presented in the necessarily constrained context of an expedited stay motion, we cannot conclude that the government has made the requisite strong showing of a likelihood of success. We therefore deny the government’s motion.

I. A.

The Systematic Alien Verification for Entitlements program, or SAVE, is an immigration- and citizenshipverification system administered by the Department of Homeland Security (DHS). Congress created SAVE in 1986, directing DHS’s predecessor to establish an automated means of verifying the immigration status of noncitizens applying for certain public benefits. See Immigration Reform and Control Act of 1986, Pub. L. No. 99-603, § 121(c)(1), 100 Stat. 3359, 3391; 42 U.S.C. § 1320b-7(d); Gov’t Mot. 2–3.

For nearly four decades, SAVE principally searched DHS’s own immigration records. An agency generally submitted a request about a specific individual using a DHS identifier for the person, such as an alien registration number. SAVE returned citizenship or immigration-status information, and the requesting agency made any ultimate eligibility determination. See 42 U.S.C. § 1320b-7(d)(5)(A); Gov’t Mot. 3–4. The system ordinarily could not verify the citizenship of a person born in the U.S. (about whom DHS would have no immigration records), it could not be searched using a Social Security number (SSN), and it could not accept bulk queries encompassing multiple persons. Gov’t Mot. 4–5.

That changed as a result of modifications to SAVE implemented in 2025. In March of that year, President Trump issued an Executive Order directing DHS to ensure that state and local election officials had “access to appropriate systems for verifying the citizenship or immigration status of individuals registering to vote or who are already registered.” Exec. Order No. 14,248, § 2(b)(i), 90 Fed. Reg. 14005, 14006 (Mar. 25, 2025). The order also directed the Social Security Administration (SSA) to make its Social Security Number

3

Verification Service, Death Master File, and other relevant federal databases available for that purpose. Id. § 3(a), 90 Fed. Reg. at 14007.

DHS soon announced the new system at issue here, which we, like the district court and the parties, will call “modified SAVE.” The new system differed from its predecessor version in three principal respects: (i) it connected SAVE to SSA records and permitted searches using full or partial SSNs; (ii) that connection allowed SAVE to return information about persons—including many U.S.-born citizens—who had no DHS immigration records; and (iii) the system permitted bulk queries. Gov’t Mot. 5–6; DHS Administrative Record (DHS AR) 115–17.

The information exchange under modified SAVE generally works in relevant respects as follows. Using a web interface, a requesting agency—for example, a state or local government—can access the SAVE system and initiate a request about a person or group of persons. The requester provides the names, dates of birth, full or partial SSNs, and other available identifying information for each person encompassed by the query. DHS then sends those data to SSA. SSA compares the submitted information with its own records and generates separate true-or-false match indicators for the SSN, name, and date of birth for each person. SSA returns a file to DHS containing the match results, as well as yes-or-no indicators capturing whether queried individuals are citizens, deceased, or foreign-born, and other data fields that indicate state or country of birth and alien registration number if applicable and available. If the requester provided only a partial SSN and SSA nonetheless identified a match in its own records, SSA shares the associated full (nine-digit) SSN with DHS for DHS’s own records. SSA also sends any error code descriptions associated with errors incurred during SSA’s search. Gov’t Mot. 6; DHS AR 116, 224–26, 424, 437–38.

4

DHS then makes the results available to the requesting agency through the SAVE web interface. For each person encompassed by the query, the SAVE results report the name, SSN, date of birth, and other identifying information contained in the request, alongside search results. The search results may include an indicator of citizenship or immigration status, an indicator capturing whether the individual is deceased, and descriptions of errors generated by the search process. As to the latter, if, for example, a requesting agency submitted only a partial SSN and SSA was unable to identify a match in its records, SAVE says “Full SSN Required – Resubmit with Additional Information.” With respect to a person’s citizenship, if SAVE does not provide confirmation that the person is a U.S. citizen, SAVE may instruct the requesting agency to contact the individual, who may then be asked for proof of citizenship. SAVE users can review the results for each person one by one or can download a bulk file containing the composite results for all individuals in a query. The time to produce SAVE results can vary from a matter of seconds to a number of days depending on the complexity of the query and the need for human involvement. Gov’t Mot. 6–7; DHS AR 762, 1379, 1443–44, 1507–08, 1525–26.

B.

Plaintiffs include the League of Women Voters (the League), several state League affiliates, the Electronic Privacy Information Center, and individual citizens. In September 2025, plaintiffs filed this action challenging modified SAVE on several grounds, including that DHS and SSA lacked statutory authority for the new system and that its implementation violated the Social Security Act, the Privacy Act, and the Administrative Procedure Act.

The district court initially denied preliminary relief on the ground that plaintiffs had not shown irreparable harm. League

5

of Women Voters v. DHS, No. 25-cv-3501, 2025 WL 3198970, at *5 (D.D.C. Nov. 17, 2025). The parties then fully briefed the merits. Plaintiffs moved for summary judgment, and the government cross-moved to dismiss or, alternatively, for summary judgment. See Pls.’ Summ. J. Mot., Dkt. 66-1; Fed. Defs.’ Mot., Dkt. 77-1; Pls.’ Reply & Opp., Dkt. 99; Fed. Defs.’ Reply, Dkt. 106.

On June 22, 2026, the district court granted plaintiffs summary judgment. League of Women Voters, 2026 WL 1784297, at *35. The court held that plaintiffs had standing, that DHS lacked statutory authority to implement modified SAVE, that the system violated the Social Security Act and the Privacy Act, and that its adoption was arbitrary and capricious. Id. at *11–18, *20–33; Add. 25–70. The court set aside modified SAVE, along with two Systems of Records Notices issued by DHS and SSA that described the new uses of their records. League of Women Voters, 2026 WL 1784297, at *35; Add. 76–77.

The government appealed and asked the district court to stay its decision pending the appeal. In the stay motion, the government presented entirely new arguments concerning plaintiffs’ claim under the Social Security Act. That claim rests on a confidentiality mandate established by 42 U.S.C. § 405(c)(2)(C)(viii)(I), which generally bars disclosure of SSNs “and related records that are obtained or maintained . . . pursuant to any provision of law enacted on or after October 1, 1990.” Plaintiffs had also argued that the same sharing of information independently violated another provision of the Social Security Act, 42 U.S.C. § 1306(a)(1). The district court did not reach that alternative theory because it concluded that the government had offered no response under the terms of § 405(c)(2)(C)(viii)(I).

6

Throughout the months-long summary-judgment proceedings, the government never made an argument under the terms of § 405(c)(2)(C)(viii)(I)’s confidentiality mandate. That is, the government never argued that, to the extent the provision’s confidentiality mandate applies, modified SAVE is consistent with it. See Add. 94–97. Instead, the government argued only that § 405(c)(2)(C)(viii)(I) does not apply in the first place because other immigration statutes—chiefly, 8 U.S.C. § 1373(c)—specifically authorize the disclosures brought about by modified SAVE. See Fed. Defs.’ Mot. 49– 50; Add. 94–97. Then, after the district court granted summary judgment for plaintiffs on the Social Security Act claim, the government’s motion for a stay pending appeal for the first time engaged with the substance of § 405(c)(2)(C)(viii)(I)’s confidentiality mandate. Only then did the government argue that, to the extent modified SAVE discloses any information at all, any such disclosures are consistent with § 405(c)(2)(C)(viii)(I). Add. 94–97.

The district court held those new arguments forfeited.

Add. 94–98. It emphasized that the government’s new theories implicated two relevant transfers of information in response to a SAVE query: SSA’s initial transmission of responsive information to DHS, and DHS’s ensuing transmission of information to the initial SAVE requester. The court explained that the forfeited arguments could require renewed examination of the administrative record and additional factual determinations about what is communicated at each step. Add. 95–97. The court declined to take up the forfeited arguments “in an expedited fashion” in the context of “a stay motion,” but it expressly invited the government to ask it to excuse the forfeiture and engage with the arguments through a postjudgment motion, “where they can receive adequate and thorough consideration.” Add. 98 n.3. The government did

7

not take up the district court’s invitation, instead filing the present motion in this court for a stay pending appeal.

II.

In attempting to satisfy its burden to make a strong showing of a likelihood of success on the merits of its appeal, the government initially argues that plaintiffs lack standing. The government has not shown the requisite likelihood of success on that argument.

The League has associational standing if one member would have standing in her own right, the interests it seeks to protect are germane to its purpose, and neither the claim nor the requested relief requires an individual member’s participation. Institutional S’holder Servs., Inc. v. SEC, 142 F.4th 757, 764 (D.C. Cir. 2025). Only the first requirement is disputed. And because the League seeks prospective relief, the question is whether at least one member faces an ongoing or sufficiently imminent injury.

At least two do. J. Doe 4 is a League member and U.S.

citizen who lives in Louisiana, which has agreed to use modified SAVE for voter-list maintenance. J. Doe 4 Suppl. Decl. ¶¶ 1–2, 5, 13, Dkt. 16-3. Doe applied for an SSN while a noncitizen, later became a U.S. citizen, and states in a sworn declaration that SSA’s records continue to list them as a noncitizen. Id. ¶¶ 2, 8, 14. J. Doe 6 is likewise a League member and U.S. citizen who lives in Virginia, where election officials have agreed to use modified SAVE for voter-list maintenance. J. Doe 6 Decl. ¶¶ 1–2, 5, 14, Dkt. 16–8. J. Doe 6 likewise applied for an SSN before naturalizing and states that SSA’s records continue to list them as a noncitizen. Id. ¶¶ 2, 9, 15. While SSA does not require individuals to update their records when their citizenship status changes (since such a change would not necessarily affect eligibility for related

8

benefits), J. Doe 6 nonetheless tried unsuccessfully to update their SSA citizenship data before the November 2025 elections. Id. ¶ 15.

If modified SAVE were used to obtain information about them, the inaccurate SSA records for J. Doe 4 and J. Doe 6 would likely produce a SAVE record that fails to confirm their citizenship. What would then presumably follow would count as injury for standing purposes. DHS instructs election officials receiving such a response to obtain proof of citizenship from the voter. DHS AR 762. And President Trump has “directed” states to remove all ineligible voters from their rolls “immediately.” White House, President Trump Delivers an Address to the Nation, at 39:36–39:46 (YouTube, July 16, 2026), https://www.youtube.com/ watch?v=iIlqG0untYM. If a person needs to prove their citizenship to remain registered to vote or if they are removed from the registration rolls, they suffer a cognizable injury. See Meese v. Keene, 481 U.S. 465, 475 (1987).

The agencies themselves have made clear that the threatened injury J. Doe 4 and J. Doe 6 describe is far from speculative. DHS warned that “[s]hortfalls in data accuracy” in SSA citizenship data could produce “incomplete or false results.” DHS AR 260, 302; see also DHS AR 240. SSA likewise cautioned that its citizenship information is accurate “for SSA’s program purposes,” but “if used later for other purposes, it may not be current.” SSA Administrative Record (SSA AR) 103; see also SSA AR 44. The implementation of modified SAVE in Texas shows how the dynamic can materialize in practice. When modified SAVE produced adverse results for Texas League members whom federal records misclassified as noncitizens, state officials required them to prove their citizenship and, in some cases, cancelled their registrations. See Nel Decl. ¶¶ 19–21, 24, 26 & Exs. 1, 2, Dkt. 66-3; A. Doe Decl. ¶¶ 11–14 & Ex. 1, Dkt. 66-4; B. Doe

9

Decl. ¶¶ 11–17, 21–22, 24–27, 30–31 & Exs. 1, 2, Dkt. 66-5; C. Doe Decl. ¶¶ 12–14, 18 & Ex. 1, Dkt. 66-6. That experience, together with J. Doe 4’s and J. Doe 6’s out-of-date federal records and their own states’ planned use of modified SAVE, makes injury sufficiently likely to establish their standing. See Jibril v. Mayorkas, 20 F.4th 804, 814 (D.C. Cir. 2021).

Contrary to the government’s argument, the intervening role of state officials does not defeat causation. An injury remains fairly traceable to federal action when third parties “will likely react” to it “in predictable ways.” Diamond Alt. Energy, LLC v. EPA, 606 U.S. 100, 112 (2025) (cleaned up). The sequence of events in Texas illustrates that states’ response to an adverse SAVE result is not conjectural—after all, the states wanting to use modified SAVE to conduct citizenship checks do so because they expect its result to inform their eligibility determinations. And the threatened injuries are fairly traceable and redressable because setting aside modified SAVE removes the federal response that sets the process in motion. The government thus has not shown that it is likely to succeed in challenging plaintiffs’ standing.

III.

Nor has the government made the requisite strong showing that it is likely to succeed on the merits of its appeal. The district court’s grant of summary judgment against the government on plaintiffs’ Social Security Act claim independently supports its judgment. As to that claim, the central arguments the government now advances in its stay motion were forfeited before the district court. We decline to excuse that forfeiture for purposes of considering the government’s preliminary request for an interim stay, regardless of whether the forfeiture might ultimately be overcome when the government’s appeal is considered on the merits after the full briefing attending that stage. And at any

10

rate, even if we consider the government’s forfeited arguments in this posture, the government still does not make the requisite strong showing of a likelihood of success on those new arguments as currently presented.

A.

The Social Security Act’s relevant confidentiality mandate provides:

Social security account numbers and related records that are obtained or maintained by authorized persons pursuant to any provision of law enacted on or after October 1, 1990, shall be confidential, and no authorized person shall disclose any such social security account number or related record.

42 U.S.C. § 405(c)(2)(C)(viii)(I).

A “social security account number” is an SSN, and a “related record” is “any record, list, or compilation that indicates, directly or indirectly, the identity of any individual with respect to whom a social security account number or a request for a social security account number is maintained.” Id. § 405(c)(2)(C)(viii)(IV). There is no dispute that the confidentiality mandate’s disclosure prohibition applies not only to the transmission of information from within the federal government to outside it (e.g., DHS to a SAVE user) but also from one federal agency to another (e.g., SSA to DHS).

1.

Plaintiffs contend that modified SAVE violates § 405(c)(2)(C)(viii)(I). In moving for summary judgment on that claim and in defending against plaintiffs’ motion for summary judgment, the government offered two responses. Neither

11

disputed plaintiffs’ argument that, insofar as § 405(c)(2)(C)(viii)(I) applies to modified SAVE, the program violates the provision’s confidentiality mandate. The government instead argued only that plaintiffs lack a cause of action to assert a violation of § 405(c)(2)(C)(viii)(I) and that other statutes in any event provide the requisite authorization for modified SAVE’s information sharing. Fed. Defs.’ Mot. 49–50. The district court rejected both of those arguments (the first of which the government no longer presses). League of Women Voters, 2026 WL 1784297, at *20, *30–33.

The government, as explained, first raised arguments under the terms of § 405(c)(2)(C)(viii)(I) only after the district court entered judgment. Add. 94–97. Although the district court deemed the arguments forfeited, the government now relies on them as the central basis of its challenge to the district court’s ruling on the Social Security Act claim. Gov’t Mot. 15–17. The government’s stay motion thus asks us to doubly exercise discretion in its favor. First, a stay pending appeal is “not a matter of right”; it is an “exercise of judicial discretion” governed by equitable principles, Nken, 556 U.S. at 433–34 (citations omitted), and is relief we have correspondingly termed “extraordinary,” CREW, 904 F.3d at 1017. Second, consideration of an argument forfeited in the district court is also not a matter of right. See Flynn v. Comm’r, 269 F.3d 1064, 1068–69 (D.C. Cir. 2001). The usual rule is that a forfeited argument will not be considered on appeal at all, Kingdomware Technologies, Inc. v. United States, 579 U.S. 162, 173 (2016); OBB Personenverkehr AG v. Sachs, 577 U.S. 27, 38 (2015), much less considered as the central ground for a stay pending appeal, see Ohio v. EPA, 603 U.S. 279, 298–99 (2024).

In that regard, when considering whether to grant a stay pending appeal, we ordinarily assess whether a party is likely to succeed in appealing the district court’s rejection of an argument that was thoroughly examined based on full

12

development through meaningful adversarial testing. A forfeited argument does not come to us with the benefit of that sort of exploration by either the parties or the district court. Of course, our court still might decide in unusual circumstances to consider a forfeited argument after full merits briefing and argument. But it is another matter altogether to rely on the same forfeited argument to grant discretionary interim relief pending the appeal at an expedited preliminary stage, without the benefit of meaningful development in full merits briefing. See Nken, 556 U.S. at 433–34; McBride v. Merrell Dow & Pharms., Inc., 800 F.2d 1208, 1210–11 (D.C. Cir. 1986). The concerns animating forfeiture principles—that late-raised arguments create “the risk of an improvident or ill-advised opinion” by denying courts and parties normal opportunities for development, McBride, 800 F.2d at 1210 (citation omitted)—have added force at this threshold stage.

Those considerations carry pronounced weight here given the course of the litigation. The government had a full opportunity before the district court’s judgment to raise and develop the theories it now presses. Plaintiffs squarely invoked § 405(c)(2)(C)(viii)(I), Pls.’ Summ. J. Mot. 32–33; the parties briefed the merits of that and other issues over a period of months; and the government not only opposed plaintiffs’ motion but also cross-moved for judgment in its favor. Fed. Defs.’ Mot. The government does not seriously dispute its forfeiture, Gov’t Mot. 17–18, and it does not ask us to find that the district court erred in deeming the arguments forfeited.

The district court also, in an unusual gesture, affirmatively invited the government to make use of a second opportunity to gain discretionary consideration of its late-raised arguments. In its denial of the government’s motion for a stay, the district court directed the government to a procedural pathway that would allow it to ask the court to excuse the forfeiture and

13

engage with the new theories in a manner allowing for their full development and consideration. Add. 98 n.3. That course accords with our precedent, which directs a party wishing to gain postjudgment consideration of a new issue to first present it to the district court, often under Rule 59(e) (or potentially under Rule 60(b)(6) when appropriate). City of New York v. Nat’l R.R. Passenger Corp., 776 F.3d 11, 17 (D.C. Cir. 2015); see Arias v. DynCorp, 752 F.3d 1011, 1016 (D.C. Cir. 2014); Jones v. Horne, 634 F.3d 588, 603 (D.C. Cir. 2011). Here, such a route was still available: a motion of the kind invited by the district court can be filed within 28 days of the judgment, see Fed. R. Civ. P. 59(e); accord Fed. R. Civ. P. 52(b), and the district court extended its invitation when 12 days remained in that period. The government, though, declined to take up the invitation and instead immediately sought relief in this court, forgoing further development and consideration of the forfeited arguments in the district court.*

*

The district court suggested that the government file a motion under Rule 52(b), Add. 98 n.3, which allows a party to move within 28 days of a judgment for a court to amend or supplement its findings and amend the judgment accordingly; Rule 59(e), relatedly, permits a party within the same period to ask the court directly to alter or amend the judgment. Fed. R. Civ. P. 52(b), 59(e). The two rules are routinely invoked together and provide closely related and overlapping forms of postjudgment relief in precisely the same timeframe. See 9C Charles Alan Wright & Arthur R. Miller, Federal Practice and Procedure § 2582 (3d ed. updated Apr. 2026); Nat’l Metal Finishing Co. v. BarclaysAmerican/Com., Inc., 899 F.2d 119, 122 (1st Cir. 1990) (describing “the close relationship between Rule 59(e) and Rule 52(b)” and the relief available under them as “so similar”). Whatever the precise procedural vehicle—Rule 52(b), Rule 59(e), or both—the district court expressly offered and essentially encouraged the government to ask the court to exercise its discretion to grant first-instance, “adequate and thorough consideration” of the late-raised arguments. Add. 98 n.3.

14

Granted, we retain “independent power to identify and apply the proper construction of governing law.” Kamen v. Kemper Fin. Servs., Inc., 500 U.S. 90, 99 (1991). But our “respect for the district judges,” among other considerations, favors giving the court that entered judgment the first opportunity to consider, develop, and resolve a late-raised issue that might call for adjusting the court’s result. City of New York, 776 F.3d at 17. And in the circumstances of this case, as the district court explained, the new theories could require further factual development in that court: an informed consideration of the new arguments could turn in part on what information passes from SSA to DHS, what information later passes from DHS to SAVE users, and what the system’s matching and confirmation responses communicate. Add. 95– 97. De novo review of the ultimate statutory question does not eliminate the need for an adequately developed factual account of the system to which the statute applies. Courts of appeals “do not sit as self-directed boards of legal inquiry and research” into such matters. Carducci v. Regan, 714 F.2d 171, 177 (D.C. Cir. 1983).

In asking us to overlook its forfeiture, the government submits that “[i]t would be extraordinary to use this unusual litigation history to justify precluding millions of verifications” through modified SAVE. Gov’t Mot. 18. But the government makes that appeal in the context of asking us to grant it the “extraordinary relief” of a stay pending appeal. CREW, 904 F.3d at 1017. And it would be all the more out-of-the-ordinary to grant that extraordinary relief on the basis of forfeited arguments: the government does not identify any case in which a court has granted a stay pending appeal based on a likelihood of ultimate success as to forfeited (and hence underdeveloped) arguments.

15

The asserted interests of states that rely on SAVE, see Dissent 11, do not warrant departing from ordinary forfeiture principles either. The consequences of a party’s litigation choices often—indeed, nearly always—extend beyond the party itself. Those downstream interests also run in both directions here, and nothing in this preliminary stay posture necessarily calls for allocating the risk of error to citizens eligible to vote who may be burdened by inaccurate modified- SAVE results rather than to states temporarily unable to use modified SAVE’s new functionality. If such downstream effects sufficed to excuse forfeiture, ordinary forfeiture principles could give way whenever—as may often be the case—government action affects nonparties. Nor does that description fit every state invoking those interests: Texas intervened as a defendant to protect its interests in modified SAVE and independently briefed the Social Security Act claim, yet it too did not advance the specific late-raised theories on which the government now principally relies. See Order Granting Tex. Mot. to Intervene 1, Dkt. 86; Tex. Mot. to Dismiss 26, Dkt. 97.

Here, moreover, the statutory obligations the states invoke—determining eligibility for various benefits and maintaining accurate voter rolls—long predate modified SAVE’s introduction in 2025. For decades, states carried out those duties using the preexisting SAVE system and other available means. The district court’s judgment requires only that they return to those long-used methods while an appeal determines whether modified SAVE is lawful. Whatever advantages modified SAVE’s functions afford, the question at this stage is limited to their interim unavailability during the appeal.

The significance of the issues in this appeal to the public at large does not dictate a contrary conclusion. In a related

16

context, we have declined to consider an argument raised only in a limited fashion by a party even where—and indeed, especially because—“important questions of far-reaching significance are involved.” Carducci, 714 F.2d at 177 (internal quotation marks omitted). And the Supreme Court, when considering an emergency stay application involving a major federal regulatory program, declined to consider a theory advanced by the dissent rather than the government itself in opposing the stay: “if the government had arguments along these lines,” the Court emphasized, “it did not make them” despite its “ample resources and voluminous briefing”—and the Court in that context thought that “sticking to [its] normal course of declining to consider forfeited arguments [was] the right course.” Ohio v. EPA, 603 U.S. 279, 298–99 (2024). We similarly adhere to that course here.

We are unpersuaded to do otherwise based on the parallel proceedings pertaining to modified SAVE in the Northern District of Florida. Several states there entered into a settlement with DHS requiring, among other things, access to modified SAVE’s SSN-search and bulk-upload functionality. After the district court here set aside modified SAVE, the Florida court enforced the parties’ settlement there and ordered DHS to restore those functions for the plaintiff states. See Florida v. DHS, No. 3:24-cv-509, Dkt. 45, at 5–9 (N.D. Fla. July 7, 2026); Add. 105–12.

It is far from clear that the two proceedings present conflicting legal determinations. The district court here adjudicated plaintiffs’ claims on the merits; the Florida court, by contrast, enforced a settlement DHS voluntarily entered while this litigation was already pending. The Florida court did not—and, by nature of the proceeding, could not—address the substance of the claims presented here. The fate of the Florida court’s enforcement order also is uncertain as it is presently on

17

appeal in the Eleventh Circuit. And questions about the effect of the district court’s judgment here on the Florida proceedings are being litigated in the Eleventh Circuit appeal.

The government, meanwhile, has not sought to reduce any practical tension raised by its obligations in the two cases by arguing here that the district court’s relief is too broad; and the mere existence of parallel proceedings—even assuming the orders in fact conflict—does not itself suggest which order, if either, should yield. Indeed, the state parties there have themselves opposed expedition, arguing that the appeal presents “many novel and complex questions” and urging that both appeals proceed “in the ordinary course.” State Appellees’ Opp. to Mot. to Expedite 1–2, 13, Florida v. League of Women Voters, No. 26-12533 (11th Cir. July 28, 2026). Those circumstances provide limited reason to depart from ordinary forfeiture principles here.

We therefore decline to take the highly unusual step of considering the government’s forfeited arguments at this preliminary stage. A subsequent merits panel remains free to decide for itself whether to entertain the arguments after full appellate briefing. And in any event, as we explain below, even if we consider the government’s forfeited arguments at this stage on the present record, the government fails to make the required strong showing of a likelihood of success.

2.

Before taking up the government’s forfeited arguments in the alternative, we first explain why the government does not make a strong showing of a likelihood of success if we confine our consideration to the sole properly preserved argument the government now presses on the Social Security Act claim. Fed. Defs.’ Mot. 44–50. That argument is one the government advances only as a fallback matter. Gov’t Mot. 17. It rests on

18

8 U.S.C. § 1373(c), which generally requires DHS to respond to state and local inquiries seeking citizenship or immigration- status information. That provision does not establish a likelihood of success for the government.

A general duty to answer a citizenship inquiry under 8 U.S.C. § 1373(c) does not by itself authorize disclosure of information that another statute, 42 U.S.C. § 405(c)(2)(C)(viii)(I), specifically makes confidential. The two commands can readily coexist and function together: DHS may answer the inquiries Congress calls for it to answer while still complying with a separate restriction on the disclosure of specific information Congress deemed confidential. See League of Women Voters, 2026 WL 1784297, at *30–33.

Congress’s treatment of employment verification in the same 1996 legislation that enacted § 1373(c) reinforces that conclusion. Congress expressly authorized SSA to participate in an employment-verification system by matching names and SSNs against its records; specified what information SSA could return; and restricted how that information could be used. See Illegal Immigration Reform and Immigrant Responsibility Act of 1996, Pub. L. No. 104-208, § 404(e), (h), 110 Stat. 3009- 546, 3009-665 (codified at 8 U.S.C. § 1324a note). Section 1373(c) contains no comparable reference to SSA records, SSN matching, or the Social Security Act’s confidentiality rule. Congress thus knew how to authorize SSN matching, and it expressly did so elsewhere in the same statute. We see little basis to read § 1373(c)’s general instruction to answer citizenship inquiries as both silently accomplishing the same thing and silently displacing an otherwise applicable confidentiality restriction.

Once the forfeited theories are removed from consideration per the usual rule attending forfeiture, then, the government is left with no preserved argument in its stay

19

motion that independently makes a strong showing that it is likely to defeat the Social Security Act claim. That itself warrants denying the government’s stay motion because we would decline to consider the forfeited arguments at this stage for the reasons explained. We nevertheless next take up those forfeited theories in the alternative and explain why the government still does not carry its burden.

B.

The government’s forfeited theories, even if considered, do not make the requisite strong showing of a likelihood of success. Recall the terms of the Social Security Act’s relevant confidentiality mandate: “Social security account numbers and related records that are obtained or maintained by authorized persons pursuant to any provision of law enacted on or after October 1, 1990, shall be confidential, and no authorized person shall disclose any such social security account number or related record.” 42 U.S.C. § 405(c)(2)(C)(viii)(I). In its forfeited arguments, the government posits two theories under that provision’s terms: (i) that the information conveyed under modified SAVE is “obtained or maintained” “pursuant to . . . law[s] enacted” before “October 1, 1990”; and (ii) that regardless, modified SAVE does not involve “disclos[ure]” of a “social security account number or related record.” Id.

Those new arguments implicate unresolved legal questions whose factual premises are incompletely developed in the available briefing and record. And since the government raised those arguments too late to enable their full development in (and full consideration by) the district court—and since the government in any event bears the burden to justify the extraordinary interim relief it seeks—any uncertainties resulting from the arguments’ inadequate development at this stage weigh against the granting of relief. Considered in that light, neither of the government’s new theories, at least as

20

presently constituted, makes the requisite showing of a strong likelihood of success on the merits of its appeal.

1.

The government first argues that the confidentiality provision’s temporal limitation excludes the records implicated by modified SAVE. Gov’t Mot. 15–16. Section 405(c)(2)(C)(viii)(I) protects from disclosure SSNs and related records “obtained or maintained” pursuant to law enacted on or after October 1, 1990. The government submits that this temporal limitation excludes essentially everything flowing from SSA because SSA began issuing SSNs in the 1930s and collecting citizenship or alien-status information in the 1970s. The government reasons from that history that, even if SSNs or related records are disclosed via modified SAVE, the fact that those records exist under a long-existing legal architecture necessarily means their disclosure cannot breach the confidentiality mandate. Gov’t Mot. 15–16.

The statutory terms, however, call for a particular inquiry:

is the disclosed information “obtained or maintained . . . pursuant to [a] provision of law enacted on or after October 1, 1990”? 42 U.S.C. § 405(c)(2)(C)(viii)(I). As to the question posed by the statute—i.e., pursuant to what provision of law is each SSN and related record at issue obtained or maintained— the government’s stay motion identifies no “provision of law,” pre-1990 or otherwise. Instead, it cites an article written by an SSA employee that recounts the history of the SSN and describes SSA’s recordkeeping practices. See Gov’t Mot. 16 (citing Carolyn Puckett, The Story of the Social Security Number, 69 Soc. Sec. Bull. 55 (2009)). Read in its entirety, the article does not adequately answer the question posed by the statute’s terms in a way that would satisfy the government’s burden at this stage.

21

For one thing, the article itself explains that SSA’s Numerical Identification System (Numident)—the database in which SSA maintains records associated with SSNs—is not simply a collection of records fixed when each SSN was first assigned. When information changes—including when statutes require changes in the procedures by which data are “obtained or maintained,” § 405(c)(2)(C)(viii)(I)—SSA adds a new “entry” or “iteration” to each individual’s record. A single Numident record thus can contain dozens, and sometimes hundreds, of entries. Puckett, supra, at 63. The article also surveys the many times, before and after 1990, when Congress enacted laws that altered SSA’s collection and verification of information. See, e.g., Help America Vote Act of 2002, Pub. L. No. 107-252, § 303(a)(5)(C), 116 Stat. 1666, 1710–11; Intelligence Reform and Terrorism Prevention Act of 2004, Pub. L. No. 108-458, § 7213(a)(1)(B)–(C), 118 Stat. 3638, 3830–31.

Neither the government’s briefing nor the present record tells us which Numident entry supplies the information used to fulfill queries from modified SAVE; when that entry was created or updated; or pursuant to what specific statutory authority it has been “obtained or maintained” within the meaning of § 405(c)(2)(C)(viii)(I). That is, the fact that SSA generally began collecting the same broad categories of information long before 1990 does not establish that the particular records at issue here fall outside the temporal limitation established by § 405(c)(2)(C)(viii)(I). Indeed, if the pre-1990 origins of SSA’s system place SSNs outside the confidentiality mandate, as the government now argues, it is unclear what in § 405(c)(2)(C)(viii)(I) would prevent SSA from publicly releasing any—or even every—SSN in its database. Cf. 42 U.S.C. § 1306(a)(1) (similar confidentiality provision).

22

In any event, modified SAVE does not merely transmit preexisting fields from Numident. It also generates new person-specific records at several junctures—and the government’s temporal argument does not address those new records or their implications for the temporal question raised by § 405(c)(2)(C)(viii)(I) either. In responding to a query, SSA compares the information supplied by DHS with its own records and creates a new, query-specific match record, which flags whether matches to its database using the submitted SSN, name, and date of birth were successful and appends the results to the requested citizenship information. DHS likewise creates and retains a person-specific SAVE case for ten years. Although our dissenting colleague notes that the SAVE case itself is not disclosed to the SAVE user, Dissent 8, DHS uses the SAVE case to create a “SAVE case response”—another new, user-facing file—that is disclosed. DHS AR 114–20; Notice of a Modified System of Records, 90 Fed. Reg. 48948, 48950, 48954–55 (Oct. 31, 2025).

Assuming those records are SSNs or “related records” and that the transfers are disclosures within the meaning of § 405(c)(2)(C)(viii), the temporal question is, again, pursuant to what authority are they obtained or maintained. The government does not say. Elsewhere, the government invokes § 1373(c) as authority for the modified-SAVE exchange, but that provision cannot supply the needed pre-1990 authority: Congress enacted § 1373(c) in 1996. Gov’t Mot. 3, 17.

The government thus ultimately at best establishes a potentially salient historical fact: SSA began collecting certain categories of information long before 1990. But the government does not provide adequate support for the proposition its argument requires: that the particular SSNs and related records implicated by modified SAVE are neither obtained nor maintained pursuant to any post-1990 law. Of course, had the government timely raised the argument in the

23

district court or sought to fully develop it in the way the district court invited, the picture might look quite different. And full merits briefing in this appeal might also flesh out the arguments (and potential responses) in ways that alter our understanding of the meaning of the confidentiality provision. But on the briefing and record before us at this preliminary stage, the argument does not make a strong showing that the temporal limitation defeats plaintiffs’ claim.

2.

The government next argues that modified SAVE does not “disclose” SSNs or “related records” in a way that § 405(c)(2)(C)(viii)(I) bars. The theory is that the sole information disclosed to a SAVE user is citizenship status (and, when applicable, an indicator that the person is deceased). That information, the government posits, is neither an SSN nor a “related record” that identifies an individual. Gov’t Mot. 16– 17. At least on the record before us at this stage, that account of modified SAVE is inadequate to carry the government’s burden.

First, modified SAVE undisputedly involves at least one disclosure of an SSN in the most literal sense. When a SAVE user submits only a partial SSN and the query produces a match, SSA sends DHS the complete nine-digit number. Gov’t Mot. 6, 15; DHS AR 424. SSA thus gives DHS a full SSN that DHS did not previously possess. Assuming the SSN otherwise falls within § 405(c)(2)(C)(viii)(I), that is plainly a disclosure. The government acknowledges the transfer of a person’s full SSN—and, in fact, explains in its stay motion the conditions under which it occurs—but does not address how it may fall outside the confidentiality mandate. Gov’t Mot. 6.

24

Second, modified SAVE does more than merely return an indicator for citizenship or death status. It verifies the information supplied by the SAVE user against SSA’s records, including as to a person’s SSN. For each query, SSA takes the submitted SSN, name, and date of birth and creates a query- specific match record containing three separate results: SSN match—true or false; name match—true or false; date-of-birth match—true or false. SSA then sends those new matching results to DHS together with citizenship and other information. DHS AR 116, 225–26, 424, 437–38.

There are sound reasons to think verification of that kind might well amount to a “disclos[ure]” of an SSN for purposes of § 405(c)(2)(C)(viii)(I). Although we have no need to authoritatively construe the provision’s use of that term at this stage, we have repeatedly recognized in related privacy contexts that an agency can reveal new information by confirming its accuracy. As we have explained, confirmation by an agency “in a position to know” may be revealing because it removes “any lingering doubts” about the information in question. Frugone v. CIA, 169 F.3d 772, 774–75 (D.C. Cir. 1999) (citation omitted); Knight First Amend. Inst. at Columbia Univ. v. CIA, 11 F.4th 810, 816 (D.C. Cir. 2021) (citation omitted).

Here, the verifying agency itself assigns and maintains the records being checked. When SSA reports an SSN match, it confirms that its records associate the submitted number with the person identified in the query; and when it reports no match, it communicates the contrary. Indeed, the familiar Glomar response to a Freedom of Information Act request—refusing either to confirm or deny whether particular records exist— rests on the premise that either answer may itself disclose protected information. See Wolf v. CIA, 473 F.3d 370, 374 (D.C. Cir. 2007). Separately, we have rejected the categorical

25

proposition that information cannot be “disclosed” to a recipient whenever the recipient already knows it. See Pilon v. Dep’t of Just., 73 F.3d 1111, 1119–26 (D.C. Cir. 1996). Those authorities of course do not definitively resolve the meaning of § 405(c)(2)(C)(viii)(I). They do, however, call into question the government’s premise that verification cannot amount to disclosure when the requester supplied the information being verified. After all, if a party asked SSA to verify that a particular nine-digit number it believes may be a given person’s SSN is in fact the correct SSN, and SSA would respond with either a yes or a no rather than declining to answer, it is quite conceivable that an affirmative answer amounts to a disclosure by SSA of the person’s SSN at some meaningful level.

There appears to be no dispute that verification of an SSN occurs when SSA transfers information to DHS in response to a query using modified SAVE; and that verification itself involves a possible violation of § 405(c)(2)(C)(viii)(I)’s confidentiality mandate. As for the ensuing transfer of information from DHS to the querying SAVE user, the present record leaves uncertain precisely how, and to what extent, SSA’s match information ultimately reaches a SAVE user. At least some error messages appear in user-facing responses. See DHS AR 762. And DHS’s own description of the system states that, when a corresponding record is located, SAVE sends a “SAVE case response” that “includes the data elements used to create the case” and other fields supplied by SSA. Notice of a Modified System of Records, 90 Fed. Reg. at 48950; see also DHS AR 1379, 1443–44. The district court specifically identified this as a question on which further factual development could have been useful had the issue been timely presented. Add. 95–97. Those sorts of factual uncertainties weigh against the government at this stage.

26

Finally, the government’s argument about “related records” rests on a similarly narrow—possibly too narrow— description of what modified SAVE discloses. Congress defines a “related record” as “any record, list, or compilation that indicates, directly or indirectly, the identity of any individual” for whom an SSN or request for one is maintained. 42 U.S.C. § 405(c)(2)(C)(viii)(IV). The government reasons that a citizenship (or death status) indicator does not itself identify anyone and that the identifying information instead “flows the other way,” from the SAVE user to DHS. Gov’t Mot. 16.

That, though, is not the specific inquiry called for by the statutory definition. The statute does not ask whether one field in a record—“U.S. Citizen,” for example—alone identifies a person. It asks whether the “record, list, or compilation” indicates the identity of an individual, “directly or indirectly.” 42 U.S.C. § 405(c)(2)(C)(viii)(IV). The government’s motion narrows both parts of that definition: it focuses on a single data field rather than the record in which the field appears, and it replaces “directly or indirectly” with an ellipsis when quoting the statute. Gov’t Mot. 16; Pls.’ Resp. 20–21.

The records produced by modified SAVE seem to fit the definition as written. DHS creates a separate SAVE case for each person submitted and retains that record for ten years. Notice of a Modified System of Records, 90 Fed. Reg. at 48950, 48954–55. And the “SAVE case response” DHS sends to a user “includes the data elements used to create the case” together with additional citizenship or immigration information. Id. at 48950. For bulk submissions, users may also generate reports listing cases, statuses, and SAVE responses. Id. at 48951. A record that links a person’s submitted name, date of birth, and SSN to a citizenship response can indicate whose information it reports even if the

27

citizenship field itself contains no name. The government does not explain why such a record falls outside the definition merely because the requester initially supplied many of its data elements. For that reason, too, the government has not made a strong showing that the records disclosed through modified SAVE fall outside § 405(c)(2)(C)(viii)(IV).

IV.

The government does not argue that it could be entitled to a stay pending appeal even if it fails to make a strong showing of a likelihood of success on the merits. We thus have no occasion to consider the remaining stay factors—whether the government would be irreparably injured absent a stay, whether a stay would substantially injure the other parties, and where the public interest lies. Nken, 556 U.S. at 434. We nonetheless briefly note some considerations that would inform that inquiry, as to which the government would bear the burden to show that the circumstances would justify an exercise of our equitable discretion. Id. at 433–34.

The government’s principal operational harm from the denial of a stay pending appeal is that, without interim access to modified SAVE during the pendency of the appeal, some citizenship verifications are slower and more cumbersome. Gov’t Mot. 26–27. And the government identifies certain specific programs that will be impeded without access to modified SAVE, including verifications of eligibility for commercial driver’s licenses and certain housing benefit programs. Gov’t Mot. 26. Those operational consequences are real, but it also bears noting that they are not of an all-ornothing character: whatever its limitations, the preexisting SAVE program in operation for decades remains available to the states and to federal programs. The harm stems from the unavailability of modified SAVE’s SSN- and bulk-search

28

functionalities, not the loss of SAVE-based verification altogether—and then only for the pendency of this appeal.

Although the chief use of modified SAVE giving rise to this litigation concerns citizenship verifications related to voter eligibility, disruptions to that use do not present the kind of imminent harm that would warrant intervention in this posture. Federal law constrains systematic voter-list maintenance in the immediate time ahead. The National Voter Registration Act makes it unlawful to undertake systematic voter removal within the 90-day period preceding a federal primary or general election. See 52 U.S.C. § 20507(c)(2)(A). As the government itself argued when opposing plaintiffs’ request for preliminary relief in the district court, the NVRA’s 90-day limitation was “fatal” to a claim of imminent harm premised on systematic voter-roll maintenance. See Add. 103–04. By the time the government sought a stay pending appeal in this court, that limitation was already operative in several states and soon would be in many more: when the government filed its motion on July 8, for instance, Florida (an amicus supporting the government) was already within the 90-day period preceding its August 18 primary, and the 90-day period leading up to the general election was less than one month away.

While the Supreme Court’s recent order granting a stay in Trump v. California, No. 26A124 (Aug. 24, 2026), focused on the timing of an asserted election-related harm, the situation there was materially different. The Court emphasized that, absent interim relief, ordinary appellate review would itself deprive the Executive of an ability to pursue its election-related objectives: “reversal of the District Court’s judgment would come too late.” Id. (slip op. at 9). Here, by contrast, federal law itself—in the form of the NVRA—constrains the principal election-related use of modified SAVE during the relevant period. Denying a stay thus does not deprive the government or the states of an otherwise available opportunity to undertake

29

systematic voter-list maintenance while ordinary appellate review proceeds. And although our dissenting colleague suggests that modified SAVE could be used for individualized decisions that may fall outside the NVRA’s reach, Dissent 20 n.4, the government itself drew no such distinction when it invoked the NVRA to address the imminence of election- related harm in the district court. In any event, the preexisting version of SAVE remains available during the appeal for individualized queries of the sort it has long permitted.

As for the competing harms to plaintiffs that would attend the grant of an interim stay, the district court described the adverse consequences to citizens from using inaccurate SSA citizenship information in modified SAVE, including the risk—already borne out in Texas—that citizens may be required to prove citizenship to remain registered and, in some cases, may have their registrations cancelled. Add. 103–04. The public interest does not favor interim restoration of a system the government has not made a strong showing it may lawfully operate. See League of Women Voters of the United States v. Newby, 838 F.3d 1, 12 (D.C. Cir. 2016).

* * * * *

Because the district court’s ruling under the Social Security Act independently supports its judgment, we do not address the court’s additional holdings concerning DHS’s statutory authority, the Privacy Act, or arbitrary-and-capricious review. The government has not made the requisite “strong showing that [it] is likely to succeed on the merits” of the Social Security Act claim, Nken, 556 U.S. at 434, and we therefore deny its motion for a stay pending appeal.

KATSAS, Circuit Judge, dissenting: For decades, states have obtained data regarding citizenship and immigration status from the Department of Homeland Security to assess eligibility for public benefits and voting. DHS answers these queries through its Systematic Alien Verification for Entitlements (SAVE) database. Before 2025, SAVE had limited utility: States could submit only individualized queries, DHS had no means of confirming the citizenship of U.S.-born individuals, and DHS lacked access to relevant records of the Social Security Administration. After multiple states sued, demanding that DHS make SAVE more effective, the agency implemented changes that permitted bulk queries and allowed internal agency use of social security numbers to determine the citizenship of individuals lacking an immigration number from DHS.

A voting-rights organization and a privacy organization challenged these changes. On summary judgment, the district court vacated the notices announcing the changes and the modified SAVE program. For the reasons set forth below, I would stay the order pending the government’s appeal.

I

A

The Immigration Reform and Control Act of 1986 (IRCA)

directed the Department of Homeland Security’s predecessor agency to “implement a system for the verification of immigration status.” Pub. L. No. 99-603, § 121(c)(1), 100 Stat. 3359, 3391. Congress requires states and some federal agencies to use this system to assess eligibility for a wide array of federal benefits. See, e.g., 42 U.S.C. § 1320b-7(a), (b)(1)– (4), (d)(3) (Temporary Assistance for Needy Families, Medicaid, unemployment compensation, and Supplemental Nutrition Assistance Program); id. § 1436a(d)(3) (housing benefits); 20 U.S.C. § 1091(g) (student aid); see also 49 C.F.R.

§ 383.73(m) (commercial driver’s license); 6 C.F.R. § 37.13(b) (REAL ID).

To comply with IRCA, DHS administers the Systematic Alien Verification for Entitlements (SAVE) program. SAVE allows federal, state, and local government agencies to query DHS about the citizenship or immigration status of individuals. The federal government also uses SAVE to control “access [to] sensitive government functions—such as employment in government positions, entry to secure facilities,” and “government-issued licenses and credentials.” Add. 88. SAVE does not itself determine eligibility for any benefits; ultimate eligibility determinations are left to the querying agencies that use SAVE. 42 U.S.C. § 1320b-7(d)(5).

Congress also has required states to ensure that their voter-

registration records are accurate, see 52 U.S.C. §§ 21083(a)(4), 20501(b)(4), and prohibited aliens from voting in federal elections, see 18 U.S.C. § 611(a). Furthermore, under the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 (IIRIRA), DHS has the “[o]bligation to … respond to an inquiry by a Federal, State, or local government agency, seeking to verify or ascertain the citizenship or immigration status of any individual within the jurisdiction of the agency for any purpose authorized by law, by providing the requested verification or status information.” 8 U.S.C. § 1373(c). Since 2005, states have used SAVE to verify that voters are citizens. Today, 27 states use SAVE for that purpose. From January 1, 2025, to April 1, 2026, these states made some 60 million voter-verification queries to SAVE. In all, over 1,300 federal, state, and local government agencies use SAVE, which processed some 25 million queries in fiscal year 2024 and 200 million queries in fiscal year 2025. Add. 83; About SAVE, USCIS, https://perma.cc/XXG4-498F.

B

Before 2025, SAVE had three significant shortcomings.

First, it could not verify the citizenship of individuals born in the United States. Second, SAVE could access only DHS records linked to an individual’s DHS numeric identifier, such as an alien registration number. It could not access records of the Social Security Administration (SSA) or conduct searches using social security numbers (SSNs). Third, SAVE could process verification requests only one individual at a time; it could not process bulk requests. According to the plaintiffs themselves, these shortcomings made SAVE “exceedingly limited in scope and functionality.” First Amended and Supplemental Complaint, ECF Doc. 61, at 2.

Dissatisfied with these limitations, a group of states sued DHS in the District Court for the Northern District of Florida in late 2024. The states alleged that SAVE’s deficiencies made DHS unable to comply with its obligation under IIRIRA to respond to their inquiries about citizenship or immigration status. The states and DHS resolved the case through a settlement agreement executed in November 2025 and approved by the Northern District in December 2025. The agreement required DHS to ensure that SAVE could “integrate with the Social Security Administration to allow searches with full SSNs” or “with last-four-digits SSNs” and could “process bulk upload verification requests so that users of the system will not need to input verification requests one-by-one.” Florida v. DHS, No. 24-cv-509, 2026 WL 1968339, at *1 (N.D. Fla. July 7, 2026) (cleaned up).

In March 2025, President Trump ordered DHS to ensure that state and local officials have “access to appropriate systems for verifying the citizenship or immigration status of individuals registering to vote or who are already registered.”

Exec. Order No. 14248, Preserving and Protecting the Integrity of American Elections, 90 Fed. Reg. 14005, 14006 (Mar. 25, 2025). He also ordered the SSA to “take all appropriate action to make available the Social Security Number Verification Service, the Death Master File, and any other Federal databases containing relevant information to all State and local election officials engaged in verifying the eligibility of individuals registering to vote or who are already registered.” Id. at 14007. Thus, in May 2025, DHS announced two major changes to the SAVE database. First, SAVE users could now verify the citizenship or immigration status of individuals using their SSNs. Second, SAVE users could submit queries in bulk, checking their entire voter-registration lists against federal databases to identify potential non-citizen voters. Optimizing SAVE: New Options to Create Cases with a Social Security Number and by Bulk Upload, USCIS, https://perma.cc/BY4S-AXKP. I refer to this new version as “modified SAVE.”

With modified SAVE, the requesting agency enters into a spreadsheet the following required information for each person whose citizenship or immigration status it seeks to verify: first and last name, date of birth, the reason for verification, and at least one numeric identifier, such as an SSN or any DHS identifier. DHS AR 1443–45. If the user provides SSNs, SAVE then checks individuals listed in the spreadsheet against the SSA’s records. Id. at 1364. As relevant here, the SSA reports to DHS whether the submitted name, date of birth, and SSN match its records. Add. 18. If the requesting agency supplies a partial SSN that matches, the SSA reports the full SSN to DHS. Id. The SSA also reports to DHS whether its records show each individual to be a citizen, the immigration status of any non-citizen, whether the individual was foreign- born, and whether the individual is deceased. Id.

If the search of SSA records flags a potential non-citizen, DHS attempts to verify citizenship status by other means. Add. 18–19. If a DHS numeric identifier is available, SAVE automatically queries additional federal databases. Id. If those queries do not confirm citizenship, DHS conducts manual searches of yet other DHS systems. Add. 80. If this process confirms that the individual is a citizen, the requesting agency is so informed. Id. at 19. If SAVE returns anything else—such as a non-citizen status, an unconfirmed status, or a death indicator—the requesting agency is told to contact the individual for more information. Id. at 19–20.

II

The lead plaintiffs in this case are two nonprofit organizations: the League of Women Voters and the Electronic Privacy Information Center (EPIC). The League of Women Voters is dedicated to “encouraging Americans to participate in the electoral process,” and it registers people to vote. First Amended and Supplemental Complaint, ECF Doc. 61, at 4–5. EPIC is dedicated to monitoring “government activities that impact individual privacy.” Id. at 6. In September 2025, the plaintiffs sued DHS and the SSA in the District Court for the District of Columbia. The organizations contend they have members who have been incorrectly identified as non-citizens under modified SAVE and thus required to document their citizenship, as well as members whose SSNs have been disclosed without consent. The organizations argue that the agencies’ operation of modified SAVE lacks statutory authorization, violates the Social Security Act and the Privacy Act, and is arbitrary.

The district court denied a stay under the Administrative Procedure Act, but then granted summary judgment to the plaintiffs. As relevant here, the court concluded that the

6

plaintiffs have Article III standing to challenge the operation of modified SAVE, that its operation violates substantive disclosure restrictions in the Social Security Act and the Privacy Act, that DHS and the SSA failed to give adequate notice of the new uses of data, and that the agencies acted arbitrarily. The court issued final, universal relief purporting to vacate modified SAVE, including its ability to accept bulk queries from requesting agencies, and the notices implementing modified SAVE.

In response to the D.D.C. order, DHS and the SSA disabled modified SAVE. Arguing that this order conflicted with the settlement agreement approved by the Northern District of Florida, the state plaintiffs moved that court to enforce the settlement agreement against DHS. The Northern District concluded that DHS had violated the settlement agreement, granted the enforcement motion, and ordered DHS to reinstate the bulk-upload and SSN-search functions of modified SAVE as to the four state plaintiffs. Florida v. DHS, 2026 WL 1968339, at *4. The League of Women Voters and EPIC intervened in the Northern District and appealed the enforcement order to the Eleventh Circuit. Florida v. DHS, No. 26-12533 (11th Cir. July 21, 2026). In the D.D.C., the League of Women Voters and EPIC moved to enforce the summary- judgment order. In a minute order, that court deferred ruling on the motion to enforce, pending the outcome of the Eleventh Circuit appeal.

DHS and the SSA (collectively “the government”)

appealed the D.D.C. summary-judgment order and moved in that court for a stay pending appeal. The district court denied the stay motion, and the government then moved this Court for a stay pending appeal.

In assessing the government’s stay motion, we consider the government’s likelihood of success on the merits, whether it will suffer irreparable injury absent relief, and the balance of the equities. Trump v. California, Nos. 26A124, 26A139, 2026 WL 2473573, at *2 (U.S. Aug. 24, 2026) (per curiam).

III

The government argues that the plaintiffs are unlikely to succeed on appeal because they lack Article III standing and their claims are without merit. In determining likelihood of success at the stay stage, we may consider standing and merits questions, and we may do so in either order. See Mullin v. Doe, 146 S. Ct. 2121, 2137 (2026) (plurality). I conclude that the government is likely to succeed on the merits, so I need not address standing at this stage.

A

The government is likely to succeed in showing that modified SAVE does not violate the Social Security Act’s prohibition on disclosure of SSNs or related records. That Act provides:

Social security account numbers and related records that are obtained or maintained by authorized persons pursuant to any provision of law enacted on or after October 1, 1990, shall be confidential, and no authorized person shall disclose any such social security account number or related record.

42 U.S.C. § 405(c)(2)(C)(viii)(I). In considering whether the operation of modified SAVE violates this disclosure bar, we must consider both (1) disclosures from the SSA to DHS and

(2) disclosures from DHS to the requesting agency. In my view, section 405 does not bar either category of disclosure.

To begin, the bar does not apply to the SSA’s disclosures to DHS, because the SSA obtains and maintains its relevant records pursuant to laws enacted well before 1990. The Social Security Act of 1935 authorizes the SSA to create and maintain SSNs. See Pub. L. No. 74-271, § 808, 49 Stat. 620, 638; Identification of Taxpayers under Title VIII of the Social Security Act, 1 Fed. Reg. 2023, 2024 (Nov. 7, 1936). And, in 1972, amendments to that Act instructed the SSA to “require of applicants for social security account numbers such evidence as may be necessary to establish the age, citizenship, or alien status, and true identity of such applicants.” Social Security Amendments of 1972, Pub. L. No. 92-603, § 137(2), 86 Stat. 1329, 1364–65 (codified at 42 U.S.C. § 405(c)(2)(B)(ii)). In sum, the SSA creates, obtains, and maintains SSNs and records related to age, citizenship and alien status, and identity pursuant to statutes enacted decades before 1990.1 And that information is exactly what the SSA discloses to DHS. 90 Fed. Reg. at 48950, 48952.2

1 The majority finds it implausible that section 405’s disclosure bar may not apply to the SSA’s handling of core records like SSNs. Ante, at 21. But the bar itself was not even enacted until November 1990. See Food, Agriculture, Conservation, and Trade Act of 1990, Pub. L. No. 101-624, §§ 1735(b), 2201(c), 104 Stat. 3359, 3792, 3952. And Congress enacted the bar in direct conjunction with provisions newly permitting other agencies, such as the Department of Agriculture, to collect SSNs. See id. §§ 1735(a), 2201(a)–(b), 104 Stat. at 3791–92, 3951–52. So it is thus hardly surprising that this 1990 bar does not cover the SSA’s management of its own core records, though of course other statutes may.

2 The majority contends that SAVE generates new types of records: a “match record” from the SSA, a “SAVE case” that DHS

Moreover, DHS discloses neither SSNs nor related records to the requesting agency. Instead, DHS conveys only information about the individual’s citizenship or immigration status (plus whether the individual is still alive). See 90 Fed. Reg. at 48950; Add. 18–19. Thus, if the SSA provides a matching SSN to DHS, the SSN itself never leaves DHS. See id. Nor does DHS disclose any related records covered by the disclosure bar. A “related record” is “any record, list, or compilation that indicates, directly or indirectly, the identity of any individual with respect to whom a social security account number or a request for a social security account number is maintained.” 42 U.S.C. § 405(c)(2)(C)(viii)(IV). The plaintiffs note that DHS “obtain[s]” such records from the SSA when it receives a “full SSN for all matches (when a partial SSN is provided) and a ‘true/false’ match response on certain inputted fields: SSN, name, and date of birth.” Plaintiffs’ Resp. at 21 (cleaned up). But even if DHS obtains such covered data from the SSA, DHS never discloses it to the requesting agency or to anyone else. Nor does DHS “indicate[], directly or indirectly, the identity of any individual,” 42 U.S.C. § 405(c)(2)(C)(viii)(IV), because its disclosure to the requesting agency communicates only what SSA records say about the citizenship of individuals identified by the requesting agency when it provides DHS with a first and last name, date of birth, and SSN or other identifier. Moreover, the Social Security Act itself distinguishes between the “identity” of an individual, which DHS does not provide to the requesting

maintains for ten years, and SAVE’s responses to user queries. Ante, at 22. However, the “match record” merely includes the contents of records that the SSA maintains pursuant to pre-1990 law. See 90 Fed. Reg. at 48952. DHS does not disclose any “SAVE case” records to the requesting agency, except for the responses that SAVE automatically provides. See id. at 48954–55; Add. 19. And as explained below, those responses do not qualify as “related record[s]” under the Social Security Act.

agency, and “the fact that such individual is a citizen or a noncitizen,” which DHS does seek to provide. See id. § 405(c)(2)(B)(i)(III). In sum, SAVE responses are not “related records” because they simply repeat identifying information provided by the SAVE user, in the course of conveying any additional, unprotected information about the identified individual’s citizenship status.3

The district court treated these arguments as forfeited, but we have discretion to excuse forfeitures “in cases involving uncertainty in the law” and in “extraordinary situations with the potential for miscarriages of justice.” Flynn v. Comm’r, 269 F.3d 1064, 1069 (D.C. Cir. 2001). The majority stresses that we should exercise this discretion sparingly, both in general and especially in the context of stay litigation. Ante, at 9–17. I have no quarrel with those propositions in the abstract. But in my view, several considerations support excusing the forfeiture in the quite unusual circumstances presented here.

3 The majority notes that disclosure bars sometimes cover disclosures to individuals who already know the protected information. Ante, at 24–25 (citing Pilon v. DOJ, 73 F.3d 1111, 1119–26 (D.C. Cir. 1996)). Fair enough, but it seems to me quite a stretch to extend that principle to the identifying information at issue here, where the assertedly protected information flows from the requesting agency to DHS, and does so for the sole purpose of generating a discrete response disclosing unprotected information about citizenship or immigration status. Similarly inapposite is the cloak-and-dagger law regarding official acknowledgment and Glomar responses, ante, at 24–25, which applies where the existence or not of agency records is itself protected information. See, e.g., Knight First Amend. Inst. at Columbia v. CIA, 11 F.4th 810, 813–16, 819–20 (D.C. Cir. 2021). Here, it is no secret that the SSA since 1972 has been statutorily required to obtain and maintain records regarding the citizenship or alien status of individuals authorized or required to have SSNs. See 42 U.S.C. § 405(c)(2)(B)(ii).

First, this case involves the ongoing administration of an important federal program mandated by Congress to facilitate eligibility determinations for voting and a wide range of federal benefits. See Pub. L. No. 99-603, § 121(c)(1), 100 Stat. at 3391 (IRCA); 8 U.S.C. § 1373(c) (IIRIRA). The original SAVE program was severely limited in its functionality; among other things, it could not even confirm the citizenship of U.S.-born individuals, and it required queries to be performed one-byone . The modified SAVE program cured those deficiencies, so we should not lightly frustrate its operation based on legal premises that may be erroneous. Instead, we should exercise our “independent power to identify and apply the proper construction of governing law.” Kamen v. Kemper Fin. Servs., Inc., 500 U.S. 90, 99 (1991).

Second, the program implicates various statutory obligations, entitlements, and interests of the states. Federal law requires the states to ensure that their voter-registration rolls are accurate. See 52 U.S.C. §§ 21083(a)(4), 20501(b)(4). It also prohibits aliens from voting in federal elections, see 18 U.S.C. § 611(a), the manner of which is presumptively a state responsibility, U.S. Const. art. I, § 4, cl. 1. How are states to carry out these responsibilities effectively, if they cannot obtain reliable information about the citizenship and immigration status of their residents from a federal government assigned with the primary “power over the subject of immigration and the status of aliens”? Arizona v. United States, 567 U.S. 387, 394 (2012). To help states carry out these responsibilities, as well as the responsibility for enforcing eligibility restrictions governing state-administered federal programs, IIRIRA gives states an affirmative entitlement to receive from DHS information about “the citizenship or immigration status of any individual” within their respective jurisdictions. See 8 U.S.C. § 1373(c) (imposing on DHS the “[o]bligation to respond” to such queries). Likewise, states have important interests in

12

receiving this information to the extent that many state entitlement programs are also limited to United States citizens resident in the state. See Br. of Amici Curiae Iowa, Florida, Indiana, and Ohio at 5–7 (States’ Br.). It is one thing to saddle the United States with the consequences of its own litigation decisions; it is quite another to so saddle the states.

Third, this case involves dueling district-court injunctions, as the district court here has prohibited what the Northern District of Florida has compelled. Specifically, the Northern District ordered DHS to “immediately comply with the courtapproved settlement agreement” in the case before it “by reinstating [the plaintiff states’] access to the bulk-upload and SSN-search features in the [modified] SAVE system.” Florida v. DHS, 2026 WL 1968339, at *4. And the district court here purported to “set[] aside and vacate[] the 2025 SAVE modified system,” Add. 5, thus effectively and universally enjoining its use. The majority notes that the Northern District did not expressly “address the substance of the claims presented here.” Ante, at 16. True enough, though the Northern District did state that its approval of the settlement agreement reflected an “implicit determination that the modifications to the SAVE system were lawful.” Florida v. DHS, 2026 WL 1968339, at *3. And the Northern District did expressly “disagree[] with the conclusions” of the district court here, id., which in turn stated its view that the Northern District had “erred in significant ways” in enforcing the settlement agreement, Add. 107. In any event, the respective orders unquestionably impose conflicting legal obligations, regardless of how the respective district courts might view the underlying merits. And in doing our part to resolve the conflict, we should say what the governing law actually is. In other words, if the Northern District provided the state plaintiffs there with legally justified relief, we should not allow its order to be frustrated based on any litigation missteps by the federal government in this case.

Finally, excusing the forfeiture here would neither prejudice the plaintiffs nor sandbag the district court. The government made its likely winning argument in stay motions before the district court and this Court; the plaintiffs thoroughly responded on the merits both below and here; the district court had a chance to excuse the forfeiture; and the issue depends “on a pure issue of statutory interpretation” that we would review de novo and that does not depend on further factual development. Amcast Indus. Corp. v. Detrex Corp., 2 F.3d 746, 749–50 (7th Cir. 1993) (Posner, J.).

Against all of this, the majority notes that the district court offered the government an opportunity to seek consideration of its forfeited arguments under Federal Rule of Civil Procedure 52(b). Ante, at 13 n* (citing Add. 98 n.3). That rule allows post-judgment motions asking the court to “amend its findings—or make additional findings” and to “amend the judgment accordingly.” But “findings” under Rule 52 involve matters of fact, not “conclusions of law” that the rule separately addresses. Fed. R. Civ. P. 52(a)(1); see Env’t Comm. of Fla. Elec. Power Coordinating Grp., Inc. v. EPA, 94 F.4th 77, 91 (D.C. Cir. 2024) (per curiam). As explained above, the forfeited arguments here turn on what statutes authorize the SSA to obtain or maintain SSNs and information regarding citizenship or immigration status, and on whether the disclosures made by DHS under modified SAVE qualify as “related records” under the disclosure bar in the Social Security Act. As those disputes involve pure questions of law, Rule 52(b) was not an available avenue for the government.

The majority likewise suggests another possibility not mentioned by the district court—that the government could and should have sought to raise its forfeited arguments through a motion to alter or amend the district court’s judgment under Federal Rule of Civil Procedure 59(e). Ante, at 13. True, we

14

have indicated that parties “should” present new arguments by seeking reconsideration in the district court before raising them on appeal. City of New York v. Nat’l R.R. Passenger Corp., 776 F.3d 11, 17 (D.C. Cir. 2015). But there is no categorical requirement to do so, and we have sometimes reached the merits despite even an express waiver below, above and beyond the mere failure to seek reconsideration. United States ex rel. Cimino v. IBM Corp., 3 F.4th 412, 418 n.1 (D.C. Cir. 2021). Moreover, new arguments are substantially disfavored in reconsideration motions under Rule 59(e), which we have described as “not a vehicle to present a new legal theory that was available prior to judgment.” Leidos, Inc. v. Hellenic Republic, 881 F.3d 213, 217 (D.C. Cir. 2018) (cleaned up). So the hypothetical Rule 59(e) motion posited by the majority would have presented essentially the same question that we now confront—whether unusual circumstances warrant excusing a forfeiture. See, e.g., Dyson v. District of Columbia, 710 F.3d 415, 420 (D.C. Cir. 2013). And the government’s failure to move for reconsideration does not undermine any of the reasons for excusing the forfeiture here: Administration of modified SAVE is still important. The states’ interests in receiving information from modified SAVE are still pressing. The two judicial orders still conflict. And the governing legal questions are still cleanly presented.

B

The government is also likely to succeed in showing that modified SAVE does not violate the Privacy Act. It argues that the Privacy Act claims here are not judicially reviewable and that they lack merit. Because the government is likely to succeed on the merits, I need not consider its alternative nonreviewability arguments.

The Privacy Act generally bars agencies from disclosing individuals’ records without consent, 5 U.S.C. § 552a(b), but it exempts “routine use[s],” which are disclosures “compatible with the purpose for which [the record] was collected,” id. § 552a(b)(3), (a)(7). This Court has not settled on a definitive test for compatibility, but every possible formulation sets a low bar. Judge Silberman and Judge Williams construed the term according to its ordinary meaning: A disclosure of a record is “compatible” so long as it does not conflict with or frustrate the purposes for which the record was collected. U.S. Postal Serv. v. Nat’l Ass’n of Letter Carriers, 9 F.3d 138, 144 (D.C. Cir. 1993) (opinion of Silberman, J.); id. at 146–47 (Williams, J., concurring in part). Other circuits, relying on legislative history, require “some meaningful degree of convergence” between the purposes of collection and disclosure. Britt v. Naval Investigative Serv., 886 F.2d 544, 549–50 (3d Cir. 1989); Swenson v. U.S. Postal Serv., 890 F.2d 1075, 1078 (9th Cir. 1989). We need not settle on a “precise definition of ‘compatibility,’” Chichakli v. Tillerson, 882 F.3d 229, 233 (D.C. Cir. 2018), because modified SAVE satisfies “any reasonable formulation of the compatibility test,” Ames v. DHS, 861 F.3d 238, 240 n.1 (D.C. Cir. 2017) (Kavanaugh, J.).

Even if SSN data was originally collected only to establish authorization to work and eligibility for social-security benefits, disclosing that data to confirm eligibility for other benefits and voting neither conflicts with nor frustrates those initial purposes. Similarly, such disclosure likely satisfies Britt’s stricter standard as well, because the same purpose runs through the collection and disclosures here: establishing individuals’ eligibility to work, vote, or receive government benefits. The SSA maintains SSNs to match individuals to benefits they are entitled to; SAVE uses the same data to match

16

individuals to extant records of their citizenship or immigration status, which allows requesting agencies to determine eligibility for those same benefits, for other public benefits, and for voting. The district court likely erred by framing the collection purpose at too low a level of generality, which is at odds with both the statute’s forgiving text (“compatible”) and with the SSN’s long-established role as a “nearly universal identifier.” Puckett, The Story of the Social Security Number, 69 Soc. Sec. Bull. no. 2 (2009), https://perma.cc/59V7-XG2D.

2

The government is also likely to succeed in showing that the Privacy Act’s procedural requirements provide no basis for affording prospective relief against the future operation of modified SAVE.

Under the Privacy Act, a system of records is “a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.” 5 U.S.C. § 552a(a)(5). When an agency establishes or revises a system of records, it must publish in the Federal Register a notice of the system’s “existence and character,” including “each routine use” of the records. Id. § 552a(e)(4). An agency may not put a new routine use of the information into effect until at least 30 days after the notice is published, during which time there must be “an opportunity for interested persons to submit written data, views, or arguments to the agency.” Id. § 552a(e)(11). The notice is called a System of Records Notice (SORN). The parties agree that SAVE qualifies as a system of records subject to these notice requirements.

Neither DHS nor the SSA published a SORN when the agencies set up modified SAVE in May 2025, but each agency

17

later published a SORN regarding its respective new routine uses of data. The SORNs described those new uses, invited comments within 30 days, and provided that the new uses would become effective at the close of the comment period. See Notice of a Modified System of Records, 90 Fed. Reg. 48948, 48948–50 (Oct. 31, 2025) (DHS); Notice of a Modified System of Records, 90 Fed. Reg. 50879, 50879–81 (Nov. 12, 2025) (SSA). The SORNs could not retroactively authorize any uses of data that occurred before their effective date. But now that the agencies have provided the requisite notice and opportunity to comment, any past procedural violations cannot justify forward-looking relief against modified SAVE.

The district court concluded that the SORNs failed to provide the requisite opportunity for comment. Relying on cases concerning notice-and-comment rulemaking under the APA, the court reasoned that the SORNs, in making modified SAVE effective on the last day of the comment period, made clear that the opportunity to comment was not “meaningful” and that the administrative “process was anything but openminded .” Add. 59–60. But unlike the APA, which requires “notice,” an “opportunity” to comment, and “consideration” of the comments, 5 U.S.C. § 553(c) (emphasis added), the Privacy Act requires only “notice” and “opportunity” to comment, id. § 552a(e)(11). Given the ubiquity of APA notice-andcomment procedures, Congress’s omission of the “consideration” requirement for SORNs is striking. Moreover, the opportunity to comment was meaningful despite the effective date set at 30 days out: The agencies might have changed their minds based on comments received, either before or after the original effective date. A rule promulgated pursuant to APA notice-and-comment procedures binds the agency once it is final. See, e.g., Humane Soc’y of the U.S. v. USDA, 41 F.4th 564, 575 (D.C. Cir. 2022). In contrast, nothing would have prevented DHS or the SSA from ending the new

18

routine uses of data for modified SAVE, even after its effective date, if the agencies found persuasive any comments submitted during the 30-day period. So, announcing the effective date denied no “meaningful” opportunity to comment. Furthermore, the district court’s analysis would have been mistaken even under the APA requirement for “consideration” of comments. In Little Sisters of the Poor Saints Peter and Paul Home v. Pennsylvania, 591 U.S. 657 (2020), the Supreme Court held that the APA imposes no “open-mindedness test” on agencies considering proposed rules, and reviewing courts may not impose such atextual procedural requirements on the agencies. Id. at 685; see also Vt. Yankee Nuclear Power Corp. v. NRDC, 435 U.S. 519, 524–25, 549 (1978). In sum, the SORNs likely satisfied the Privacy Act’s procedural requirements of notice and an opportunity to comment.

Whether styled as an injunction or vacatur, forward-

looking relief must rest on ongoing or threatened unlawful conduct, not past violations. See Little Sisters, 591 U.S. at 686 & n.14; City of Los Angeles v. Lyons, 461 U.S. 95, 102–03 (1983). Here, there was likely no ongoing procedural violation when the district court entered summary judgment. Once 30 days elapsed from each SORN’s publication, the requisite notice and opportunity to comment had been provided. With no ongoing or imminent procedural violation to remedy, the prospective vacatur of modified SAVE was likely erroneous.

C

The government is likely to succeed in showing that the adoption of modified SAVE was not arbitrary. As explained above, that program is manifestly reasonable: It advances important government interests such as complying with IIRIRA, enforcing eligibility restrictions for federal benefits, and ensuring election integrity. The district court’s only basis

19

for claiming arbitrariness was that the government did not engage with comments. Add. 62–63. That conclusion rested on the legal premise that the government could not establish the close of the comment period as the effective date. Id. As that premise is likely mistaken, the court likely had no basis on which to rest a holding of arbitrariness.

IV

The government will suffer irreparable harm absent a stay.

Its “inability to enforce its duly enacted plans clearly inflicts irreparable harm on” it. Abbott v. Perez, 585 U.S. 579, 602 n.17 (2018); see also Make the Rd. N.Y. v. Mullin, 179 F.4th 16, 25 (D.C. Cir. 2026) (“the Government is harmed by an improper intrusion by a federal court into the workings of a coordinate branch of the Government” (cleaned up)). Vacatur of the bulk-process and SSN-lookup functions of modified SAVE makes it much more difficult for DHS to carry out its IIRIRA duties effectively, which no one disputes are legitimate. Cf. Maryland v. King, 567 U.S. 1301, 1303 (2012) (Roberts, C.J., in chambers). And the dueling judicial orders put the government in an impossible position: To comply with the order under review here, the government must violate an order of the Northern District of Florida.

V

The balance of equities tilts in the government’s favor. In analyzing that balance, we consider both the parties’ interests and the public interest. See Allen v. Milligan, 146 S. Ct. 1377, 1381 (2026) (per curiam).

The district court’s order inflicts significant harm on the government. Without modified SAVE, it is much more difficult to protect the “integrity of the electoral process,” which is an “interest[] of the highest importance.” First Nat’l

Bank of Bos. v. Bellotti, 435 U.S. 765, 788–89 (1978). Electoral integrity is also a priority of the administration, see Exec. Order No. 14248, 90 Fed. Reg. 14005, and of the states that sued to compel effective performance of DHS’s legal obligations under IIRIRA, Florida v. DHS, 2026 WL 1968339, at *1. The order also creates security vulnerabilities for the government, which uses SAVE to control “access [to] sensitive government functions—such as employment in government positions, entry to secure facilities,” and “government-issued licenses and credentials.” Add. 88. And it frustrates eligibility determinations for a wide array of federal programs, ranging from SNAP benefits and Medicaid to Department of Housing and Urban Development eligibility determinations for federal housing programs. See 42 U.S.C. § 1320b-7(b)(1)–(4), (d)(3); id. § 1436a(d)(3), (f). Finally, the order hamstrings the states’ ability to effectively police eligibility for state professional licenses and for voting in state elections. See States’ Br. at 5– 7. For example, appearing as a defendant-intervenor below, the State of Texas explained that modified SAVE helps it “maintain[] accurate voter rolls, prevent[] illegal votes, and ensur[e] fair and accurate elections.” State of Texas’s Emergency Motion to Intervene, ECF Doc. 43, at 7. 4

4 The majority notes that the National Voter Registration Act (NVRA) prohibits states from conducting “any program the purpose of which is to systematically remove the names of ineligible voters” from official lists within 90 days of a federal primary or general election. 52 U.S.C. § 20507(c)(2)(A); see ante, at 28. But the plaintiffs did not invoke the NVRA to downplay the immediate harms to the federal government and the states from enjoining modified SAVE. And it is unclear to me whether the NVRA covers modified SAVE. For one thing, the “purpose” of modified SAVE, which is run by a federal agency, is to generate information for a wide variety of federal and state agencies seeking the information for a wide variety of purposes. Moreover, even for requesting agencies

On the other side of the ledger, granting a stay would impose relatively little harm on the plaintiffs and their members. Individuals who were issued SSNs before they became citizens, but who have not updated the SSA with their citizenship status, will not lose the right to vote. Instead, they will simply have to provide proof of citizenship to remain on the voter rolls of state or local governments. That burden might qualify as a concrete injury for purposes of Article III standing, ante, at 8, but it is not an especially substantial one. The alleged privacy harms are also modest: At worst, an individual’s SSN will be known by one more federal agency (DHS), but never will be disclosed to the requesting agency or the public. Unsurprisingly, the record contains no evidence of significant harm to the plaintiffs’ members during the period between the denial of an APA stay in November 2025 and the grant of summary judgment in June 2026. And even if the public interest in using SSNs for modified SAVE were undercut by privacy considerations, the public interest at a minimum would still favor allowing states to do bulk searches without SSNs, which the district court has also effectively enjoined.

focused on voter qualifications, SAVE itself makes no final eligibility determinations. See 42 U.S.C. § 1320b-7(d)(5). And states may use information from modified SAVE to make decisions regarding voter eligibility individually rather than “systematically.” Regardless, states always may run programs to systematically remove the names of voters who have died—another piece of information that modified SAVE can provide. 52 U.S.C. § 20507(c)(2)(B)(i), (a)(4)(A); Add. 18. And the NVRA imposes no restriction on the efforts of state and federal agencies to assess eligibility in contexts other than voting.

VI

For these reasons, I would grant the government’s motion for a stay pending appeal. As my colleagues deny the motion, I respectfully dissent.