21 states and the District of Columbia are suing the Department of Transportation and Department of Homeland Security over demands for access to 17 million driver records from the Commercial Driver's License Information System, citing violations of privacy laws and federal overreach.
- Two lawsuits filed Aug. 13 in U.S. District Court for the Eastern District of Virginia challenge federal demands for CDLIS records containing driver names, dates of birth, license numbers, and Social Security Numbers
- The Federal Motor Carrier Safety Administration initially demanded the data on June 25, followed by an identical demand from the Department of Homeland Security via subpoena on July 28
- Federal agencies allegedly threatened to terminate AAMVA's federal grants and contracts if the organization did not comply with the data demands by August 17
- States argue the requests violate the Driver's Privacy Protection Act and state privacy laws, with concerns about how the sensitive data would be used and protected
- The lawsuits seek to declare the data demands unlawful, prevent data transfer to federal agencies, and prohibit any termination of grants based on noncompliance
Twenty-one states and the District of Columbia are suing the Department of Transportation, DOT officials, and the American Association of Motor Vehicle Administrators (AAMVA) over a DOT demand for AAMVA to turn over more than 17 million driver records.
A separate lawsuit from 22 states and D.C. targets the Department of Homeland Security for making an identical demand of AAMVA. Both lawsuits were filed Aug. 13 in the U.S. District Court for the Eastern District of Virginia.
AAMVA is a non-profit organization that is contracted by the DOT to operate the Commercial Driver’s License Information System (CDLIS) that states use to ensure CDL applicants and holders have only one driver’s license and one complete driver record, and to ensure that states do not improperly issue CDLs to applicants with a history of unsafe commercial driving.
According to the lawsuits, on June 25, the Federal Motor Carrier Safety Administration (FMCSA) sent a letter to AAMVA with an “unprecedented demand,” the states said: “That AAMVA turn over records containing the name, date of birth, State of record, license number, and Social Security Number of every driver in the entire CDLIS database going back five years, comprising some 17 million pointer records.”
Additionally, for any driver record that did not include a Social Security Number, FMCSA requested the date when the number was removed from the record.
A subsequent subpoena from DHS stated the information would be used for “investigating illegal practices in commercial driver’s license (CDL) schools, identifying and addressing criminal fraud regarding the issuance of CDLs to illegal aliens, and conducting civil immigration enforcement," according to the lawsuits.
States suing DOT and FMCSA, along with DOT Secretary Sean Duffy and FMCSA Administrator Derek Barrs, argue that the request violates privacy and other laws.
How we got here
Following FMCSA’s June 25 request, AAMVA sent a response on June 30 raising several concerns, including that the contract between AAMVA and FMCSA did not entitle FMCSA to the requested records. Additionally, the organization said it would have to assess its legal obligations under the Driver’s Privacy Protection Act, as well as privacy laws in all U.S. jurisdictions.
AAMVA also asked FMCSA for “the specific intended use of the information,” saying that it “must understand what agency or agencies will use the information and for what government function or functions.”
FMCSA responded by claiming it was entitled to the requested records, adding that it would “use the CDLIS data as part of our statutory and regulatory oversight in our ongoing efforts to ensure the integrity and issuance of [CDLs]” and “to fulfill its federal safety and regulatory obligations.”
More back-and-forth in writing between FMCSA and AAMVA led to a July 23 in-person meeting between officials of both agencies, the lawsuit added.
“The meeting ended with FMCSA making an explicit threat to terminate all of AAMVA’s federal grants and contracts and potential litigation if AAMVA did not inform DOT by the following day (July 24, 2026) whether AAMVA intended to produce the 17 million pointer records,” the states allege in the lawsuit.
AAMVA finally agreed to provide the requested records “on or around” Aug. 17. AAMVA also asked FMCSA not to follow through on the threat to terminate contracts and grants because “[d]oing so will cause significant disruption to the national commercial driver licensing program, including CDLIS. Disruption to these programs, particularly CDLIS, will have immediate negative impacts on all jurisdictions, including the inability for all 50 states and the District of Columbia to issue or renew any CDL as well as non-CDL driver licenses.”
AAMVA informed states on July 27 of FMCSA’s demand, telling states that despite its objections, “[f]ederal statutes establish FMCSA access to all information in CDLIS, and the CDLIS Cooperative Agreement [between FMCSA and AAMVA] provides that AAMVA shall make available to FMCSA all information on driver records.”
Many states responded in opposition, largely expressing concerns over potential violations of federal and/or state privacy laws.
However, on Aug. 7, AAMVA told FMCSA in a letter that it “viewed itself as caught between DOT’s assertion of a right to unrestricted access to the records on the one hand, and the views expressed by many member states that disclosure is unlawful.”
AAMVA then told FMCSA that it would convene its board on Aug. 14 to consider an “opt-in or opt-out choice by the states whether to authorize AAMVA’s transmission of that state’s data.”
FMCSA rejected the opt-in/opt-out proposal on Aug. 11, calling it “unacceptable,” according to the lawsuit. FMCSA also told AAMVA that if it didn't provide the records by Aug. 17, “DOT will pursue all available options to secure production [of the records], including canceling AAMVA’s grants, filing an enforcement action to enforce the subpoena” -- a subpoena issued by DHS, as explained below -- “and considering terminating its contract with AAMVA.”
On Aug. 12, AAMVA informed states that it would not produce the requested records to either FMCSA or DHS by Aug. 17.
Homeland Security’s involvement
More than a month after FMCSA’s initial request, the Department of Homeland Security subpoenaed AAMVA, in person, on July 28. The subpoena, entitled “Immigration Enforcement Subpoena,” called for the production of exactly the same data demanded by FMCSA.
That subpoena was short-lived, as a letter from AAMVA to DHS referenced an email sent by FMCSA staff in which the staff informed AAMVA that FMCSA and DHS had “coordinated their data demands,” the lawsuit against DHS claims, and that DHS intended to withdraw the subpoena “due to AAMVA’s efforts to cooperate with FMCSA.”
Yet after AAMVA’s Aug. 7 letter to FMCSA detailing that it may not be able to provide data from all 50 states by Aug. 17, DHS served a second subpoena that was identical to its first.
The stated reason for the subpoena, according to the lawsuit, is “investigating illegal practices in commercial driver’s license (CDL) schools, identifying and addressing criminal fraud regarding the issuance of CDLs to illegal aliens, and conducting civil immigration enforcement.”
The lawsuit against DHS requests that the court “quash the subpoena” and “stay compliance with the subpoena pending resolution of the motion to quash.”
The lawsuit against FMCSA, DOT, AAMVA, Duffy, and Barrs asks the court to:
- Declare the data demand unlawful
- Enjoin implementation or enforcement of the data demand as to any records owned or provided by the states
- Prohibit any terminations of grants based on the request or any purported noncompliance with the request
- Enjoin AAMVA from transferring any of the states’ data to FMCSA or DHS
- Enjoin FMCSA and DOT from accepting from AAMVA any transfer of records owned or provided by the states related to the request
