The Trump administration's push to rapidly amass sensitive personal information about hundreds of millions of people living in the U.S. is extending to a rich new vein of information: troves of databases run by states. In some instances, the data could be leveraged to enhance the federal government's immigration enforcement efforts — a break with longstanding norms and practices that also raises legal questions.
"Every week we're seeing new examples of this administration demanding or sharing sensitive government data for unprecedented uses," said Nicole Schneidman, who heads the technology and data governance team at Protect Democracy, a nonprofit legal center that describes its mission as "defeating the authoritarian threat."
Schneidman said Americans should understand "the data that they have entrusted to state governments right now is truly a target."
For instance, the Department of Agriculture told states last month they will need to turn over the names, Social Security numbers, addresses and dates of birth of the tens of millions of people who applied for federal food aid under the Supplemental Nutrition Assistance Program (SNAP) over the last five years — or potentially risk losing federal funds.
Immigration and Customs Enforcement has issued subpoenas to states and localities for records that include the personal information of noncitizens, including for sensitive details on applicants to a California program that gives monthly support to low income, elderly or disabled legal immigrants who do not qualify for Social Security payments.
And earlier this month, federal health officials shared data about millions of Medicaid recipients from a handful of states with the Department of Homeland Security, which oversees immigration enforcement.
Aiding in Trump's effort to consolidate data is an executive order the president signed in March, "Stopping Waste, Fraud and Abuse by Eliminating Information Silos," which calls for the federal government to have "unfettered access" to data from state programs that receive federal funds, including data sets held by third parties.
The order says data sharing can help eliminate "bureaucratic duplication and inefficiency while enhancing the Government's ability to detect overpayments and fraud."
While data sharing across government entities can create efficiencies, it also risks running afoul of federal laws, which are supposed to guard against the federal government having unconstrained access to personal data.
Under the Privacy Act of 1974, federal agencies are supposed to tell the public how they intend to use and safeguard personal data before they begin collecting it, and are not supposed to use data beyond that purpose.
Privacy experts warn of dramatic implications if federal agencies are able to seize the sensitive data currently held only by states and use it broadly without constraint. One fear is that the data could be used by the federal government to create powerful surveillance tools that could be used on all Americans.
"Once this kind of data is in the wrong hands and in particular is aggregated, it can be used for an incredibly broad ranging set of purposes," Schneidman of Protect Democracy said. "It is critical for every American to understand there is no 'undo' button here."
In other countries data has been used to "quash dissent at scale," Schneidman said.
White House spokesperson Taylor Rogers defended the Trump administration's data efforts and dismissed critics as biased.
"President Trump is streamlining data collection across all agencies to increase government efficiency and save hard-earned taxpayer dollars," Rogers wrote in an email. "The Trump Administration is committed to protecting the privacy of Americans."
Leveraging data to track immigrants
For months, the Trump administration has been consolidating data across the federal government with the stated goal of rooting out waste, fraud and abuse, including searching for cases of ineligible noncitizens fraudulently receiving public benefits. At the same time, the effort could also help the administration track noncitizens and scale up deportations.
Initially helmed by tech billionaire Elon Musk, the administration's Department of Government Efficiency has played a key role in merging federal databases for these purposes.
DOGE has gained access to several major federal databases, and earlier this year, the Department of Homeland Security brokered agreements with the Internal Revenue Service and Housing and Urban Development to get data on noncitizens.
This month's Medicaid data transfer appears to be among the largest known cases yet of sensitive data from states being shared across federal agencies.
Top officials at the U.S. Department of Health and Human Services ordered staff at the Centers for Medicare & Medicaid Services to share with DHS sensitive data from a handful of states about millions of their Medicaid enrollees, according to reporting by The Associated Press.
The data pertains to Medicaid recipients in California, Illinois, Washington and Washington, D.C., according to the AP report. Those jurisdictions allow some noncitizens who do not qualify for federal Medicaid to enroll in a version of the program that is funded by the state. (All states receive federal funding to use for emergency care, which can treat low-income patients regardless of their immigration status.)
A number of state officials have voiced outrage that the state data was shared with DHS.
"CMS has long promised the public that it is committed to protecting the integrity and privacy of its data, including not sharing it for immigration enforcement purposes," Illinois Department of Healthcare and Family Services spokesperson Melissa Kula wrote in an email, adding that the state agency is "deeply concerned."
California Gov. Gavin Newsom called the move "legally dubious" and in a letter sent last week, the state's U.S. senators alleged it may have violated the federal Privacy Act of 1974, the Social Security Act and the health privacy law known as HIPAA. The senators called on DHS to destroy the Medicaid data it received.
Public information officers from California, Illinois and Washington told NPR they still have not been notified by CMS about the data transfer and therefore could not confirm what data DHS holds. States routinely must share detailed data about Medicaid enrollees with CMS, including names, addresses, Social Security numbers and immigration status, under the expectation that it will remain confidential and secure.
Health and Human Services spokesperson Andrew Nixon called the transfer "lawful interagency data sharing with DHS" and said it was part of an effort by CMS Director Mehmet Oz to crack down on states "that may be misusing federal Medicaid funds to subsidize care for illegal immigrants."
Oz announced that priority in late May, citing a presidential executive action that calls for federal agencies to ensure federal public benefits are not being accessed by immigrants in the country illegally.
Nixon denied the data transfer to DHS was "unprecedented" in his statement, but declined to respond to an NPR request to explain what the precedent was, or clarify what Medicaid data was shared.
In a statement to NPR, DHS spokesperson Tricia McLaughlin said, "CMS and DHS are exploring an initiative to ensure that illegal aliens are not receiving Medicaid benefits that are meant for law-abiding Americans" but did not respond to questions about the specifics of what data was received.
Sharing sensitive Medicaid data that was collected by CMS to administer the program with another federal agency would be "a totally unauthorized repurposing of this data," said Jeffrey Grant, a former CMS official who left earlier this year after working there for 30 years. "You cannot just hand data over."
Privacy and democracy advocates who have been warning about the potential for federal data grabs at the state level in recent months saw the Medicaid data transfer to DHS last week as a turning point.
"This is exactly why privacy advocates have been sounding the alarm about this administration's unprecedentedly boundless approach to collecting people's data," said Elizabeth Laird, director of equity in civic technology at the nonprofit Center for Democracy and Technology.
"Not only will this discourage states from cooperating with the federal government going forward, it will lead people to miss out on life-saving benefits they're entitled to as they can't trust that their information won't be used against them," Laird said.
The disclosure of Medicaid data to immigration authorities comes as Congress is weighing massive cuts to that program and other parts of the federal social safety net.
"If your goal is a policy program that supports the most vulnerable people in society, this approach makes no sense whatsoever," Ami Fields-Meyer, a senior fellow at the Ash Center for Democratic Governance and Innovation at Harvard University specializing in the intersection between civil liberties and technology, and a former senior policy adviser to Vice President Kamala Harris, recently told NPR.
"But if you're trying to integrate critical assistance into a machinery for hunting immigrants and breaking up families and deporting people without due process — this is exactly how you do it."
New models for demanding state data
The revelations about Medicaid data follow new data-sharing guidance that the USDA issued to states last month to turn over personal information about tens of millions of SNAP recipients. Several states have announced their intent to comply with the USDA's unprecedented demand, but the plan is also getting pushback.
After a federal lawsuit accused USDA's data demand of violating federal privacy laws, a senior official said in court filings that data would not be collected until the department satisfied legal requirements and could ensure the data would be appropriately safeguarded.
Recently, the USDA published a public notice, as is required by the Privacy Act, of its intent to collect the data. The notice says the department will check SNAP applicants against federal databases to verify eligibility, including checking immigration status and finding duplicate enrollments. The wording of the notice suggests the collected data can be used much more broadly than past department data sets.
Separately, the USDA's Office of Inspector General is continuing to press certain states for personal data on SNAP participants for the stated goal of evaluating the quality and integrity of the data, according to emails reviewed by NPR. In at least one state, the data request includes citizenship status and information about household members, but not other information that's used to determine eligibility, such as employment status or income, the emails show.
Critics of this administration's data sharing efforts have pointed out that Project 2025, the sprawling proposed template drafted by conservative activists for Trump's second term, suggested gaining access to new sources of state data for purposes that include immigration enforcement.
The document says the federal government should make certain federal grants to states and localities contingent on "total information-sharing in the context of both federal law enforcement and immigration enforcement," including "access to department of motor vehicles and voter registration databases."
Those objectives echo data requests the first Trump administration made to states, when there was a push for states to share DMV and voter information, but most states refused.
Now in Trump's second term, federal agencies including DOGE and DHS have begun analyzing state voter rolls to look for noncitizens, as directed by Trump's executive order on elections. Separately, the Department of Justice sent an unprecedented request to Colorado for all its election records last month.
Legal and privacy issues raise dilemmas for states
Data sharing across federal agencies and with states can be an invaluable tool, said Allan Medina, a former federal prosecutor who is now a partner at Goodwin, a law firm, but he cautioned it has to be done appropriately.
As a federal prosecutor, Medina worked in a strike force alongside HHS' Office of Inspector General, FBI and other state and federal law enforcement partners to investigate medical device companies defrauding Medicaid. But he said in that context, everyone involved had been trained about how to safeguard sensitive tax and health data and understood the limits of how they were legally allowed to be used.
He said Trump's executive order on eliminating data silos raises questions on who exactly is receiving the sensitive data. "It could be whomever, [it] could be people within DOGE," Medina said. "Are they trained? What are the training protocols?"
While there have been more than a dozen lawsuits challenging DOGE's data access on privacy grounds, court rulings have been mixed. After a federal judge in Maryland temporarily stopped DOGE from accessing sensitive information at the Social Security Administration, the U.S. Supreme Court stayed that ruling, allowing DOGE unfettered access.
The unprecedented data requests from the federal government are causing states to carefully consider their responses, especially if they risk violating state privacy laws by inappropriately turning over records.
Colorado is evaluating how to respond to a detailed data request for its Medicaid data, according to Colorado Public Radio.
Separately, Colorado's labor director has argued an ICE subpoena asking for personal information of sponsors of child migrants is illegal under state law, and sued the state's Democratic governor, Jared Polis, for instructing him to respond to it.
City officials in Chicago have told news outlets they have not responded to an ICE subpoena for records from a city ID program used in large part by immigrants, including those without legal status.
Such ICE subpoenas to states, cities and counties to get records for groups or programs appears to be a new tactic, said Lindsay Nash, a law professor at Cardozo School of Law who has done extensive research into ICE's use of subpoenas.
"There's reasons that these subpoenas very well may be invalid," Nash said. She says states should carefully consider how to respond and should prioritize protecting information.
Some states are trying to be proactive.
Before Illinois' Medicaid data reportedly wound up in the hands of DHS, Gov. JB Pritzker — a Democrat and prominent critic of the administration — issued an executive order to protect the data privacy of individuals with autism after federal health officials announced plans to use Medicaid and Medicare data for a new database for autism research.
Maryland's Department of Human Services sent a letter to its vendors, grantees, contractors and community partners saying personally identifiable information and protected health information "should be kept confidential and not shared, disclosed or accessed, except in accordance with the contract and applicable law."
Laird, of the Center for Democracy and Technology, said an important factor in how this shakes out is how states choose to react to data requests.
During Trump's first term, officials from red and blue states pushed back on the idea of sharing sensitive data on voters, including birth dates and partial Social Security numbers, with a federal commission on election integrity.
Mississippi's Republican secretary of state at the time, Delbert Hosemann, said his response would be, "They can go jump in the Gulf of Mexico and Mississippi is a great state to launch from."
This time around, states have to weigh the threat of losing federal funds if they do not comply with certain requests or potential litigation.
Still, Laird said she wonders if that spirit of resistance to federal data requests will persist.
"Will we continue to see the bipartisan value of really limiting who has access to very sensitive information continue?" Laird asked. "Or has there been a sea change?"
Have a tip you want to share with NPR? Reach out to Jude Joffe-Block through encrypted communication on Signal at JudeJB.10. Please use a nonwork device.
Copyright 2025 NPR