Federal Limits

Limit 05 of nine · Information firewall

Protect personal records

67M+ voter records bulk-scanned; 292,114 searches of state driver records in a year.

The problem

Starting in 2025, the federal government moved to fuse state-held records — voter rolls, DMV files, tax data — into a single surveillance system, with deportation as the current use case and no legal wall stopping the next one: 31 lawsuits across 30 states over voter rolls, a rebuilt SAVE system scanning 67 million-plus registrations, an IRS deal exposing roughly 47,000 taxpayers, and 292,114 searches of DMV records. Courts struck the worst of it — but those are reversible orders; only a state firewall law is durable.

What the law does

Bars state agencies and local data-holders from handing residents’ voter, DMV, school, health, and licensing data to federal civil enforcement without a judge’s warrant.

Where it stands

Where it stands — all 52 jurisdictions18 of 52 have written a limit of this kind
written in full written in part not written red underline = state law mandates cooperation
Find my state all 52 jurisdictions, with the statute where one exists
  • Alaskanot written
  • Alabamanot writtenstate law mandates cooperation (state law mandates cooperation)
  • Arkansasnot writtenstate law mandates cooperation (state law mandates cooperation)
  • Arizonanot writtenstate law mandates cooperation (state law mandates cooperation)
  • Californiawritten in fullCal. Veh. Code § 12801.9 (AB 60, DMV) + Cal. Educ. Code § 234.7 (AB 699, schools) + SB 81 (2025) (health; Cal. Civ. Code §§ 56.05, 56.10 + Health & Safety Code §§ 24250-24257) + SB 1159 (2014, Ch. 752) (licensing; Cal. Bus. & Prof. Code § 135.5) + AG voter-data refusal (non-durable, narrative only)
  • Coloradowritten in fullC.R.S. §§ 42-1-211, 42-2-505 (SB 24-182, Colorado Road and Community Safety Act identification documents) + C.R.S. §§ 24-72-202, 24-72-204, 24-74-101 to 24-74-105 (SB 21-131) + C.R.S. §§ 24-76.6-101 to 24-76.6-103 (HB 19-1124) + SB 25-276 (title 22)
  • Connecticutwritten in partPA 25-3 (HB 8004, Nov. 2025 Spec. Sess.) § 14 — school/appointment-info nondisclosure (1 of 5 §4.5 domains)
  • District of Columbiawritten in partD.C. Code §50-1401.05 + DC voter MOU refusal
  • Delawarenot written
  • Floridanot writtenstate law mandates cooperation (state law mandates cooperation)
  • Georgianot writtenstate law mandates cooperationOCGA §50-36-1 (state law mandates cooperation)
  • Hawaiiwritten in partHRS §286-104.5 (limited-purpose driver's license) + voter-MOU refusal
  • Iowanot writtenstate law mandates cooperationSF 2218, SF 2340 (state law mandates cooperation)
  • Idahonot writtenstate law mandates cooperation (state law mandates cooperation)
  • Illinoiswritten in part210 ILCS 85/6.14h (hospital records) + 625 ILCS 5/6-110.3 (DMV; P.A. 103-210) — 105 ILCS 5/22-105 REMOVED, see notes
  • Indiananot writtenstate law mandates cooperation (state law mandates cooperation)
  • Kansasnot writtenstate law mandates cooperationHB 2437 (SAVE Kansas Act) (state law mandates cooperation)
  • Kentuckynot written
  • Louisiananot writtenstate law mandates cooperation (state law mandates cooperation)
  • Massachusettswritten in partWork and Family Mobility Act (MGL c. 90, §8) + DOL Nlets blocks Nov 2025 + voter-MOU refusal
  • Marylandwritten in fullHB 711/Ch. 874 (2026) GP § 4-320(g)(2) + § 4-320.1(c) (MVA + general public-records-custodian hard-denial) + PS § 3-529 (LE database)
  • Mainewritten in partLD 2106 / PL Ch. 770 — 20-A §14(3) (education records) + 22 §1730-B(3) (health records, state institutions)
  • Michigannot writtenMCL 28.298, 28.305 (State Personal ID Card Act / Enhanced DL Act)
  • Minnesotawritten in partMinn. Stat. §171.12 (immigration status data; requester must certify data not used for civil immigration enforcement nor disclosed to an entity that primarily enforces immigration law; civil liability via §13.08) + §171.06, subd. 3(d) (no inquiry into citizenship/immigration status), added by HF 4 (2023)
  • Missourinot writtenstate law mandates cooperation (state law mandates cooperation)
  • Mississippinot writtenstate law mandates cooperation (state law mandates cooperation)
  • Montananot writtenstate law mandates cooperation (state law mandates cooperation)
  • North Carolinanot writtenstate law mandates cooperationHB 318 (Oct 2025) (state law mandates cooperation)
  • North Dakotanot writtenstate law mandates cooperation (state law mandates cooperation)
  • Nebraskawritten in partNeb. Rev. Stat. §32-202(17)
  • New Hampshirenot writtenstate law mandates cooperation (state law mandates cooperation)
  • New Jerseywritten in partP.L.2026, c.4 (Privacy Protection Act, A4070 Aa[1R]) § 6a (health) + § 7 (DMV, amending C.39:2-3.4)
  • New Mexicowritten in partSB 36 / Ch. 138 (2025) + SB 40 (2026) ALPR ban
  • Nevadawritten in partNRS 483.291 (driver authorization card) + voter-MOU refusal
  • New Yorkwritten in fullN.Y. Veh. & Traf. Law §201(12) + N.Y. Educ. Law §3201-b(3)(d) (Ch. 55, L. 2026) + N.Y. Exec. Law §319-a(2) / Gen. Mun. Law §996-a(2)
  • Ohionot written
  • Oklahomanot written
  • Oregonwritten in partEnrolled SB 1570 (2026 Ch. 93) § 4 — health records at hospitals/FQHCs: no disclosure of citizenship/immigration-status info absent court order or legal mandate
  • Pennsylvanianot written
  • Rhode Islandwritten in partR.I. Gen. Laws § 31-10.4-3(c)(1) (driver privilege cards / identification privilege cards, Chapter 31-10.4)
  • South Carolinanot writtenstate law mandates cooperation (state law mandates cooperation)
  • South Dakotanot writtenstate law mandates cooperation (state law mandates cooperation)
  • Tennesseenot writtenstate law mandates cooperation (state law mandates cooperation)
  • Texasnot writtenstate law mandates cooperation (state law mandates cooperation)
  • Utahnot writtenstate law mandates cooperation (state law mandates cooperation)
  • Virginiawritten in partVa. Code §46.2-208(B)(9)
  • Vermontnot written
  • Washingtonnot written
  • Wisconsinnot written
  • West Virginianot writtenstate law mandates cooperation (state law mandates cooperation)
  • Wyomingnot writtenstate law mandates cooperation (state law mandates cooperation)
  • Puerto Riconot written

Methodology v3.5 · scored Aug 20 2026

The model language

“No state agency shall disclose, provide access to, or transfer any personal information of any person contained in state databases or records to federal civil immigration enforcement, except where compelled by a judicial warrant signed by a federal or state judge or magistrate, compelled by a subpoena issued by a court of competent jurisdiction, or required by federal law that has been judicially upheld against legal challenge.”

— Section 5 · Information Firewalls, The Federal Limits Act
Read the full model bill →

What we propose

Firewall three or more of five data domains (voter, DMV, school, health, licensing) with hard-denial language, a judicial-warrant exception, public logging of refused requests, and a SAVE opt-out. Model: Colorado SB 24-182; California Veh. Code 1801.1; Illinois Way Forward Act.

Who’s already done it

17 states + D.C. have firewalls; 4 at full strength — CA, CO, MD, NY. California firewalls all five domains; Maryland and New York anchor the multi-domain designs. Illinois holds two domains rather than three: its school-records bar protects only citizenship and immigration status, and a federal saving clause preserves exchange of exactly that information, leaving no firewall standing on that domain.

On the record

Status: holding in court — but via reversible litigation, not durable statute. Oklahoma already settled; a state law is the answer.

One of nine.
Not the whole fight.

See where your state stands on all nine limits, or read the model bill section that closes this one.

Check your state → ← Back to the Nine