Electronic Freedom Foundation

In an extremely disappointing ruling, a California trial court dismissed SIREN v. San Jose, our case challenging the city of San Jose’s warrantless searches of its vast stores of automated license plate reader (ALPR) data. EFF and the ACLU of Northern California represent SIREN and CAIR California, two non-profits that serve San Jose residents, in this case.

Make no mistake: We believe this ruling is wrong on the law, and we will appeal. The ruling ignores the importance of landmark rulings from the U.S. Supreme Court regarding the invasiveness of aggregating collected data on an individual over time, including one issued just months ago. It also severely underestimates the harm that ALPRs cause, in San Jose and around the country. 

San Jose’s ALPR surveillance system is inescapable. It blankets the city’s streets in nearly five hundred cameras that continuously photograph every car that passes by and retains the collected data for a month or longer. In our briefs, we argued that law enforcement officers who warrantlessly search the resulting ALPR database are violating the California Constitution’s ban on unreasonable searches and its guarantee of privacy. The court disagreed, explaining that based on one California appeals court case involving individual streetlight cameras, people do not have a reasonable expectation of privacy when driving on a public road. This is wrong. Networked ALPRs are not individual streetlight cameras. Their net effect of tracking and mapping cars as they travel reveals patterns of life, intimate relationships, and much more.

Fortunately, there are signs that the tide is turning against ALPRs in the courts. Just a day before the ruling in our case, a federal district court in Oklahoma called ALPRs “a type of indiscriminate mass surveillance” and decided that a law enforcement officer’s warrantless search of ALPR data violated the Fourth Amendment. The officer was observing traffic on an Oklahoma highway when he saw a woman driving a car with California plates. According to the court order, the officer began following the woman “for no apparent reason” other than her out of state plates. While following her, the officer decided to run the woman’s license plate number through Flock’s ALPR system – again, with no apparent reason other than her California plates. The Flock search returned at least 30 days of data, allowing the officer to track the car across at least three states, over the span of a month, from a single search.

The facts of this case demonstrate how ALPRs allow law enforcement to grab a breathtakingly vast sweep of information about a car (and the driver within) with no more effort than a Google search. It’s true that when a person drives on public roads, they can be observed, including by police. But as the Supreme Court has explained, we don’t expect law enforcement to be able to secretly track and store every movement our cars while we’re driving. The federal court in the Oklahoma case aptly illustrated this difference in societal expectations:

We might reasonably expect our friends and family to tell us something like: “Hey, I saw you out driving by the store last week.” But we do not expect people we know—let alone strangers, and especially not law enforcement—to randomly approach us to say: “Hey, I have been following your car for the last 30 days, and here is a detailed log of every place your vehicle has been with supporting photographic evidence. I am also going to share this information with law enforcement throughout the country so they know your whereabouts, too.

This decision is the first of its kind, and EFF will continue working to ensure that it is the first of many. Outside the courts, we’ve seen people across the country step up to reject ALPRs at the state and local level. EFF will continue challenging this technology on every front as well.

Related Cases: SIREN and CAIR-CA v. San Jose

When we communicate online today – from your personal emails and DMs to secure international commerce – we usually do so with encryption. Encryption converts readable data into unreadable gibberish to protect our privacy and security. This didn’t just happen organically. Three decades ago, the U.S government treated encryption like a weapon, and it took some unlikely heroes to set it free: a grad student, a junior lawyer, and a fledgling digital rights group who sued the federal government. 

The ruling in Bernstein v. Department of Justice held that code is speech and so is protected by the First Amendment – a precedent that underpins the internet as we know it today. This landmark case was led by Cindy Cohn, then a young pro bono lawyer working on behalf of EFF, who went on to become EFF’s legal director and then executive director. 

Welcome to the second episode of “Privacy’s Defenders,” a podcast about the people – lawyers, journalists, hackers, and others – who’ve fought to secure your digital liberties since before most people even knew what the internet was. 

%3Ciframe%20height%3D%2252px%22%20width%3D%22100%25%22%20frameborder%3D%22no%22%20scrolling%3D%22no%22%20seamless%3D%22%22%20src%3D%22https%3A%2F%2Fplayer.simplecast.com%2F91542147-6839-46fe-a813-73eb7a5c683c%3Fdark%3Dtrue%26amp%3Bcolor%3D000000%22%20allow%3D%22autoplay%22%3E%3C%2Fiframe%3E Privacy info. This embed will serve content from simplecast.com

   

(You can also find this episode on the Internet Archive and on YouTube.)

In this episode, Cindy – who left EFF in June – speaks with Dan Bernstein, who was a Cal Berkeley grad student when he developed a simple encryption algorithm called “Snuffle.” Because federal law classified encryption as a war munition, publishing Snuffle meant submitting it to the government for review, getting a license as an arms dealer, and being granted a license the government had no intention of granting. Bernstein felt this violated his free-speech rights and in 1995 he sued, represented by Cindy working with EFF. 

Cindy also talks with Tony Coppolino, the Justice Department lawyer she battled in court – who admits she intimidated him from their very first phone call, and who offers a surprising perspective on the case all these years later. 

The “Privacy’s Defenders” podcast is a follow-up to Cindy’s book, “Privacy’s Defender: My Thirty-Year Fight Against Digital Surveillance,” bringing to life pivotal moments in the voices of those who fought for your rights. Sales of “Privacy’s Defender” benefit EFF, so pick up your copy today!

Joanne Elgart Jennings co-produced and created this podcast.   

Jarrod Sport co-produced, mixed, and mastered it.   

Corinne Ruff is our story editor. 

We had additional help from Rachel Estabrook and Alison Broverman. 

The original music was composed and performed by Nat Keefe of Hot Buttered Rum with Ben Andrews on the fiddle.

In the past two years, the federal government has unlawfully consolidated data exposing our private information. 

This consolidation has been chaotic but generally came in three rolling waves: It started with DOGE, moved to agency-to-agency data sharing with ICE, and then attempted data-driven purges of state voter rolls.

We all deserve to live in a world where the data we use to pay our taxes, receive benefits, and vote is not combined and weaponized against us. The amalgamation of data leads to mistakes, abuses, and a lack of trust in institutions meant to protect us. Overall, it can chill our participation in society. This is particularly true for groups disfavored by this administration—especially immigrants and protesters.

Congress highlighted similar abuses—including the creation of enemies lists and snooping on activists and federal employees—following the McCarthy and Watergate eras. And the increasing use of computers to magnify those harms led Congress to pass a slate of protections like the federal Privacy Act of 1974.

The good news is that many people have stepped forward to resist the federal government’s unprecedented and unlawful data consolidations. Many groups, including EFF, have filed lawsuits to enforce our data privacy laws, and many states have, too. Legislators at the federal and state levels have worked to expose and oppose these surveillance programs. And many people have protested for their right to data privacy.

Existing data privacy protections have been essential in the past two years, but they can be improved. This should include: narrowing loopholes and increasing enforcement in existing laws, limiting the government’s purchase of data on the commercial market, and passing a comprehensive consumer privacy law.

Data Consolidation by DOGE

Starting on January 20, 2025, President Trump created DOGE—essentially renaming an existing agency originally meant to modernize government technology. Rather than engage in modernization, DOGE quickly obtained high-level access to sensitive databases across the government that store millions of people’s personal records—including at the Office of Personnel Management (OPM), the Social Security Administration, and the Treasury Department.

DOGE was staffed with people with little government or cybersecurity knowledge and who often had conflicts of interest. DOGE’s early aim was not always clear, aside from gaining “prompt access to all unclassified agency records” and the “sharing and consolidation” of those records.

The result? The indiscriminate firing of government employees and the decimation of important agencies that focused on consumer protection and foreign aid. It also resulted in clear misuses of data. For example, while working with DOGE at the Social Security Administration, one individual signed an outside agreement with an advocacy group with the aim of using SSA data to find evidence of alleged voter fraud and “overturn election results in certain States.”

DOGE’s data access and consolidation violated the federal Privacy Act, which limits the sharing and consolidation of government databases. Many groups stepped in to sue. For example, EFF and our co-counsel at Lex Lumina LLC and Democracy Defenders Fund, on behalf of two public employee unions (AFGE and AALJ), sued the OPM for unlawfully disclosing federal workers’ information to DOGE. After EFF and others secured early victories, the government sought to end the lawsuits by firing many DOGE agents and removing their access to records. A great deal of damage remains in need of a judicial remedy.

Data Consolidation by the Department of Homeland Security (DHS)

Even as DOGE’s influence diminished, federal agencies have attempted to share, compare, and seize large databases, in order to target immigrants. In some cases, they have succeeded. This happened with tax records at the IRS, Medicaid data from the Department of Health and Human Services (HHS), and public housing data from the Department of Housing and Urban Development. The Department of Agriculture also sought to collect databases regarding Supplemental Nutrition Assistance Programs (SNAP) from states.

Many groups have filed lawsuits to block this anti-immigrant-motivated data consolidation, alleging it violates privacy protection laws. EFF filed amicus briefs in support of two of these lawsuits: Centro de Trabajadores v. Bessent, which concerns IRS data; and California v. HHS, which concerns Medicaid data (and where we teamed up with EPIC and Protect Democracy). Most recently, states have stepped up to challenge the federal government’s attempted seizure, for immigration enforcement purposes, of state commercial driver’s license data held by the American Association of Motor Vehicle Administrators, a non-profit organization.

This data consolidation for immigration enforcement has also included government purchase of commercial products. This includes ICE’s purchase of commercial location data without a warrant, and its interest in “Big Data and Ad Tech providers.” ICE also has contracts with companies like Palantir, which help organize all the datasets the agency collects.

Data Consolidation for Voter Purges

The right to vote is fundamental to every democracy. That’s why EFF has long advocated for cybersecurity in voting systems, to make sure every vote is properly counted.

Voter purges are a longstanding threat to the right to vote. State and local officials regularly delete people from the voter registration rolls, often for bad reasons and without adequate notice. This has a disparate impact against people of color.

Now the federal government is trying to purge voters, too. To do so, it has consolidated our data in three ways. First, it is using an old data system called SAVE for a new purpose: checking voter eligibility. Second, it has seized voter information from states. Third, it has created a federal list of eligible voters.

As a direct result, people with a right to vote will be purged from voter rolls because of erroneous data. Others will be intimidated from voting or registering. And all registered voters suffer a violation of their data privacy rights: information collected for one purpose is being used against them for another purpose.

Expansion of SAVE

Since 1986, the federal government has operated SAVE, which stands for Systematic Alien Verification for Entitlements. It is not a database, but it facilitates easy access to databases. It is used to determine whether immigrants and naturalized citizens are eligible for various government benefits, such as food stamps.

In 2025, the federal government started using SAVE for a new purpose: checking voters’ eligibility. Further, SAVE now provides access to new databases and allows bulk searches. More than 60 million voters have been run through SAVE, and 21,000 were flagged as potential noncitizens who are ineligible to vote. Erroneous flags have caused purges of lawful voters – such as Anthony Nell.

A case called League of Women Voters v. DHS challenges this expansion of SAVE. The plaintiffs are represented by CREW, Democracy Forward, the Fair Elections Center, and EPIC. A federal judge held this program unlawful and set it aside. DHS appealed and asked for a stay of this order, and a federal appellate court denied the stay. Unfortunately, the U.S. Supreme Court granted the stay, exercising its controversial “shadow docket” authority by a six-to-three vote.

Federal employees in DHS’s “Fraud Detection and National Security Unit,” which ordinarily investigates alleged immigration fraud, have been re-assigned to examine voter eligibility. A whistleblower alleges that employees have been directed to go to state election agency websites, enter some of a voter’s personal information, and thereby access more of it. This may violate state laws requiring a person, before accessing a voter’s information, to attest they are that voter or have that voter’s authorization.

Federal Seizure of States’ Voter Information

Since 2025, the federal government has demanded that at least 48 states hand over their voter information. At least 16 states have complied. The federal government is running this information through SAVE, searching for voters to purge.

The federal government has sued 30 states for refusing to comply. So far, courts have dismissed 25 of these suits. There’s also a lawsuit against this data grab, titled Common Cause v. DOJ, brought by CREW, Protect Democracy, and the ACLU.

The New Federal Voter Eligibility List

In March 2026, President Trump issued an executive order requiring DHS to create a list of people who are U.S. citizens, aged 18 or older, and residents of the state. The order also requires DOJ to prosecute anyone, including state and local officials, who provides a ballot to a person who is not eligible to vote in federal elections.

In California v. Trump, 24 states allege that this executive order violates the Constitution’s separation of powers. A federal judge enjoined this program, and an appellate court denied a stay. But the U.S. Supreme Court by a six-to-three vote granted a stay, which allows the program to move forward. (By a seven-to-two vote, the Court denied a stay of an injunction against a different part of the same executive order, which concerned mail-in ballots.) Another legal challenge, titled EPIC v. USCIS, alleges that the new federal voter eligibility list violates the Privacy Act as well as the separation of powers.

Next Steps

It is encouraging to see so many people, groups, and states step forward to protect our data privacy from these unlawful waves of federal data consolidations. Still, more work remains. For example:

• The Privacy Act of 1974 has proven a critical bulwark. But after a half century, it could use a refresh. For example, Congress should close its loopholes and expand its enforceability.
• Law enforcement agencies must be prohibited from avoiding the Constitution’s warrant requirement by buying our personal data from brokers. For example, Congress should pass the “Fourth Amendment Is Not For Sale Act.”
• We need a comprehensive consumer data privacy law, among other reasons to reduce the flood of our personal data that corporations provide to law enforcement agencies. Legislators should check out EFF’s “privacy first” framework.

In the meantime, there’s no time like the present to practice surveillance self-defense, like using strong passwords and disabling your phone’s ad identification.

 

Related Cases: American Federation of Government Employees v. U.S. Office of Personnel Management

EFF was thrilled to join organizers, advocates, and activists in the East Bay for the second annual Oakland Tech Week last week. We are grateful to our friends at MediaJustice and Upturn for inviting us co-present this all-day event, “Building Beyond Big Tech: Organizing Oakland’s Future”, on Sept. 30.  The event, hosted by the Kapor Center in downtown Oakland, offered a unique chance to spend time with people across The Town and the Bay Area working to create a better future for everyone.

“We’re at this truly consequential moment,” said EFF executive director Nicole Ozer, in her speech kicking off the day’s events. “We know that in this community’s work—and communities across the country—our ability to ensure that technology empowers rather than oppresses is fundamental to the future of countries, our livelihoods, and, literally, our lives.”

We also participated in a panel on the state of play in California, moderated by MediaJustice executive director Steven Renderos. Director of State Affairs Hayley Tsukayama joined reporter Khari Johnson of CalMatters and Crystal Zemero of People Over Billionaires to talk about the landscape at the state level. The day also included smaller conversations focused on building better tech and fine-tuning messaging, facilitated by our colleagues at MediaJustice.

Seeing the people—our neighbors—who are fighting back against surveillance in their communities was inspiring. They’re casting doubt on the claims large technology companies make about what’s happening in their neighborhoods. They’re speaking up at council meetings and rallies. They’re seeking changes that would give their workplaces and neighborhoods a better, safer relationship with technology. It was so important to come together in solidarity to compare notes, spend time together, find opportunities to support each other, and scheme together.

We can work together to build a future that works for everyday people. A better world is possible—and Oakland Tech Week was a great reminder that, all around us, folks are working together to tackle huge challenges.

“There are formidable forces,” Ozer said.  “But we can pierce the other side’s narrative of inevitability with our power of indignation. The future of AI and other technology is not written and we can work together to get it right.”

Whether you’re in Oakland or Aukland, consider this a renewed invitation to join us.

Join the Fight 

Become an EFF Member Today

EFF strongly condemns Turkey’s state-led discriminatory, oppressive attacks on feminist and LGBTQ+ organisations, media platforms, student groups, and rights defenders and activists within the country.

Since mid-September, access to the websites and social media accounts of a dozen organizations have been blocked by court order, while over 60 members and activists have been detained, their offices and homes raided, mobile phones, laptops and other digital devices seized, and judicial proceedings launched against them. 

These actions threaten the very existence of the LGBTQ+ organizations targeted, limiting their ability to carry out legitimate human rights work, deterring participation and support, and chilling the free speech rights of not just these groups, but any organization that even reports on LGBTQ+ oppression.

A little over a week ago, an Istanbul court shut down the website and social media accounts of T24, Turkey’s longest running independent digital news organization—which has covered government-backed campaigns against and earlier crackdowns on gay rights groups—alleging it had aired “LGBT propaganda” over the past year. 

It’s all part of Turkey’s efforts to portray LGBTQ+ groups and support networks for those living with HIV as criminal organizations that must be suppressed, purportedly to protect family values. Homosexuality is not illegal in Turkey (unlike Uganda, Nigeria, and Egypt, where it is criminalized), but LGBTQ+ organizations and activists have in recent years faced increased government oppression, including criminal proceedings on allegations related to obscenity and violations of Turkey’s Law on Associations, which regulates the activities of nonprofits.

In its new crackdown, the government is targeting LGBTQ+ groups’ websites and social media channels for alleged obscene posts accessible to children. Kaos GL, Turkey’s oldest gay rights organization, said investigations are being led by the Cyber Crimes Bureau of the Ankara Chief Public Prosecutor’s Office, which took members of its Board of Directors into custody, raided their homes, and searched the organization’s offices, where electronic devices were seized. 

According to Human Rights Watch, prosecutors in Istanbul said those targeted were suspected of “founding, leading, or being a member of a criminal organization,” as well as sex work and drug-related offenses. Publicly available law enforcement and judicial documents about the investigation reportedly don’t say which publications or posts are alleged to be obscene.

The prosecutor’s office launched an investigation of the organization and others under Article 226 of the Turkish Penal Code, which regulates the offense of “obscenity” (without clearly defining it), while the overall operation, dubbed “My Family is Safe” and launched as part of President Recep Tayyip Erdoğan’s “Decade of the Family” program, is being brought under Article 220 of the code. Justifying the crackdown by invoking family values and child safety suggests that the government is trying to enforce a moral code on society based on intolerance of and discrimination against LGBTQ+ people.

New Low for Turkey

Framing the activities of LGBTQ+ rights organizations as violations of organized crime provisions is a new low for Turkey, where free speech and press freedoms have long been under attack. The implication from these raids and investigations is that the organizations’ legitimate civil society work advocating for the rights of queer people—monitoring human rights violations, offering legal aid, running news portals, sponsoring cultural events such as symposiums and film screenings, publishing an online magazine and supporting LGBTQ+ refugees—is suspected of being criminal threatens the basic human rights of the LGBTQ+ community in Turkey.

These actions send a dangerous message to people and organizations exercising freedom of speech and association in support of queer people. Under the penal code, directing a criminal organization is punishable by five to ten years in prison, while merely being a member carries a sentence of two to five years. 

EFF joins hundreds of human, civil, LGBTQ+, and digital rights organizations around the world in calling for the immediate release of all those detained for exercising their rights to freedom of expression, association and legitimate human rights work, and the unblocking of all websites and social media accounts of affected organizations. 

For many LGBTQ+ individuals the world over, the internet can be a safer space for exploring identity, finding community, and seeking support. The anti-LGBTQ+ crackdown in Turkey is not happening in a vacuum—unfortunately we are seeing anti-LGBTQ+ bills restricting free expression and privacy, content moderation decisions that disproportionately impact LGBTQ+ users, and other forms of intolerance around the world. 

We urge international civil society and diplomatic partners to raise awareness of and to speak out against the crackdown, and to publicly show support for the legitimacy of Turkey’s LGBTQ+ organizations and the important work they do to ensure that queer people are safe and free.

This post was co-authored by Sheila B. Lalwani, a doctorate student and recent COMPASS Fellow hosted by EFF.

Age verification proposals are often presented as a simple tradeoff: sacrifice a little privacy to better safeguard children online. But that framing overlooks a more fundamental question. What happens to people who cannot verify their age at all? This is particularly a problem when users are required to prove their age with identity documents.

Age-related restrictions are developing quickly around the world. While they differ radically across jurisdictions, in the past year, we’ve witnessed a sharp uptick toward mandatory age assurance for social media access but also for other high-risk digital services.

For example:

• In late 2025, Australia became the first country to implement a minimum age requirement for prohibiting children under age 16 from creating or holding social media accounts. 
• India passed the Digital Personal Data Protection (DPDP) Act that includes mandatory verifiable parental consent and has undertaken ongoing discussions for social media restriction.
• The United Kingdom passed the Online Safety Act requiring age verification across a swath of services hosting content considered harmful to users under 18. More than half the states across the U.S. have enacted age verification laws. 
• An EU Commission’s expert report recommends a ban on social media access for users under 13. It also recommends mandatory age verification for platforms to ensure that users are ‘age appropriate.’ 

The Access Problem 

Age verification laws that are predicated on the necessity of users possessing a current passport, driver’s license, credit card, or similar documents proving their identity exclude critical sections of populations.  And this problem is global in nature: Millions of people lack government-issued identification or encounter regular challenges to obtaining or updating it. 

Roughly 15 million adult U.S. citizens lack a driver’s license, and a further 2.6 million lack any government photo ID; leaving large groups blocked from online content or services. The UK has a similar predicament: proof-of-age checks are often reliant on passports, driver’s licenses, or other recognized alternatives, which can pose unique challenges to people without these documents.

Much of the advocacy around age verification discusses the privacy harms of age verification. Yet these measures also threaten something more fundamental: equal access to information and the ability to exercise the right to freedom of expression. 

Unfortunately, age verification systems foster unequal access to information and provide an asymmetric solution to find essential information, build community, and weigh in on public discourse. As governments and companies increasingly require users to prove their age before accessing online services, these individuals risk being excluded from large parts of the internet altogether. 

Effects on Global Majority Countries 

Age verification laws reshape who can speak, who can access information, and who gets excluded from the digital public sphere. In other words, age verification is not a neutral safety measure: it presents a structural barrier to disproportionately exclude certain groups—particularly those in the global majority—and alters the architecture of global online expression. Some of these groups are already marginalized offline, and age verification extends that exclusion into digital spaces.

For instance, 850 million people globally do not have ID. Most of these individuals exist in primarily low and middle income countries in Sub-Saharan Africa and South Asia. The World Bank points out that many are members of marginalized groups and more than half of those lacking access to identity documentation also have children whose births have not been registered. Women are particularly vulnerable and are 8% less likely than men to have an ID. Other vulnerable groups, such as adults in low income countries, are less likely to have an ID when they fall below 25 years, as are those with a primary school education or less or those in rural areas. 

A policy paper from EDRi points out that age verification laws provide quick tech solutions but overlook longstanding structural challenges and undermine the universality of the internet. The analysis finds that age verification laws have serious human rights implications and ironically harm the very individuals they deem to protect. Moreover, these laws depend on the collection of harmful mass data that human rights organizations, including EFF, is fighting against—and has for decades. 

For example:

• In Morocco, a push to restrict children’s access would ban under-13s from creating accounts on gaming platforms. This could potentially create challenges for those with IDs that have incomplete information concerning the year of birth. In addition, this push would also impact those who attempt to leave Morocco.
• In Egypt, the lack of ID cards has created challenges for minority groups such as the Baha’i.
• Stateless individuals would also struggle under age verification laws. The Rohingya, the world’s largest population of stateless people, often lack IDs. 
• Kuwait’s Bidoon population also lacks proper identification materials. According to Amnesty International, this leads many to rely on standard civil identity cards, which can be restrictive.  
• Nigeria launched a national program to provide ID cards to its population in 2007. Since then, 64.4 million have registered, but that represents just over 30% of the national population.
• The Kafala system, a practice in several countries across the Middle East, also introduces challenges for age verification laws. Under this legal framework, migrant workers’ legal residency and employment status are bound to a specific employer. This potentially leaves stateless persons or migrant workers vulnerable to forced labor and restricted movements. 

No ID, No Access

Age verification laws are less about confirming the age of a user and more about creating barriers to online participation that many people cannot reliably scale. The net result is reduced access, more data collection, and an increased chance of unequal or mistaken exclusion from accessing information online. 

Nobody doubts the importance of protecting children online. While proponents assert that age verification laws protect minors from harmful material, online harassment, and digital addiction, these laws are not the solution. They subvert fundamental freedom of expression rights and pose significant privacy risks.  

EFF has long warned against age-gating the internet. Age verification technology itself is often inaccurate and privacy-invasive, and as more countries considering implementing ID-based checks, the risks move beyond censorship and surveillance toward excluding some people entirely. That’s why we’re working with groups in the U.S. and around the world to push back against these laws, and why we hope you join our effort.

For more information on how to fight back against dangerous age verification laws, visit our resource hub at eff.org/age