The Privacy Act of 1974 (5 U.S.C. § 552a) requires federal agencies to publish a "System of Records Notice" (SORN) before collecting personally identifiable information about Americans, and restricts how that data can be used or shared. Agencies must tell the public what data they're gathering, why, and who can access it. Violations can be challenged in federal court. Critics of the DOJ's 2025–2026 voter data collection argue it violated the Privacy Act by aggregating tens of millions of voters' SSNs, driver's license numbers, and voting histories without issuing the required public notice.