Fifty States of Voter Files (08/26/2026)

Three separate voter data stories landed inside 48 hours, and read together they describe a single pattern. ICE sought voter registration and history files on Monday. DHS is now seeking a contractor to gather the same category of record from every state and territory. USPS has finalised a rule that ties mail-in ballots to data law enforcement can reach. None of this required a new collection power, because the records were already public.

Top 5 Critical Privacy Alerts

1. DHS Wants Voter Files From All Fifty States

Government contracting documents made public on Tuesday show the Homeland Security Department seeking a third-party company able to collect publicly available voter registration information from all 50 states, the District of Columbia, and US territories at the agency’s direction. DHS says the data will inform the fraud detection activities of its immigration investigations branch. Benjamin S. Weiss reported the acquisition for Courthouse News. PogoWasRight

Operator Note: Every element here is already public, and that is what makes the aggregation the event. A voter file released under one state’s rules to one requester was a bounded disclosure, and fifty of them in a single queryable system is a different object that nobody legislated. We made the same point on August 24 about the enforcement data lake, and the pattern is now running twice a week rather than occasionally.

2. Meta Settles Teen Safety Claims for About $18 Billion

Meta reached a settlement with a bipartisan coalition of 52 state attorneys general, led by California, over claims it designed features to encourage compulsive use by minors and collected data from children under 13. The figure is roughly $18 billion over ten years, structured as $12.7 billion to participating states with a further $5.3 billion conditional on YouTube and TikTok adopting similar measures, which is why outlets are reporting different totals. Meta agreed to default two-hour daily limits for under-18s, overnight app blocking, hidden reaction counts, age-verification technology, and an independent compliance auditor. There is no admission of liability. BleepingComputer

Operator Note: The conditional $5.3 billion is the interesting instrument, because it makes one company’s payment depend on its competitors’ behavior and effectively deputises Meta to lobby for industry-wide age assurance. Watch the age-verification requirement rather than the headline number: mandatory age assurance at this scale means identity infrastructure arriving on consumer platforms by consent decree rather than by statute. Biometric Update

3. USPS Finalises a Ballot Rule That Reaches Law Enforcement

The Postal Service has finalised a mail-in voter ballot rule that would give law enforcement access to voter-linked data. The linkage attaches to the ballot itself, so it exists before anyone has an investigation that needs it. Biometric Update

Operator Note: Read this next to the DHS acquisition above rather than on its own. One creates a federal appetite for voter records and the other creates a federal pipeline carrying them, and the two were decided by different agencies under different authorities with no single proceeding where anybody could object to the combination.

4. Amazon Is Scanning and Destroying Books for AI Training

Reporting from inside the warehouse describes physical books being scanned and then destroyed to produce training data. The destruction is deliberate, and the process is built around it. 404 Media

Operator Note: The destruction is the part that will stay with people, and it is also the legally coherent part, since a scanned-and-destroyed copy is easier to defend as format shifting than a scanned-and-retained one. That a copyright argument produces a warehouse of pulped books tells you the framework was not built for this.

5. Flock’s Chief Executive Is Misrepresenting Reporting to Police Customers

404 Media reports that the company’s chief executive has been telling law enforcement customers something untrue about the outlet’s reporting on an abortion-related case. The customers in question buy and operate camera networks on the strength of what the vendor tells them. 404 Media

Operator Note: Surveillance vendors sell to buyers who cannot easily verify vendor claims, and a police department taking a supplier’s characterisation of press coverage at face value is a procurement failure before it is a press one. If your organization buys security technology, the question this raises is who checks what your vendors say about their own controversies.

Additional Privacy Alerts

Surveillance & Facial Recognition

• EFF’s position on automated license plate readers is to eliminate them: A clear statement from an organization that usually argues for constraints rather than abolition. EFF
• A student described as a hobby plane spotter was allegedly photographing for the Chinese government: Open-source collection wearing an ordinary hobby. 404 Media

Privacy Laws & Regulations

• noyb has sent SCHUFA a cease-and-desist over a shadow database and is building a class action: noyb
• France’s top court struck down a social media ban for young people: EFF
• Saudi Arabia has issued deepfake guidelines as identity threats rise: Biometric Update

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.