Homeland Security Secretary Markwayne Mullin has asked Attorney General Todd Blanche to investigate whether a voter-roll nonprofit funneled millions of Americans' Social Security numbers and driver's license data to a group bankrolled by Mark Zuckerberg's family foundation, a transfer DHS says may violate federal privacy law.
Mullin's letter, released by the White House Government Transparency Task Force, accuses the Electronic Registration Information Center, a nonprofit that helps states maintain voter rolls, of sharing sensitive motor vehicle records with a second nonprofit, the Center for Election Innovation and Research. CEIR received more than $70 million from Priscilla Chan and Mark Zuckerberg's foundation ahead of the 2020 election and used the data not for research, but to contact unregistered citizens in voter outreach campaigns, Just the News reported.
The referral marks the second time DHS has flagged the issue. The agency first brought its concerns to the Justice Department in September 2025. What DOJ did with that information remains unclear, and neither the attorney general's office nor ERIC has responded publicly beyond ERIC's assertion that it did nothing wrong.
At the center of the complaint is the Driver's Privacy Protection Act, the federal law that restricts how personal information from state motor vehicle records can be used and shared. ERIC, which counts 27 states and the District of Columbia as members, lobbied those states to sign contracts requiring them to hand over data on people who were not registered to vote, and therefore had no connection to voter-roll maintenance, the letter argues.
Mullin wrote that the arrangement:
"lobbies states to sign a contract that requires the disclosure of the private data of individuals who were not registered to vote and therefore certainly could not be in need of voter list maintenance. The data fields disclosed include Social Security numbers and driver's license numbers."
That data then moved from ERIC to CEIR. And CEIR, according to the letter, did not simply study it. DHS says it possesses evidence that ERIC contacted "eligible or possibly eligible" citizens who had never registered to vote, a step that would blow past the narrow research exception ERIC claims protects the transfer.
The research exception under federal statute, 18 U.S.C. § 2721, the law governing privacy of state motor vehicle records, allows data sharing only when "the personal information is not published, re-disclosed or used to contact individuals." Contacting those individuals is precisely what DHS alleges happened.
Mullin told Blanche the arrangement:
"exposes millions of citizens' sensitive private data to unknown contractors, subcontractors and agents of ERIC, potentially in violation of the DPPA."
The letter points to email communications disclosed through a public records request in Georgia. Those emails, Mullin wrote, showed CEIR was "coordinating ERIC [eligible voter] outreach", specifically, "contacting each individual identified in the motor vehicle file." If accurate, the emails undercut ERIC's defense that data shared with CEIR fell under a permissible research use.
Mullin framed the stakes bluntly:
"This sharing and re-sharing of Motor Vehicle Agency data among NGOs may not qualify as a permissible use of motor vehicle data identified in the DPPA. This category of data regarding potential voters is incredibly valuable to political parties and campaigns."
That last sentence is the quiet accusation embedded in the referral. Data on unregistered but eligible voters, complete with Social Security numbers and driver's license numbers, is exactly the kind of targeting information campaigns pay dearly to acquire. Routing it through nonprofits funded by one of the wealthiest political donors in the country raises an obvious question about whose interests the arrangement served.
The financial trail runs through Facebook founder Mark Zuckerberg and his wife Priscilla Chan. Their foundation provided more than $400 million to CEIR and a second group, the Center for Tech and Civic Life, during the 2020 election cycle. Of that total, more than $70 million went to CEIR alone, a figure CEIR itself announced in October 2020 under the headline "Priscilla Chan and Mark Zuckerberg Increase Support for Safe and Reliable Voting."
CEIR turned that money into grants for state election offices. Twenty-three states and Washington, D.C. applied for and accepted funds through the group's Voter Education Grant Program. Pennsylvania alone received $13 million, but the grant came with strings. It required the state to turn over motor vehicle data "originally shared with ERIC, to be used by CEIR to create" lists of eligible but unregistered voters for voter registration outreach.
Both ERIC and CEIR were founded and organized by David Becker, a former government lawyer who later became a director at People for the American Way, a progressive advocacy organization. The overlapping leadership between the two nonprofits is part of what drew scrutiny beginning in 2022.
An administration official told reporters that DHS believes at least nine states signed grant agreements authorizing the data transfer. Those nine states alone hold more than 48 million registered voters.
But the actual volume of exposed records is likely far larger. The official explained the math plainly: state motor vehicle databases include every licensed driver, not just registered voters. Because the contracts required states to hand over records on people who had not registered to vote, the transferred files would exceed the registered-voter count by an unknown margin.
Which nine states are involved has not been disclosed. The letter and the lawsuits that preceded it name Pennsylvania, Michigan, Minnesota, Wisconsin, and Georgia, but the full list remains an open question.
DHS is not the first to raise the alarm. In 2022, the Thomas More Society, a conservative legal organization, filed lawsuits against election departments in Michigan, Minnesota, Pennsylvania, and Wisconsin. Those suits alleged the states violated the Help America Vote Act, a separate federal statute, by sharing voter information with third parties. The outcomes of those cases are not described in current reporting.
ERIC first came under broader public scrutiny that same year. The nonprofit has maintained that it did nothing wrong and that its data-sharing arrangement with CEIR fell within the research exception of the federal privacy statute. DHS disagrees, and the letter to Blanche asks DOJ to settle the question.
A Trump administration official outlined several paths the Justice Department could take. DOJ could issue a cease-and-desist order to ERIC, impose legal penalties for privacy-law violations, or explore whether the nonprofit violated the terms of its 501(c)(3) tax-exempt status, a designation that bars organizations from engaging in political campaign activity.
That last option would be the most consequential. Losing tax-exempt status would not just cost ERIC its favorable tax treatment. It would force every member state to reconsider whether its contract with the organization is legally defensible, and whether the data it already handed over was shared lawfully.
Neither CEIR nor AG Blanche has responded publicly to the referral. ERIC's only known position is its blanket denial that it did anything wrong.
When private citizens hand their Social Security numbers to a state DMV, they do it to get a driver's license, not to end up on a voter-outreach list assembled by a nonprofit running on $70 million from Silicon Valley. If the law means what it says, someone owes 48 million Americans an explanation.
