On Aug. 13, 2026, twenty-one states, the District of Columbia, and the Governor of Pennsylvania filed two coordinated actions in the Alexandria Division of the Eastern District of Virginia. The first, State of Illinois v. United States Department of Transportation, No. 1:26-cv-2547, is a seven-count complaint against DOT, Secretary Sean Duffy, FMCSA, Administrator Derek D. Barr, and the American Association of Motor Vehicle Administrators. The second, No. 1:26-mc-19, is a motion to quash an administrative subpoena that Homeland Security Investigations served on AAMVA, subpoena number HSI-DC-2026-081167-001, demanding production of the same records by 8:00 a.m. Eastern on Monday, Aug. 17. The records at issue are the roughly 17 million Master Pointer Records in the Commercial Driver’s License Information System: for each commercial driver, a name, date of birth, sex, driver’s license number, state of record, and Social Security number or a flagged substitute.

The states’ complaint opens with the word “sovereign” and never really puts it down. Driver licensing, they argue, “has long been the province of the sovereign states,” CDLIS is state data on a state platform, and the federal demand is a lawless raid on it. That framing will carry weight with readers who know licensing through the family 4-wheeler, but that framing leaves out most of what the industry actually looks like from inside the cab and the regulatory office. Read in the light most favorable to the federal government, which is the light a courtroom will eventually require, this case is weaker than the press releases suggest, and the states may have spent millions of taxpayer dollars to litigate a premise the trucking industry settled in 1986.

The commercial license was never really the states’ invention

A regular driver’s license is a state creature. A CDL is not. Congress created the commercial driver’s license in the Commercial Motor Vehicle Safety Act of 1986 because the state-by-state system had failed in a specific, deadly way: drivers held licenses in multiple states at once and spread their violations across them, staying clean on paper in each jurisdiction while compiling a disqualifying record across all of them. The Senate report behind the Act counted more than 4,000 deaths a year from interstate truck crashes and found that in some states nearly a third of commercial drivers carried multiple licenses. The fix was federal. Congress wrote national testing and disqualification standards, now codified at 49 CFR Parts 383 and 384, told the states to administer them, and told the Secretary of Transportation to build the database that would make one-driver-one-license enforceable.

The CDLIS statute, 49 U.S.C. 31309(a), says the Secretary of Transportation “shall maintain an information system” to “serve as a clearinghouse and depository of information about the licensing, identification, and disqualification” of commercial drivers. Congress did not tell the states to maintain it. Congress did not tell AAMVA to maintain it. It told the Secretary, and then in subsection (d) it let the Secretary run the system “directly or through an authorized operator.” AAMVA is that operator, a contractor standing in the Secretary’s shoes since 1988. The states’ entire theory asks a court to hold that the official Congress charged with maintaining a database may not see what is in it. That is a hard sentence to write with a straight face, and the plaintiffs know it, which is why the complaint works so hard to reframe the statute around the words “clearinghouse” and “depository” and dictionary definitions from 1986.

The plaintiffs’ own exhibit file contains the concession. In its July 27 letter to every state driver licensing agency, quoted at paragraph 95 of the complaint, AAMVA told its members that “[f]ederal statutes establish FMCSA access to all information in CDLIS and the CDLIS Cooperative Agreement provides that AAMVA shall make available to FMCSA all information on driver records.” The custodian of the data, the entity the states now cast as a coerced victim, read its own governing documents and told fifty-one jurisdictions that the federal government has access to everything. A litigant can argue around an admission like that. A litigant cannot make it disappear from its own Exhibit 1.

Interstate by geography, interstate by commodity

The sovereignty framing has a second problem, and it lives in the freight itself. Most CDL holders operating today are certified as non-excepted interstate drivers, the certification category under 49 CFR 383.71 that puts a driver under the full federal safety regime, medical card and all. Most carriers haul interstate freight, and interstate does not just mean crossing a line on a map. Under 49 CFR 390.5, transportation between two points inside a single state is still interstate commerce when it is part of trade, traffic, or transportation originating or terminating outside the state. A driver who never leaves Virginia but pulls containers off the Port of Virginia stacks is in interstate commerce, because the box came across an ocean. The doctrine is old; the Supreme Court called it the practical continuity of movement in Walling v. Jacksonville Paper Co., 317 U.S. 564 (1943), and the FMCSA has applied it to intrastate legs of through freight ever since. Drayage out of a seaport, freight off an intermodal ramp, packages out of an air hub: all of it is federal commerce hauled by federally regulated drivers, no state line required.

The states themselves signed on to this architecture, and they get paid for it. Every state has adopted the Federal Motor Carrier Safety Regulations, or compatible versions of them, as a condition of receiving Motor Carrier Safety Assistance Program money under 49 U.S.C. 31102. That funding is how state troopers run roadside inspections enforcing federal rules, and Part 350 of the regulations requires states to keep their laws compatible with the federal ones or lose it. States carve out intrastate exemptions at the margins, hours-of-service relief for agricultural hauls, age thresholds, weight tweaks, and those carveouts are real. They’re carveouts from an adopted federal baseline, which is the point. On the licensing side, the leverage is even more direct: 49 U.S.C. 31314 lets the Secretary withhold up to eight percent of a state’s federal highway apportionment for CDL program noncompliance, and 49 U.S.C. 31312 lets FMCSA decertify a state’s CDL program outright. A regulatory field where the federal government writes the standards, audits the administrators, funds the enforcers, and can shut down a noncompliant state program is not a field where “the province of the sovereign states” describes the terrain. It describes the nostalgia.

Why the feds came for the pointer records

The complaint treats the June 25 data demand as a bolt from the blue. The sky over CDL licensing has been unclear for a year, and several of the plaintiff states are to blame. On Aug. 12, 2025, a driver named Harjinder Singh attempted an illegal U-turn with a tractor-trailer on the Florida Turnpike near Fort Pierce and three people died in the minivan that ran under his trailer. The investigation that followed found a driver who could not pass an English proficiency check holding commercial credentials out of California and Washington, and it lit a fuse under a question regulators had deferred for years: how many commercial licenses are in circulation that should never have been issued?

The answer, when DOT went looking, was ugly. A federal audit identified more than 200,000 non-domiciled CDL holders nationally, licenses issued to drivers domiciled outside the United States, with a large share suspected of improper issuance. FMCSA’s 2025 Annual Program Review of California, conducted under the authority of 49 U.S.C. 31311 and 49 CFR 384.307, found that roughly 25 percent of sampled non-domiciled records failed to comply with Parts 383 and 384, including a documented case of a Brazilian driver issued passenger and school bus endorsements that stayed valid after his lawful presence expired. California agreed in November 2025 to revoke about 17,000 improperly issued credentials, missed its own deadline, and on Jan. 7, 2026, FMCSA issued a Final Determination of Substantial Noncompliance and moved to withhold roughly $158 million in highway funds. California cancelled about 13,000 of the licenses on March 6. New York had more than $73 million withheld in April on the same theory. A national final rule restricting non-domiciled CDL eligibility took effect March 16, and when challengers asked the D.C. Circuit to stay it, Judges Katsas and Rao declined, writing that petitioners were unlikely to show FMCSA lacked statutory authority.

That year, the data demand stopped looking like a surveillance whim and started looking like the audit trail’s next step. FMCSA is the agency Congress ordered to verify that states issue CDLs only to qualified, lawfully present applicants. It caught one of the largest licensing states with a quarter of its sampled non-domiciled credentials out of compliance, caught a second large state failing to revoke, and has an open question about 200,000 licenses nationwide. Its stated purpose for the pointer records, verifying CDL validity and conducting safety assessments under its Chapter 311 and 313 mandates, maps directly onto the enforcement program it has been running in public since September 2025. The plaintiff roster includes California and New York, the two states already sanctioned in that program. A judge can notice that.

The privacy objection also has a scale problem. The federal government already operates national databases of CDL driver personal information, because Congress told it to. The Drug and Alcohol Clearinghouse, mandated by 49 U.S.C. 31306a, holds violation records tied to identified CDL holders, with mandatory employer queries running millions of checks a year under a published system-of-records notice. FMCSA’s licensing and enforcement systems have handled driver-level data for decades. The pointer record at issue here is five identity fields. The claim that federal possession of those fields is an intolerable novelty has to explain why the far more sensitive federal database of drivers’ failed drug tests has operated for six years without the republic noticing.

Where the states actually have a case

The plaintiffs aren’t wrong about everything, and their strongest card is pretext. FMCSA told AAMVA the data served its safety mandates; DHS then served an instrument captioned “Immigration Enforcement Subpoena” for the same records; FMCSA staff admitted the two agencies coordinated; and DHS offered to withdraw its subpoena if AAMVA satisfied FMCSA. Department of Commerce v. New York, 588 U.S. 752 (2019), stands for the proposition that courts may set aside agency action when the stated rationale is contrived, and the fact pattern here gives the states more to work with than the census case did. The Privacy Act claim also has teeth. FMCSA promised system-of-records notices “under separate cover” and, per the complaint, never delivered them, and an agency ingesting 17 million identified records into a new federal system without a published SORN has a genuine 5 U.S.C. 552a problem that no amount of statutory access authority cures. The government’s weakest flank here is process, not power.

The DPPA count is closer than the states admit. The government-use exception at 18 U.S.C. 2721(b)(1) permits disclosure “for use by any government agency” in “carrying out its functions,” and on its face that language is broad. The states lean on Senne v. Village of Palatine, a Seventh Circuit case about personal data printed on a parking ticket, and on Maracich v. Spears, a case about lawyers trolling DMV records for clients, to read a granular use-it-or-lose-it requirement into the exception. This court sits in the Fourth Circuit, bound by neither gloss. An awkwardness also underlies the whole DPPA theory: Reno v. Condon, 528 U.S. 141 (2000), upheld the constitutionality of the DPPA on the reasoning that driver data sold and shared by states is an article of interstate commerce that Congress may regulate. The states invoke a statute that exists because their driver records are federal regulatory territory to argue that their driver records are beyond federal regulatory reach.

The two filings, on the record

The civil complaint in 1:26-cv-2547 runs seven counts. Counts one through six target the agency defendants under the APA and the Constitution: failure to consult the states as 49 U.S.C. 31309(a) requires, violation of the DPPA, violation of the Privacy Act, action in excess of the CDLIS statute, arbitrary and capricious action including pretext, and a Spending Clause claim that record surrender was never a clear-notice condition of CDLIS participation under Arlington Central v. Murphy. Count seven is a breach-of-contract claim by Illinois, California, Maine, and the District against AAMVA itself, based on confidentiality clauses in four state contracts attached as exhibits. The prayer asks for declaratory relief, vacatur, and preliminary and permanent injunctions barring both the demand and AAMVA’s compliance with it.

The miscellaneous action, 1:26-mc-19, moves under Rule 45 to quash the Aug. 11 DHS subpoena, which cites 8 U.S.C. 1225(d) as its authority and gives its purposes as investigating CDL school fraud, criminal fraud in issuing CDLs to illegal aliens, and civil immigration enforcement. The states attack it as a John Doe subpoena seeking identifying data on millions of people unknown to the agency, as exceeding the immigration statute’s scope, as procedurally invalid, as issued in bad faith to backstop FMCSA’s demand, and as violating the DPPA and Privacy Act. They want the Court to stay compliance while it hears the motion. The timeline behind both filings is compressed: FMCSA’s demand letter on June 25, correspondence through July 10, an in-person meeting July 23 that the complaint says ended with a threat to cancel all of AAMVA’s roughly $10 million in federal grants and contracts, the first DHS subpoena served in person July 28, AAMVA’s opt-in proposal rejected as “unacceptable” on Aug. 11 alongside the second subpoena, and AAMVA telling the states on Aug. 12 that it will not produce by Monday. AAMVA’s board met Aug. 14. The production deadline, the funding threat, and now a federal judge all converge on Aug. 17.

Where this leaves the plaintiffs: they’ve filed a sovereignty case about an industry that stopped being theirs in 1986, over records held in a system Congress assigned to the Secretary of Transportation, weeks after their own custodian told them in writing that the federal government has access to all of it. The pretext and Privacy Act claims may well win them a TRO on Monday and could win them more, because the government cut corners on process that it had no need to cut. Winning on process while the record establishes federal primacy over the data is a strange kind of victory, and an expensive one. Anyone who has spent a career hauling, brokering, insuring, or reconstructing this industry’s freight could have told the twenty-three attorneys general what the litigation will now teach them at public expense: in trucking, the federal government isn’t the intruder in the states’ house. It built the house.