A coalition of 22 states and the District of Columbia filed a sweeping federal lawsuit on August 13, 2026, targeting the Federal Motor Carrier Safety Administration (FMCSA), the U.S. Department of Transportation (DOT), and the American Association of Motor Vehicle Administrators (AAMVA) over an unprecedented government demand for the bulk transfer of 17 million commercial driver license records. The case, State of Illinois et al. v. U.S. Department of Transportation et al., No. 1:26-cv-2547 (E.D. Va.), could become one of the most consequential legal confrontations involving the trucking industry's regulatory infrastructure in decades.
What Is CDLIS and Why Does It Matter?
Congress authorized CDLIS in 1986 under the Commercial Motor Vehicle Safety Act to give states an efficient, secure mechanism for sharing information about CDL applicants. The system is operated by AAMVA, a nonprofit trade association whose members include all 50 states and the District of Columbia, under contract with FMCSA.
CDLIS functions as a clearinghouse of "Master Pointer Records" (MPRs), which contain a driver's name, date of birth, Social Security number (or a substitute), sex, and driver's license number, along with the issuing state. When a state processes a CDL application, it queries CDLIS to determine whether the applicant holds a license in another state or has a history of disqualification, a safeguard against drivers "license shopping" across jurisdictions to hide a problematic driving record.
Federal law requires states to query CDLIS before issuing or renewing a CDL. Failure to comply puts up to 8% of each state's federal highway funding at risk, a figure representing hundreds of millions of dollars annually for larger states. The system has operated continuously since 1988, and every state has built its CDL issuance procedures around it.
The Data Demand
On June 25, 2026, FMCSA sent a letter to AAMVA demanding a bulk download of the entire CDLIS database going back five years, all 17 million MPRs, including names, dates of birth, driver's license numbers, and Social Security numbers. For records lacking an SSN, FMCSA also demanded to know the date the number was removed. AAMVA noted this was unprecedented; FMCSA had never before sought bulk access to any portion of the CDLIS database.
Over the following weeks, AAMVA pushed back, raising concerns under the Driver's Privacy Protection Act (DPPA), the Privacy Act of 1974, and its own contracts with member states. FMCSA's responses were vague, citing its general statutory safety and regulatory mandates without specifying how it would actually use all 17 million records.
Then, on July 28th, one day after AAMVA notified its state members of the demand, the Department of Homeland Security served a separate, in-person subpoena on AAMVA requesting the identical dataset, explicitly titled an "Immigration Enforcement Subpoena." FMCSA staff subsequently confirmed to AAMVA by email that the two agencies had coordinated their demands. When AAMVA proposed an opt-in/opt-out mechanism allowing individual states to authorize or decline disclosure of their own data, FMCSA rejected it outright as "unacceptable."
On August 11, 2026, two business days before the states filed suit, FMCSA escalated further. It threatened to cancel all of AAMVA's federal grants and contracts unless AAMVA delivered the full dataset by 8:00 a.m. on August 17. DHS simultaneously served a second, identical subpoena with the same deadline. AAMVA notified the plaintiff states on August 12 that it would not comply by that date, and the lawsuit was filed August 13.
The Legal Arguments: Seven Causes of Action
The states' complaint asserts seven distinct causes of action, alleging the following:
Violation of the CDLIS statute (49 U.S.C. § 31309): FMCSA issued the Data Demand without consulting the states, as the statute explicitly requires before any significant changes to CDLIS.
Violation of the Driver's Privacy Protection Act (DPPA): The DPPA prohibits bulk disclosure of "highly restricted personal information" — including SSNs — from motor vehicle records unless a specific statutory exception applies. The states argue the "government use" exception cited by FMCSA does not cover indiscriminate bulk extraction of 17 million records without demonstrating that every piece of data will actually be used for a legitimate government function.
Violation of the Privacy Act of 1974: FMCSA failed to publish a required System of Records Notice (SORN) before establishing what would effectively be a new federal database of state driver records, and violated multiple procedural and substantive requirements of the Act.
Excess of Statutory Authority (49 U.S.C. § 31301 et seq.): The CDLIS statute authorizes FMCSA to maintain a clearinghouse for state-to-state information sharing, not to seize state-owned records for its own use and redistribution.
Arbitrary and Capricious Agency Action (APA): FMCSA departed from decades of settled policy without acknowledging the change, providing a reasoned explanation, or considering reliance interests. The states also argue FMCSA's stated rationale is pretextual, given the coordinated DHS immigration enforcement subpoena.
Violation of the Spending Clause: Because participation in CDLIS is conditioned on federal highway funding, any new conditions must be set out "unambiguously" in advance. The CDLIS statute contains no provision permitting the federal government to demand bulk transfer of state driver records as a condition of participation.
Breach of Contract (against AAMVA): Illinois, California, Maine, and the District of Columbia have contracts with AAMVA that expressly prohibit disclosure of confidential driver data without state authorization and require compliance with state and federal privacy law. No contracting state has authorized AAMVA to release its data to FMCSA in response to this demand.
FMCSA and DOT's Response
Secretary of Transportation Sean Duffy wasted no time responding. In a statement released the evening of August 13, 2026, Secretary Duffy characterized the lawsuit as an effort by "radical state AGs" to "make it harder for my Department to enforce the rules of the road and easier for dangerous illegal immigrant truck drivers to operate a big rig."
"Every administration since 1988 has had access to this basic database, so let's be clear on what this ridiculous lawsuit is really all about. These radical state AGs want to make it harder for my Department to enforce the rules of the road and easier for dangerous illegal immigrant truck drivers to operate a big rig. They may not care about keeping you and your family safe, but President Trump and I do. We will fight this lawsuit tooth and nail to prevent more senseless crashes by unqualified drivers." — U.S. Transportation Secretary Sean P. Duffy
DOT's statement pointed to a fatal August 12, 2025, Florida Turnpike crash involving an undocumented driver with an allegedly fraudulently issued CDL as context for the administration's enforcement push. It also highlighted actions taken since President Trump's April 2025 Executive Order directing FMCSA to restore integrity to the trucking industry, including:
Revocation of over 30,000 allegedly illegally issued CDLs across non-compliant states
Removal of nearly 10,000 fraudulent or unqualified CDL training providers from the federal registry
Enforcement of English Language Proficiency (ELP) standards, placing over 26,000 non-compliant operators out of service
Closure of the non-domiciled CDL loophole
DOT's position is that AAMVA "operates the CDLIS database on behalf of the federal government" and is "contractually and legally obligated to furnish the requested records at FMCSA's direction, with federal protection against state-level liability." The states and AAMVA vigorously dispute this characterization.
How This Connects to the Non-Domiciled CDL Crackdown
Trucksafe readers will recognize the CDLIS dispute as part of a broader enforcement pattern we have been tracking since 2025. FMCSA's aggressive CDL integrity campaign, which we covered in detail in our articles on the non-domiciled CDL crackdown, has been steadily escalating. The closure of the non-domiciled CDL loophole, which allowed foreign nationals to obtain CDLs through states with less stringent vetting requirements, was a direct precursor to the current confrontation.
The administration's position, reflected in Secretary Duffy's statement, is that bulk access to the CDLIS database is necessary to identify drivers who obtained CDLs through fraud or through non-compliant state programs. The states counter that FMCSA already has the ability to query CDLIS on an individualized basis, the same way states use it, and that there is no legitimate safety justification for demanding a snapshot of all 17 million records, particularly when the coordinated DHS immigration subpoena reveals the actual intended use.
What Fleets Should Watch For
Here is what compliance professionals should monitor closely in the coming days and weeks:
Preliminary injunction ruling: The states are seeking emergency relief before August 17. If granted, CDLIS continues operating and the data transfer is blocked pending full litigation. If denied or delayed, the situation could become chaotic.
CDLIS availability: If AAMVA's funding is cut, states may suspend CDL issuance.
Driver qualification file implications: If CDL issuance freezes in any state, carriers may face challenges onboarding new drivers or maintaining compliant driver qualification files for drivers whose licenses expire during any system outage.
Possible appeal or settlement: Given the national stakes, a negotiated resolution or congressional intervention is possible. We will report developments as they occur.
Downstream immigration enforcement: If FMCSA does obtain the data and shares it with DHS, carriers with drivers who hold CDLs issued under programs now under scrutiny could face elevated enforcement attention.
Regardless of how this lawsuit resolves, it signals that the federal government's scrutiny of the CDL issuance process is intensifying. Fleets should ensure their driver qualification files are current and complete, that all CDLs on file were properly issued and remain valid, and that any drivers subject to prior concerns about CDL fraud have been properly vetted.
Trucksafe will continue covering this litigation as it develops. If you have questions about how to protect your fleet's compliance posture in light of these developments, contact our team.
