Yellow Jacket InitiativeBy E. Lawrence Anderson, Yellow Jacket Initiative
As of Sunday, October 25, 2026, about 7:30 a.m. ET. Sources: Department of State, Privacy Act of 1974; System of Records (State-26, Passport Services Records), Public Notice 13151, FR Doc. 2026-21695, 91 FR 66906–66910 (October 23, 2026); the 2015 State-26 notice, Public Notice 9068, FR Doc. 2015-06691, 80 FR 15653–15657 (March 24, 2015); the companion notice FR Doc. 2026-21694; and regulations.gov docket DOS-2026-1156.
Update, Sunday, October 25, 2026, about 7:40 a.m. ET: the comment instructions below were corrected about 15 minutes after first publication. The original "Where" line read: "regulations.gov, docket number DOS-2026-1156. Search for the docket number and follow the site's instructions. If the docket does not appear yet, search regulations.gov for 'State-26' or FR Doc. 2026-21695." The original docket sentence read: "When we checked regulations.gov on Sunday morning, October 25, the docket showed no posted documents, and the Federal Register's own record links this notice to a different, general State Department docket." Opened in a browser, the DOS-2026-1156 docket returns "not found"; the notice is open for comment as document DOS_FRDOC_0001-7298.
On Friday, October 23, 2026, the Department of State published a notice in the Federal Register modifying the Privacy Act system of records that holds U.S. passport files: Public Notice 13151, FR Doc. 2026-21695, 91 FR 66906–66910. The system, State-26, last published in full in 2015 (80 FR 15653), is renamed from "Passport Records" to "Passport Services Records." It covers passport books and cards and their applications from 1925 to the present, Consular Reports of Birth Abroad, and related records (91 FR 66907).
A Privacy Act "routine use" is a published permission for an agency to disclose records outside itself without the individual's written consent. This notice adds three of them.
What is new.
We compared the routine uses line by line against the 2015 notice. Twenty-one uses, (a) through (t) and a closing catch-all, carry over; the catch-all moves from letter (u) to (x) with the same text. Most carry over word for word. Three are new:
- (u) and (v): disclosures to respond to a suspected or confirmed data breach, at State or at another federal agency (91 FR 66908–66909). The notice describes these as following "new Office of Management and Budget (OMB) guidance including breach notification routine uses."
- (w), quoted in full: "Various entities including, but not limited to, Federal, state, territorial, tribal, and local government agencies, and non-profit organizations, utilizing federal government verification platforms, for the purpose of verifying the identity or citizenship for users accessing government websites and applications, voter eligibility, and other governmental services" (91 FR 66909).
One existing use is reworded. Use (n) in 2015 covered "Attorneys representing an individual" in passport proceedings "when the individual to whom the information pertains is the client of the attorney making the request." The 2026 text covers "Parties and their attorneys in administrative or judicial passport proceedings when necessary for the adjudication of a case involving the individual who is the subject of a Departmental record" (91 FR 66908). The notice's stated aims include clarifying "the use of passport records in administrative hearings."
The system's statement of purposes also changed. In 2015 it listed passport adjudication, "social security benefits, employment applications, estate settlements, and Federal and state law enforcement and counterterrorism purposes" (80 FR 15654). The 2026 version inserts "voter eligibility" into that list (91 FR 66907).
What the notice does not say.
The notice does not name any "federal government verification platform." It does not define which "non-profit organizations" are meant or what role they would have. It does not limit (w) to election officials. "Including, but not limited to" means the list of entities is not exhaustive. We have not seen any record showing a disclosure has been made under (w).
The State Department's explanation.
The Department says the changes "reflect the Department's move to cloud storage and new Office of Management and Budget (OMB) guidance including breach notification routine uses, and to clarify the use of passport records in administrative hearings and by additional users for identity verification" (91 FR 66907). That is the Department's own account.
Some context supports a routine reading. Passport records already exist "to establish the U.S. nationality and identity of persons" (91 FR 66907). Two of the three new uses, (u) and (v), are the standard breach-response uses federal agencies have been adding to their notices across the board. Existing use (a), unchanged since 2015, already allows disclosure to the Department of Homeland Security for E-Verify employment checks and to help state driver's-license offices confirm a passport is authentic. And a routine use permits a disclosure; it does not require any agency or organization to make or request one.
What is new is the combination in (w): citizenship verification, "voter eligibility" by name, and recipients that reach beyond government to non-profit organizations, through platforms the notice does not identify.
Timing.
Under the notice, everything except (u), (v) and (w) took effect on publication, October 23. Those three are open for comment, and "Unless comments are received that would require a revision, routine uses (u), (v), and (w) will become effective on November 23, 2026" (91 FR 66906). Monday, November 23 falls 20 days after Election Day (Tuesday, November 3). On the notice's own dates, (w) is not in effect for this election.
How to comment.
- Deadline: Monday, November 23, 2026.
- Where: regulations.gov. The notice names docket number DOS-2026-1156, but on Sunday morning, October 25, that docket number returned "not found" there. The notice itself is posted for comment as document DOS_FRDOC_0001-7298, with a Comment button and a deadline of November 23, 2026, 11:59 p.m. Eastern. [Updated October 25, 2026]
- Note: the notice says "Comments submitted in a manner other than the eRulemaking Portal will not be considered comments on the System of Records Notice (SORN) and might not be considered by the Department" (91 FR 66906–66907). Questions (not comments) can go to the Senior Agency Official for Privacy at SORN@state.gov, subject line "Passport Services Records, State-26."
Useful questions for a comment: which verification platforms (w) covers; which non-profit organizations, and under what agreements; what data elements would be shared; and how an individual could find and correct an inaccurate record used to judge voter eligibility.
The Federal Register's record links this notice to a general State Department docket, DOS_FRDOC_0001, rather than DOS-2026-1156. That record, checked early Sunday, October 25, showed 0 comments posted. Comments are often posted with a delay, so that is not evidence that no one has commented. [Updated October 25, 2026]
A same-day companion notice (FR Doc. 2026-21694) rescinds a separate, defunct system, State-02 (Board of Appellate Review Records). The notice says the board "was disbanded in 2008."
Primary sources: FR Doc. 2026-21695, 91 FR 66906–66910 (October 23, 2026); Federal Register record; 2015 State-26 notice, 80 FR 15653–15657 (March 24, 2015); FR Doc. 2026-21694, rescindment of State-02; regulations.gov document DOS_FRDOC_0001-7298 (comment page).
Read the text.
Independent Research. All Documents Freely Reproducible.