How Routine Use 10 Changes the Data Path
The modified TANF Data notice does more than add a sentence about sharing. It connects a broader program-integrity purpose to outside verification sources, a named disclosure route, and a retrieval rule based on Social Security numbers. This chapter follows that chain so the reader can distinguish the path the notice describes from a matching operation or transfer that the supplied evidence does not prove.
From benefit administration to program integrity
The June 2026 modified notice retains familiar administrative purposes for TANF Data. The system is used to determine whether grantees are ensuring that recipients are eligible, to compile information for reports to Congress, and to conduct research on caseload dynamics and employment trajectories. Alongside those purposes, however, the notice adds a more detailed account of federal oversight.
The new oversight purpose is framed as program integrity. The notice says ACF may use HHS agency activities—including comprehensive reviews of how grantees administer TANF, financial and programmatic audits, fraud investigations, and ongoing monitoring—to confirm that grantees comply with program requirements. The examples include complete and accurate reporting, work-participation rates, time limits, and verification of recipients' citizenship or immigration status in records maintained by the Department of Homeland Security and U.S. Citizenship and Immigration Services.
That grouping changes how the system is described. Eligibility reporting and congressional statistics are uses tied closely to the ordinary administration of a grant program. Program-integrity work is an oversight category that can include checking whether another public entity administered the program correctly. The notice presents both as purposes of the same records system, but they are not identical activities. The first asks what a grantee reported about a case and whether a recipient met program rules. The second can ask whether that report is consistent with information held elsewhere or whether the grantee's broader administration meets federal requirements.
The notice also adds two authorities to the authority section: 42 U.S.C. 1320b-7 and 8 U.S.C. 1373. Listing a statute in that section tells the reader which legal provisions the agency invokes as part of the system's foundation. It does not convert the citation into a judicial determination that the provision authorizes every use later described. That distinction becomes central to the states' lawsuit, but it is already visible in the notice's structure: the agency states an authority, then describes a purpose and a disclosure mechanism that may be tested against that authority.
What routine use 10 actually says
Under the Privacy Act framework described in the notice, a routine use identifies circumstances in which information from a system of records may be released without the individual's consent. “May” matters. The language describes a permitted route the agency says is available under specified conditions; it does not mean that every record must be disclosed or that any recipient can obtain the entire system.
Routine use 10 is the new route at the center of this dispute. It says records may be disclosed to another federal or grantee agency or entity engaged by ACF to assist with program-integrity reviews or projects. The notice names DHS and TANF program administrators as examples. The stated purpose is to verify whether TANF grantee agencies are complying with TANF requirements, including by verifying citizenship or immigration status.
Several limits are built into that sentence. The outside organization must be another federal or grantee agency or an entity engaged by ACF. The assistance must concern a program-integrity review or project. The verification must relate to compliance with TANF requirements. These conditions do not answer the ultimate legal question, but they are more precise than the shorthand claim that the notice “allows sharing with anyone.” At the same time, the route is not confined to information already held inside one TANF office. It expressly contemplates another organization participating in the work and gives an immigration-status verification example.
The roles can also change from one step to the next. An agency might be a source of verification information, a recipient of records, or both in a particular project; the notice does not say that every outside entity plays all of those roles. A TANF administrator might receive information to help evaluate grantee compliance. DHS is named as an example of an entity that could assist with the project, but the example alone does not establish a transfer to DHS. The crucial factual predicate is engagement in the relevant project, not mere existence as a federal agency.
The notice's own language provides a further qualification. Its routine-use section says these disclosures are additional to the statutory Privacy Act provisions and that each proposed disclosure will be evaluated to ensure that it is legally permissible. Routine use 10 therefore supplies the system's stated disclosure framework, while preserving a separate legal review at the point of a proposed disclosure. Whether that review is adequate, and whether other statutes impose additional conditions, are questions the notice does not decide.
The word “engaged” does important work in this design. Routine use 10 does not describe a standing entitlement for every federal agency to inspect TANF Data. It describes a disclosure to an agency or entity that is participating in an ACF program-integrity review or project. The notice does not say how that engagement is created, what document records it, how long it lasts, or whether the entity may use the information for anything beyond the project. Those omissions do not erase the route the notice describes; they identify the points at which a real disclosure would need more specific facts.
The same is true of the information exchanged. A project would have to identify what TANF information is relevant to the compliance question, which outside information is being used for verification, and which entity is meant to receive a record. The notice gives examples of fields and recipients but does not establish that all fields would move together, that a whole case file would be exported, or that verification information would automatically flow back to a grantee. It also does not specify how a discrepancy would be resolved when the TANF report and outside source disagree. A result marked as needing additional verification is not the same as a final finding of ineligibility or wrongdoing.
This is why the mechanism should be read as a set of control points rather than as a single event. ACF's stated purpose must connect to a program-integrity project; the outside participant must have the relationship described in the routine use; the information must be located and used for the stated verification task; and the proposed disclosure must pass the legal-permissibility review the notice itself preserves. The source materials do not show how any particular project passed those points. They show why each point matters when assessing the notice's practical reach.
The sequence is an explanatory rendering of the notice's architecture, not a record of a completed transaction. It shows that the receiving entity appears at a particular stage and for a stated task. It does not imply that ACF must disclose every record, that the verification source is always a separate agency, or that an outside entity can reuse the information for an unrelated purpose.
Why outside verification changes the mechanism
The difference between an internal review and an outside verification project is not just the number of agencies involved. It changes the path by which a fact about a TANF case could be evaluated.
Start with a hypothetical example, used only to illustrate the notice's mechanism. A TANF grantee reports a household record to ACF. The record includes an identifier and information relevant to eligibility. ACF then undertakes a program-integrity project and uses information obtained from another government source to verify one part of the report. If the project falls within the notice's described routine use, ACF may disclose records to an engaged federal or grantee entity assisting with that verification. The outside information may confirm the report, reveal a discrepancy, or require additional verification. Each of those is a possible stage in the described process, not evidence that this particular household or project exists.
The modified notice makes the outside source explicit. Verification information may come from the grantee agencies, other HHS records, or other federal or state agencies or entities engaged to assist ACF. The examples include names, addresses, county, dates of birth, Social Security numbers, and detailed immigration-status information. That means the system can be described as connecting the TANF program's own report with information produced in another institutional context.
This is where the sharing boundary becomes operationally meaningful. A record can cross an institutional boundary before it crosses a legal one. The data may originate with a state or Tribal program, be held by ACF, be checked against another record source, and be disclosed to an entity assisting the review. Each movement creates a distinct question: who supplied the information, who controls the next use, what purpose justifies the use, and what happens if the sources disagree? The notice supplies the broad architecture but not the answer to every question about governance or error correction.
SSN retrieval is the linkage point
The notice's retrieval rule gives this architecture a concrete operating point. It says grantee-reported records are retrieved by Social Security number or case number. Verification information is retrieved by Social Security number. This does not describe an algorithm, but it explains how the system's two streams can be located in relation to a person.
A Social Security number therefore plays two roles in the notice. It is one of the identifying data elements that may appear in adult or child records, and it is the stated retrieval key for verification information. A case number can locate the grantee-reported case, while an SSN can locate verification information associated with the individual. That distinction helps explain why the new outside-source language has practical force: the system is not merely storing a narrative statement that someone was checked. It specifies an identifier by which verification information is retrieved.
The inference must stop there. A retrieval key does not tell us how two records are matched, how duplicate or changed identifiers are handled, how false matches are detected, or who reviews a disputed result. The sources do not provide a match threshold, an error rate, an automated decision rule, or an account of consequences for a person whose information does not align. The design makes comparison possible in the ordinary sense of the word; it does not establish that a computer match occurred or that a result was used to deny or change a benefit.
That boundary is especially important because the lawsuit raises a Computer Matching Act theory. The California Department of Justice says the coalition argues that an agreement required for sharing with another agency does not exist. The statement tells us what the plaintiffs contend. It is not independent evidence of the agreement's absence, and it is not a court ruling that the Act applies or was violated. A matching agreement, if one exists, would be a separate implementation artifact that the supplied materials do not contain.
Where the described path stops
Routine use 10 does not turn the whole system into an unrestricted public pool. Its text names a class of potential recipients, a relationship to ACF, and a program-integrity purpose. But neither does the text settle every boundary that matters. The notice does not establish the volume of records to be shared, whether disclosure would be one-time or recurring, which fields would be transferred for a particular project, how long a recipient could retain them, or what safeguards would govern the recipient's own systems.
Nor does the notice prove that the path has been activated. The supplied material contains no data-transfer log, project plan, matching agreement, agency implementation report, or individual case outcome. The fact that the notice added a route can support a statement about intended design. It cannot support the stronger statement that an agency used the route in a particular case. Absence of those artifacts in this source set is an evidence gap, not proof that no transfer, agreement, or review exists elsewhere.
The effective date supplies another stopping point. The June notice carved out routine use 10 and subparagraph (a) under routine use 1 for a later effective date. Later notices successively moved that date. The exact timeline matters enough to receive separate treatment; for now, it is sufficient to see that a written routine use and an operative routine use are not necessarily the same thing at the same moment.
The mechanism can therefore be stated without exaggeration. ACF's modified description connects TANF reports to outside verification information. It identifies SSN retrieval for that verification stream. It adds routine use 10 for disclosure to an engaged federal or grantee agency or entity assisting a program-integrity review, with DHS and TANF program administrators as examples. The notice also preserves a statement that each proposed disclosure must be legally permissible. What remains open is whether a specific disclosure would satisfy that condition, whether matching requirements apply, whether the delayed provision was in force at the relevant time, and whether any described operation actually occurred.
That is the difference between a data path on paper and a data path in practice. The paper path tells us what to investigate next: the dates that govern it, the legal theories that challenge it, and the evidence that would show whether it moved from design into operation.