What to know about the key laws invoked in the scores of Trump legal challenges

Washington — Dozens of lawsuits have been filed in the past month challenging executive actions President Trump has taken since the start of his second term in office, and federal courts from coast to coast have started scrutinizing the president’s plans.

The challenges are aimed at unwinding many of the president’s policies, which they believe are unlawful. They have targeted his plans to crack down on illegal immigration, shrink the size of the federal government and cut spending, as well as Mr. Trump’s pledge to end what he believes is the weaponization of the Justice Department and FBI.

Many of the lawsuits hinge on alleged violations of decades-old federal laws: The Administrative Procedure Act, the Privacy Act and the Impoundment Control Act. The measures prescribe certain procedures and policies that the executive branch must follow when it comes to taking certain actions.

Here is what to know about each of the laws:

Administrative Procedure Act

Lawsuits challenging Mr. Trump’s actions on gender ideology, immigration, civil service rules, FBI agents, deferred resignations, USAID cuts, foreign aid pauses and federal assistance freezes all have one thing in common: they allege the Trump administration and senior officials have violated the Administrative Procedure Act.

Enacted by Congress in 1946, the law, known as the APA, established the process that federal agencies must follow when creating new rules and regulations, and how courts review those actions. The law’s requirements do not apply to the president.

“In the late 1940s, at a time when agencies were doing more and more, and agencies often had their own procedures for doing certain things, Congress wanted to largely standardize the procedures that agencies need to go through when they either make or repeal or reform a regulation or when they take specific action through agency adjudication,” said Adam White, a senior fellow at the American Enterprise Institute who focuses on the Supreme Court and the administrative state.

The APA requires agencies to provide the public with notice of a proposed rule and the chance to offer written comment on it. Once the notice-and-comment period is closed, the agency then publishes its final rule in the Federal Register. This must be done at least 30 days before the rule takes effect.

Courts reviewing a challenged agency action typically consider whether an agency’s action is “arbitrary and capricious.” The standard of review requires an agency to show that it engaged in “reasoned decisionmaking” by providing an adequate explanation for its decision, according to the Congressional Research Service. The agency also has to provide “the essential facts upon which the administrative decision was based.”

“To make a rule, an agency under the APA normally has to give reasons for its rule, and arbitrary and capricious review is a consideration of those reasons,” White said. 

Arbitrary and capricious review is deferential to the agency, which will often prevail in cases alleging violations of the APA if their explanation is “even plausibly reasonable,” White said.

“The government usually wins because it’s a very deferential standard of review, but every once in a while it loses because it just didn’t connect the dots on the policy it was trying to explain,” he said.

Most of the lawsuits filed against the Trump administration that seek to invalidate its actions allege violations of the APA, and specifically claim the targeted policies are arbitrary and capricious.

In one of the cases that challenges a memo freezing federal assistance, a group of nonprofit organizations argues that the funding pause is arbitrary and capricious “in multiple respects.” The suit argues that the directive fails to acknowledge the “catastrophic practical consequences” of halting federal assistance and did not articulate why a review of existing grant programs requires they be paused.

But the challengers also allege that OMB does not have the authority to unilaterally freeze federal financial assistance programs government-wide.

The APA has tripped up the last two administrations.

In a decision from June 2020, the Supreme Court ruled that Mr. Trump’s rescission of the Deferred Action for Childhood Arrivals immigration program, or DACA, violated the APA. The high court found the rescission was arbitrary and capricious, and said the first Trump administration failed to consider certain issues when it walked back the DACA program, such as the impacts to young people who were enrolled.

Then, in its last term, the Supreme Court blocked a rule from the Environmental Protection Agency under former President Joe Biden that aimed to address the harmful smog that travels from certain states. The court said a group of states that challenged the rule were likely to prevail on their claim that it was arbitrary and capricious, in part because of the EPA’s decisionmaking regarding concerns raised during the notice-and-comment period.

Privacy Act

Enacted in 1974, the Privacy Act was passed during the Watergate scandal and at the advent of new technologies like mainframe computer systems that allowed for the storage of millions of Americans’ information.

“It was Congress’ effort to control what government may do with the information it collects about American citizens and to provide, to a limited degree, an ability for American citizens to review and respond to that use through lawsuits and more particularly through congressional oversight,” Paul Rosenzweig, an expert in homeland security and national security, told CBS News.

The law governs the government’s collection and use of Americans’ information kept by agencies. It lays out how the government must store that information, who can access it and when the government can use the data or disclose it. The Privacy Act also prohibits agencies from disclosing records pertaining to an individual without their written consent, unless it falls under an exception.

These 12 exceptions allow the government to use personal information in certain circumstances without the individual’s approval, such as for law enforcement activity, or when the information cannot be tied with a specific person, such as for statistical research. A “need-to-know” exception lets an agency disclose Privacy Act records to its officers and employees who need the record to perform their duties, while another allows disclosure when the information is needed for a “routine use.”

The Privacy Act gives Americans the right to sue an agency for an alleged violation of the law. A well-known case was brought by Linda Tripp, who was a central figure in the impeachment scandal involving former President Bill Clinton. 

Tripp accused the Defense Department of violating the Privacy Act by disclosing personal information to a newspaper. She filed three lawsuits against the agency, and the case eventually ended with a settlement in which the Defense Department agreed to pay Tripp $595,000.

Now, the law has been invoked in several lawsuits stemming from the work of the White House’s Department of Government Efficiency, or DOGE, which was established by Mr. Trump as part of his efforts to shrink the size of government.

In November, the president said Elon Musk would lead DOGE, though the White House has since said he is a special government employee and senior adviser to Mr. Trump, and not the administrator of the task force.

Since DOGE’s formal creation on Mr. Trump’s first day in office, its employees have been dispatched to more than a dozen federal agencies and started accessing data systems. But their efforts have raised concerns among labor unions and Democratic-led states, which have in turn filed lawsuits seeking to block  DOGE’s access.

“This is a novel set of circumstances involving wholesale disclosures and wholesale access,” Rosenzweig said. He noted that while Privacy Act lawsuits typically center on a specific person’s complaint, “we’ve never seen that many suits of this scope and scale. We’ve also never seen an administration purport to authorize access to such a wide range of people who would not normally be given access: special government employees in DOGE.” 

The suits allege that several agencies — including the Departments of Labor, Health and Human Services, Treasury and Education — have violated the Privacy Act by disclosing Americans’ personal information to DOGE staff without their consent.

“People who must share information with the federal government should not be forced to share information with Elon Musk or his ‘DOGE.’ And federal law says they do not have to,” lawyers for a group of unions wrote in a lawsuit against Treasury Secretary Scott Bessent challenging DOGE’s access to sensitive personal and financial information maintained by the Bureau of the Fiscal Service. 

But the Trump administration has argued that DOGE employees are authorized to access the records and are being supervised by the agencies to which they have been detailed. At the Treasury Department, for example, Justice Department lawyers invoked the need-to-know exception and said in a filing that DOGE team members were agency employees who have a need for the records to perform their duties.

“Need-to-know is based upon need and thus the asserted justification for why they must have access is fair ground for court-based inquiry,” Rosenzweig said. “For as long as the Privacy Act has been around, that need has been measured by both the asserted government interests and, to some degree, the sensitivity of the data at issue. It’s not canonical, but it is a common-sense assessment that if you really want to know my health records, you better have a damn good reason.”

The cases are in their early stages, and no judge has ruled definitively on whether the Trump administration has violated the Privacy Act by allowing Musk and DOGE access to agency records without Americans’ consent.

Judges have, though, denied preliminary requests to prevent DOGE staff from getting into systems at some agencies. In one decision from U.S. District Judge John Bates, the court found that a group of labor unions was unlikely to succeed on their claims that the Trump administration is violating the Privacy Act by allowing DOGE access to systems at the Departments of Labor and Health and Human Services, and the Consumer Financial Protection Bureau.

The Impoundment Control Act 

Court fights aimed at the Trump administration’s 90-day pause on foreign development assistance argue that it is violating the Impoundment Control Act, while federal judges overseeing cases involving the Office of Management and Budget’s memo halting federal aid have both cited the law.

Enacted in 1974, the law aimed to reassert Congress’ power of the purse by providing the procedures for when a president wants to suspend appropriations that have already been approved by Congress. The law was enacted following attempts by President Richard Nixon’s administration to not spend money that had been appropriated by Congress, according to the Government Accountability Office.

The measure allows the president to temporarily withhold or cut approved funds in certain circumstances. But under the law, he must first send a “special message” to Congress that details the request to rescind or withhold funds. In the case of rescissions, Congress must then pass legislation cutting the funding.

The administration’s attempts to halt foreign aid and federal assistance programs may have been aimed at sparking legal challenges to the Impoundment Control Act, as they have done.

OMB Director Russell Vought said during his confirmation hearing that Mr. Trump believes the impoundment law is unconstitutional.

In decisions temporarily halting the administration’s funding freeze while litigation continues, judges have raised the Impoundment Control Act.

U.S. District Judge Loren AliKhan pointed to the Impoundment Control Act as one example of the legislature prohibiting “the executive branch from encroaching on Congress’s appropriations power.” U.S. District Judge John McConnell issued a separate ruling in which he found there is “no evidence that the executive has followed the law by notifying Congress” to bring about a pause that would be legally allowed.