Last updated: March 2026
The Privacy Act of 1974 (the Act) sometimes creates a tension between the strict language of the law and the way things really work. The Act only protects U.S. persons, i.e., citizens and lawful permanent residents (LPRs, or “green card” holders). However, some agencies serve both U.S. persons and non-U.S. persons in the same program. In those cases, agencies run mixed systems that contain records on both populations. Agencies often can’t tell who is a U.S. person, and therefore covered under the Act, because they rarely need real-time data on immigration status to run their programs.
This document provides a two-page overview of how agencies have handled this tension and the current state of play.
Learn more about mixed systems, read the brief: