Your driver's license information is protected by state and federal privacy laws that limit who can see it and how it can be used

When you get a driver's license, you hand over sensitive information: your address, date of birth, Social Security number, and sometimes a photograph. States are required by federal law to keep that data private and to say no to most requests for it. The main protection comes from the Driver's Privacy Protection Act (DPPA), a 1994 federal law that sets a floor for how states must handle license records. On top of that, each state has its own privacy laws that often go further.

The key thing to understand is that your state's Department of Motor Vehicles (DMV) cannot sell your personal information to just anyone who asks. They can only release it to a short list of people and organizations — law enforcement, courts, insurance companies in certain situations, and a few others. If someone wants your information and is not on that list, the DMV has to say no.

Key Takeaways

  • The Driver's Privacy Protection Act is a federal law that stops states from selling or sharing driver's license information without your permission, except to a limited list of authorized users.
  • Each state adds its own privacy rules on top of the federal law, so the level of protection varies depending on where you live and got your license.
  • Law enforcement, courts, insurance companies, and a few other organizations can request your information without your consent, but most other requests require your written permission.
  • Violations of the DPPA can result in civil lawsuits against the person or company that obtained your information illegally, and some states allow you to recover money for the breach.

The Driver's Privacy Protection Act and what it covers

Congress passed the DPPA in 1994 after a stalker used a private investigator to obtain a woman's address from her driver's license record. The law says states cannot release personal information from license records without a permissible purpose — a legal reason that falls into one of about a dozen categories.

The DPPA defines "personal information" as your name, address, telephone number, Social Security number, date of birth, photograph, and signature. It does not cover information that is already public, like your name and address if they appear in a phone book, but it does protect that same information when it is in your DMV file.

The law applies to all 50 states and the District of Columbia. States that do not follow it can lose federal highway funding, so compliance is not optional. However, the DPPA sets a minimum standard — states are allowed to be stricter, and many are.

Who can request your information without your permission

The DPPA lists about a dozen categories of people and organizations that can request your personal information from the DMV without asking you first. These are called "permissible purposes." They include:

  • Law enforcement agencies investigating crimes or conducting background checks
  • Courts and judges in legal proceedings
  • Insurance companies underwriting or settling claims related to you
  • Employers and potential employers conducting background checks (in some states)
  • Government agencies for licensing, registration, or benefit purposes
  • Private investigators and security companies, but only for specific lawful purposes
  • Toll collection agencies and parking enforcement
  • Tow truck operators and vehicle repossession companies

Even when a request falls into one of these categories, the organization must certify that they have a legitimate reason and are not using the information for stalking, harassment, or other harmful purposes. The DMV is supposed to verify this before releasing anything.

How to control who sees your information

You have the right to opt out of certain disclosures under the DPPA. When you renew your license or get a new one, your state's DMV should offer you the chance to restrict the release of your personal information. This is usually a checkbox on the process or renewal form.

If you opt out, the DMV will not release your information to private parties — though law enforcement and courts can still get it. The catch is that opting out may affect some services: insurance companies might not be able to contact you, and some employers might not be able to run background checks. You have to decide whether the privacy benefit is worth that trade-off.

Some states go further and let you restrict information even from some government agencies. Check your state's DMV website to see what options are available where you live. The process and form vary by state.

What happens if someone gets your information illegally

If someone obtains your personal information from your driver's license record without a permissible purpose, you have the right to sue them under the DPPA. You can recover actual damages (money you lost because of the breach) or statutory damages of at least $2,500 per violation, whichever is greater. You can also recover attorney's fees and court costs.

This means that if a private investigator, data broker, or anyone else illegally buys or obtains your information from the DMV, you have a legal claim against them. You do not have to prove that you were harmed — the law assumes harm from the unauthorized disclosure itself.

Many states also have their own privacy laws that add extra penalties. Some allow you to recover additional damages under state law, and some give the state attorney general the power to prosecute violations as a crime. If you believe your information has been obtained illegally, contact your state's DMV or attorney general's office to report it.

State-level privacy rules that go beyond the federal law

While the DPPA sets the floor, states often build higher walls around driver's license information. Some states restrict access more tightly than federal law requires, limit the purposes for which information can be used, or require additional safeguards.

For example, some states do not allow private investigators to access license information at all, while others require a court order. Some states have stricter rules about how long information can be kept or how it can be stored. A few states require the DMV to notify you if someone requests your information, though this is not required by federal law.

Because these rules vary, the level of protection you have depends on where your license was issued. If you want to know the specific rules in your state, contact your state's DMV or look up your state's driver's privacy law online.

How data breaches and security failures are handled

Even with privacy laws in place, DMV databases are sometimes breached or compromised. When this happens, states are required to notify you if your personal information was exposed. The notification must happen without unreasonable delay, and in most states within 30 to 60 days of discovery.

The notification should tell you what information was compromised, what the state is doing to fix the problem, and what steps you can take to protect yourself — such as placing a fraud alert or credit freeze. Some states also offer free credit monitoring for a period of time after a breach.

If a breach happens because the DMV failed to follow security standards, you may have a claim against the state. However, many states have sovereign immunity laws that limit how much you can recover. Check your state's laws or contact the state attorney general's office if you are affected by a breach.

Frequently Asked Questions

Can insurance companies see my driver's license information without asking me?

Yes, insurance companies can request your information from the DMV for underwriting and claims purposes without your permission. However, if you opt out of information sharing when you renew your license, they will not be able to access it. Keep in mind that opting out may make it harder for insurers to contact you or verify your driving record.

What should I do if I think someone got my information illegally?

Contact your state's DMV and ask them to investigate. You can also file a report with your state's attorney general's office. If you have evidence that a specific person or company obtained your information without permission, you can consult with an attorney about filing a civil lawsuit under the DPPA.

Does the DPPA protect my information if I move to a different state?

The DPPA applies in all states, but your old state's DMV still controls your old license record. If you get a new license in your new state, that state's privacy laws explore to your new record. Your old state must still follow the DPPA, but your new state may have stricter rules.

Can I see who has requested my driver's license information?

Most states do not automatically tell you who has requested your information. However, some states allow you to request an audit log of who accessed your record. Contact your state's DMV to ask whether this service is available and how to request it.

What is the difference between opting out and a name change or address restriction?

Opting out stops the DMV from releasing your information to private parties. A name change or address restriction changes what information is shown on your physical license or public records. These are different tools for different purposes — opting out protects your DMV file, while restrictions affect what appears on your card or in public databases.