Reno v. Condon

What the DPPA does in one sentence

The federal Driver's Privacy Protection Act (DPPA) bars state DMVs, and anyone downstream of them, from selling or disclosing driver record information without consent, except for specific permitted uses. Congress passed it in 1994 after the murder of Rebecca Schaeffer, whose killer hired a private investigator who pulled her home address from California DMV records.

See the full law page for what the DPPA covers and how to invoke it.

What this case is

In the late 1990s, South Carolina sold driver records to commercial bulk-data buyers. The DPPA told the state to stop. South Carolina sued, arguing the federal government had no constitutional authority to tell a state DMV what to do with its own records. The state lost at the district court, won at the Fourth Circuit, and the federal government took the case to the Supreme Court.

The Court heard argument on November 10, 1999, and decided the case on January 12, 2000. It unanimously reversed the Fourth Circuit and upheld the DPPA. Chief Justice Rehnquist wrote the opinion. The vote was 9 to 0.

What the court held

South Carolina's argument was structural. The state said the DPPA "commandeers" state officials to run a federal regulatory program, which the Tenth Amendment forbids under New York v. United States and Printz v. United States.

The Court rejected that framing. The DPPA does not order state legislators to legislate or order state police to enforce federal law. It regulates state DMVs as sellers in the commercial market for personal information. A driver record is "an article of commerce," the Court held, because it is sold and resold across state lines for profit, which places it inside Congress's authority under the Commerce Clause.

The Court also treated the DPPA as a law of general applicability, because it regulates both the state DMVs that supply the records and the private resellers and redisclosers downstream of them. For that reason it did not need to decide whether the statute would be valid if it reached private parties alone.

Why this matters to first responders

Many officers and firefighters do not realize their home address reached a broker site in part because a state DMV sold the underlying record to a commercial data aggregator at some point. The chain runs: DMV record → bulk reseller → people-search site → public listing.

The DPPA can break that chain. It is enforceable against the broker, and not just the state, because this case settled that Congress had authority to write the statute at all. Modern DPPA suits against brokers, including Atlas-style enforcement, depend on Reno v. Condon being settled law.

If South Carolina had won, the federal floor disappears. State-by-state DMV rules would be all you had, and most states offer little beyond that floor.

What it changed

After 2000, the DPPA stood as enforceable against state DMVs that kept selling records, and against the commercial buyers and resellers downstream. The statute's text also reaches those private resellers directly, so a broker holding DMV-sourced data is covered even though the state made the first sale.

The DPPA gives covered drivers a private right of action. A person whose record is obtained, disclosed, or used for an impermissible purpose can recover actual damages, or liquidated damages of no less than $2,500 per violation, plus attorney's fees. That right of action is what officers and firefighters rely on when a broker's listing is sourced from DMV records and their state has no Daniel's Law analog. The remedy is narrower than Daniel's Law, but the federal floor reaches every state.

Where it doesn't reach

The DPPA covers DMV records. It does not cover:

• Public records from other sources, such as voter rolls, court records, or property assessor data
• Information you posted yourself on social media
• Records collected before the DPPA took effect in 1994

If your address showed up on a broker site because it scraped a county property record or an old LinkedIn page, the DPPA is not the right tool. See Daniel's Law for state-level coverage, and the federal Lieu Act for federal judges.

Downstream impact

Reno v. Condon is cited in data-broker cases that turn on whether Congress or a state legislature can regulate commercial traffic in personal information without violating federalism. Its framing of personal information as an article of commerce gave later privacy statutes, including Daniel's Law and the Lieu Act, a settled constitutional footing to build on.

Where the case is thin

The opinion is short. The Court declined to reach the harder questions about private parties acting alone, content-based speech challenges, and as-applied carve-outs. Those came in later cases. What Reno v. Condon settled was the threshold question: whether the federal government and the states can regulate this market at all.

What this means for your exposure

If a broker lists your home address and the trail leads back to a DMV record, the DPPA is the federal tool that applies in any state, with a private right of action and liquidated damages of no less than $2,500 per violation plus attorney's fees. Frontline Privacy files removal requests with brokers, keeps checking for your information to come back, and can point to the DPPA when a DMV-sourced listing is the problem.