DPPA (Driver's Privacy Protection Act)

What DPPA does

The Driver's Privacy Protection Act (18 USC §§2721-2725) is the federal law that controls what a state DMV can do with the personal information in your driver's license and vehicle registration records. In plain terms: the DMV, and anyone who gets DMV data from it, cannot hand out your name, home address, or the rest of your record except for a short list of approved reasons.

Congress passed it in 1994 as part of the Violent Crime Control and Law Enforcement Act. It grew out of the 1989 murder of actress Rebecca Schaeffer. A man obsessed with her hired a private investigator, who pulled her home address from California DMV records. He used it to find her and kill her at her apartment.

A decade later, a stalker bought Amy Boyer's workplace address from the online broker Docusearch and murdered her there. That case produced Remsburg v. Docusearch (New Hampshire, 2003), a state supreme court ruling that a broker owes a duty of care to the people whose data it sells.

The default rule is straightforward. A state DMV cannot disclose your personal information without one of the law's permitted purposes. Anyone downstream who obtained DMV-derived data is bound by the same limit. A violation carries liability.

What is covered

The law splits DMV data into two tiers. Standard "personal information" includes your name, home address, phone number, Social Security number, driver ID number, photo, and physical details like height, weight, and age. "Highly restricted personal information" is a narrower set: Social Security number, photograph, and medical or disability information. Highly restricted data needs your express written consent for almost any use.

What the law does not cover: traffic violations, accident reports, and license status. Those run through state public-records law, not DPPA. If your home address sits in a publicly filed accident report, DPPA does not reach it. A state vehicle-records statute might.

The 14 permitted purposes

DPPA at 18 USC §2721(b) lists 14 purposes that make disclosure legal. What each one looks like in practice:

1. Government agency function. Your own agency pulling records for legitimate work. The most common path.
2. Verifying vehicle or driver records, fraud prevention. A bank confirming your driver ID number on a loan application.
3. Normal course of business by a legitimate business. Confirming personal information you provided is accurate.
4. Civil, criminal, administrative, or arbitral proceedings. Process service, court orders, expert witnesses.
5. Research activities. Studies that do not publish individual records.
6. Insurance underwriting and claims investigation. An insurer running your driving history.
7. Notifying owners of towed or impounded vehicles. Reaching the registered owner.
8. Licensed private investigators. Only when the PI is acting for one of the other permitted purposes.
9. Employer verification of commercial driver's license information. Trucking and bus companies checking their drivers.
10. Toll transportation operations. EZ-Pass and equivalents.
11. Express consent of the individual. You give explicit permission for the specific use.
12. Bulk distribution for surveys and marketing. Only with express opt-in consent.
13. Use by private investigators for permitted purposes. A restatement of purpose 8.
14. Other use specifically authorized by state law. State-by-state carve-outs.

Brokers and aggregators have leaned on purposes 5, 8, and 13 to justify building commercial people-search databases. Courts have generally rejected the idea that the research purpose covers compiling a commercial database of individual records.

Reno v. Condon and the constitutional challenge

When DPPA passed, South Carolina sued the federal government, arguing the law violated the Tenth Amendment by commandeering state DMV operations. The Supreme Court rejected the challenge unanimously in Reno v. Condon, 528 U.S. 141 (2000). Chief Justice Rehnquist wrote that DPPA regulates the states as owners of databases, not as sovereigns, and that Congress can regulate the interstate commerce of motor vehicle records.

Constitutional challenges since have generally run into that ruling. The statute is settled. The live disputes now are about who counts as a permitted user and what counts as a permitted purpose.

The ALPR litigation wave

The active front in 2025 and 2026 is automated license plate readers (ALPRs), cameras that photograph plates and log them. Most of the lawsuits target commercial ALPR users, such as parking operators, hotels, and homeowners' associations, that match a scanned plate to DMV records to get the owner's name and home address. Venable's February 2026 analysis describes the pattern: a plate gets matched to DMV-derived name and address, then that data moves to a use the law does not permit. Plaintiffs' lawyers are pressing the DPPA's liquidated-damages provision against those downstream uses.

Officers face the mirror image of this risk from inside their own agencies. In the 2026 Joplin case, a Missouri officer ran a single license plate about 395 times through a department plate-tracking system and was no longer employed afterward. The same data flows that help officers work can expose anyone when the access is personal rather than official.

How to spot a DPPA-violating disclosure

Most officers will not see a DPPA violation directly. The pattern usually looks like this: you get mail or a call that references your registered vehicle's make and plate at your home address, and the sender has no plausible permitted purpose. Or your name and address show up on a broker site with the source labeled "DMV records," "vehicle registration," or "VIN-linked."

Signals to look for:

• Source labeling. Some broker sites label DMV-derived data when they disclose their source feeds. That is a strong signal.
• VIN, make, model, and year tied to your home address. Court records and accident reports rarely include all four. DMV records do.
• A plate traced to your identity. If a stalker references your plate, they got it from somewhere upstream of the DMV.

If you have one of these, document it. Save the listing, the URL, and any contact that referenced the data. That is the evidence an attorney needs to file.

Penalties and damages

The penalties are real. A state DMV with a policy or practice of substantial noncompliance faces a federal civil penalty of up to $5,000 for each day it continues, under 18 USC §2723. A person who knowingly violates the law can be criminally fined under Title 18. The private right of action under 18 USC §2724 lets you sue for your actual damages, with a floor of $2,500, plus attorney's fees, and punitive damages if the violation was willful.

The numbers add up. A broker that pulled your DMV record and shared it with five downstream affiliates is looking at six violations at $2,500 each, and more if any affiliate re-shared. Because the floor is $2,500 per violation, class actions can carry large aggregate exposure.

One question is still open. Courts have split on whether each impermissible access of a record is a separate violation, which lets damages stack, or whether a whole course of conduct counts as one violation. The difference is large. A private investigator who pulled 50 records on the same target over a year could face $125,000 under the per-access reading, or $2,500 under the per-course reading. If you are filing, ask counsel how your circuit reads it.

State-level overlays

DPPA is a federal floor. Several states layer stronger DMV confidentiality on top:

• California: Vehicle Code §1808.4 lets active and retired peace officers, judges, prosecutors, and their families mark their DMV records confidential. See /states/california.
• New Jersey: §39:2-3.4 marks the DMV records of judges, prosecutors, and law enforcement officers confidential. See /states/new-jersey.
• Texas: Gov. Code §552.1175 lets peace officers and certain other officials keep their home address and other personal identifying information confidential in public records, and the DPS Alternate Address Program lets them list a work address on their license instead of their home. Transportation Code Chapter 730 is Texas's own DPPA-mirror statute; it restricts DMV disclosure generally rather than through an officer filing. See /states/texas.
• Most other states: DMV confidentiality is available to officers in some form. Check your state page from /states.

If you are an active or retired officer in one of these states, file the state confidentiality designation too. It is separate from broker removal, and the two work together.

What it doesn't reach

DPPA binds the DMV's disclosure pipeline. It does not reach:

1. Brokers that obtained DMV-equivalent data through other channels. Vehicle registration data sometimes shows up in commercial broker files sourced from leaks, breaches, or third-party aggregators that were never bound to a permitted-purpose certification.
2. Voter rolls, property records, court filings, and other public records that overlap with DMV data. State public-records law governs those, not DPPA.
3. Brokers operating outside the US. DPPA enforcement runs through federal court. Offshore operators are practically out of reach.
4. Information you put into circulation yourself. If you posted your address publicly, DPPA cannot claw it back.

Common questions

Can my own agency be sued under DPPA? Yes. Agencies can be liable when an officer pulls a record for a personal, non-permitted use. A department policy that allows broad personal lookups is a DPPA exposure for the department.

Can I sue if a private investigator pulled my record? Yes, if the PI had no permitted purpose. The PI carve-out in §2721(b)(8) only covers a PI acting for a permitted user. It does not authorize lookups for personal reasons.

What about an insurance company running my motor vehicle record? Permitted under §2721(b)(6). Underwriting and claims investigation are explicit carve-outs.

Does DPPA apply to license plate readers? It depends on the data flow. If the ALPR system enriches a plate with DMV-derived name and address, that is DMV-derived data and DPPA reaches the downstream sharing. If the system only stores a plate and timestamp, it falls outside DPPA, though other state and federal privacy laws may apply.

What we do

We cannot sue a broker for a DPPA violation on your behalf. That is a separate legal action for an attorney. What we do is clear the broker-side exposure the law was meant to prevent. We file standard opt-outs across the data broker and people-search sites we cover, we keep checking, and we re-file when a record comes back. When a listing looks DMV-sourced, we flag it so you can hand the package to an attorney if you decide to pursue the federal claim. Officers who want to close the DMV-fed broker exposure can start recurring opt-outs instead of filing with each broker themselves.

If you have evidence that a specific broker pulled your DMV record without a permitted purpose, that is a case for an attorney to file in federal court.