License plate OSINT
A photo of your plate at the gym, the precinct, the driveway. Looked up through one of several paths — legal, regulated, illegal — and converted to a name and home address.
Plate-to-address lookups run through a regulatory minefield. Federal law — the [Driver's Privacy Protection Act](/laws/dppa) — limits what state DMVs can hand out. In practice, it leaks anyway through paid services, parking-app data leaks, and toll camera databases.
What an adversary sees
A clean photo of a plate is the start of a chain that often ends at your driveway. The paths an adversary uses:
- Paid people-search lookups that resell DMV data through a permitted-use loophole or just buy bulk leaked data and call it "public records"
- Partial-plate enumeration — three characters and a state are enough when combined with vehicle make/model to narrow to a single record
- Parking-app data breaches — ParkMobile, SpotHero, and others have leaked plate-to-account data tying plate to email, phone, and home address
- Toll camera databases — E-ZPass, SunPass, FasTrak records have surfaced in subpoenas and breaches
- Vehicle make/model OSINT — once they have the year and trim, they narrow neighborhoods by registration density

Plate becomes name. Name plus city becomes address. Address plus the precinct schedule becomes a pattern of life.
How to do this on yourself
Run your own plate the way an adversary would.
- Pull a report through Faxvin or VinCheckup with your plate and state. Note what comes back — owner history, accident reports, registration city.
- Search your plate as a string against Google, Reddit, and image search. Old Craigslist car-sale ads, parking dispute posts, dashcam YouTube clips.
- Check HaveIBeenPwned for any parking-app or toll-account email you've used. If the breach included plates, yours is out.
- Look up your state DMV's confidentiality flag — every state has one for sworn personnel under the federal law, but each requires you to actively elect it.
Do the same for every plate you've held in the last ten years. Old plates still index against you.
What to do about what you find
File the state DMV-confidentiality election. The mechanism is statutory and varies:
- California — Vehicle Code §1808.4 lets peace officers, judges, and certain others suppress home address from DMV records. File the request directly with DMV.
- New Jersey — §39:2-3.4 plus Daniel's Law (a state statute that lets covered officers force brokers and DMV-record handlers to remove their home address) gives sworn personnel statutory redaction.
- Texas — Transportation Code §730.013 carves out a confidentiality flag for officers and family.
- Florida, New York, and most states — similar mechanisms. Check your state HR or union for the exact form.
Operational rules that matter more than paperwork:
- Do not park the personal vehicle at the precinct unless required. Park off-site and walk.
- No vanity plates that announce occupation. No "BLUE" or "K9" plates.
- Toll-pass plate covers if your state law permits — check first, some states ban any cover.
What we handle automatically
We handle the downstream broker side — the people-search sites that take a plate-to-name conversion (however they got it) and tie it to a current home address. Removing those breaks the last link in the chain.
The DMV confidentiality flag is on you. We can't file CA §1808.4 paperwork on your behalf. The plate-lookup services themselves operate in a gray zone we don't have removal channels into — but the address they return comes from the same broker network we clean.
See license plate lookups for the breakdown of which lookup services pull from which broker sources, and run a free scan to see which brokers tie your name to a current address today.
Most OSINT chains end at a broker page that ties your name to a home address. Run a free scan to see what's currently exposed.