Why businesses scan your driver's license and what they do with the data

When a business scans your driver's license, they are reading the barcode or magnetic stripe on the back of the card, which contains your name, address, date of birth, license number, and sometimes a photograph. Retailers, bars, rental car companies, and financial institutions use these scans for different reasons: age verification, identity confirmation, fraud prevention, or record-keeping for transactions.

The data they capture depends on what their scanner reads. A basic age-verification scan at a liquor store might only pull your birth date and name. A rental car company or bank might capture your full address, license number, and photograph. The business decides what information their system extracts and stores.

Once scanned, that data enters the business's own system. Some businesses keep it for a few days or weeks; others store it for years. The length of storage, who can access it, and whether it gets sold or shared depends entirely on that business's privacy policy and the state laws that govern their industry.

Key Takeaways

  • A driver's license scan reads the barcode or magnetic stripe on your card and pulls your name, address, date of birth, license number, and sometimes your photo into the business's system.
  • Different businesses use scans for different reasons: bars and retailers scan for age verification, rental companies and lenders scan for identity confirmation, and some scan to prevent fraud or create transaction records.
  • The business decides what data their scanner captures, how long they keep it, and whether they share it with third parties, subject to state privacy laws and their own stated policies.
  • You have the right to refuse a scan in most states, though the business can refuse service if they require it for their transaction.
  • State laws vary widely on how long businesses can store scanned license data and whether they must delete it after a certain period.

What data is actually stored when your license is scanned

The information captured during a scan includes everything encoded on your license's barcode or magnetic stripe. This typically includes your full name, date of birth, address, license number, license class, and expiration date. If your state's license includes a photograph on the barcode, that image may also be captured and stored.

Some scanning systems are configured to pull only specific fields — for example, a grocery store's age-verification scanner might extract only your birth date and name, ignoring your address and license number. Other systems capture everything the barcode contains, whether the business needs it or not. The business's software settings determine what gets stored.

Once stored, this data sits in the business's database, often linked to the transaction you made that day. If you bought alcohol, made a rental reservation, or opened a financial account, your scanned license information is now associated with that record. The business can use it to verify your identity on future visits, flag fraud, or comply with regulatory requirements.

How long businesses keep scanned driver's license data

There is no single federal rule for how long a business must or can keep your scanned license information. Instead, state laws and industry-specific regulations set different timelines. Some states require deletion within 30 days; others allow indefinite storage. Some industries, like banking and lending, have federal rules that override state law.

Bars and liquor retailers in some states must delete age-verification scans within a few days or weeks. Rental car companies often keep scans for years to track repeat customers and prevent fraud. Banks and credit unions may keep scans as long as the account is open, plus additional years for regulatory compliance. Retailers with no specific legal requirement may keep scans indefinitely unless their privacy policy says otherwise.

Your state's laws matter most. California, for example, requires businesses to delete scanned license data within a specific timeframe unless they have a legal reason to keep it. Other states have no deletion requirement at all. If you want to know your state's rule, contact your state's attorney general's office or check your state's consumer protection statutes.

Your right to refuse a driver's license scan

In most states, you have the legal right to refuse to let a business scan your driver's license. However, the business also has the right to refuse the transaction if the scan is part of their standard process. If you decline to be scanned at a liquor store, the store can refuse to sell you alcohol. If you refuse a scan at a car rental counter, the rental company can refuse to rent to you.

Some states have specific protections. California law, for example, limits when and how retailers can scan licenses for age verification and requires them to delete the data quickly. New York restricts the use of license scans in certain contexts. Check your state's laws to understand what protections exist where you live.

If a business scans your license without your knowledge or consent, or uses the scanned data in a way that violates your state's privacy law, you may have grounds to file a complaint with your state's attorney general or pursue legal action. Document what happened, including the business name, date, and what you were told about the scan.

Differences between age verification and identity verification scans

Age-verification scans are the most common type. A liquor store, tobacco shop, or bar scans your license to confirm you are old enough to make the purchase. The business needs only your birth date to complete this check. Many age-verification systems are designed to extract only that field, discarding the rest of your information when ready.

Identity-verification scans serve a different purpose. A rental car company, bank, or payday lender scans your license to confirm you are who you say you are and to create a record of the transaction. These scans typically capture your full name, address, license number, and photograph. The business keeps this data to prevent fraud, comply with Know Your Customer rules, or track repeat customers.

The difference matters for privacy. An age-verification scan should not require your address or license number. An identity-verification scan does. If a business is scanning for age but capturing your full address, ask why they need it. If they cannot explain a legitimate business reason, you can decline and ask if they have an alternative verification method.

What to do if you're concerned about a scanned license

If you believe a business scanned your license improperly, stored it longer than required, or shared it without your consent, start by reviewing their privacy policy. Most businesses post this online or can provide it on request. The policy should explain what data they collect, how long they keep it, and whether they share it with third parties.

If the policy does not address your concern or if you believe the business violated their own policy or your state's law, contact your state's attorney general's office. Many states have consumer protection divisions that investigate complaints about data handling. You can also file a complaint with the Federal Trade Commission, which oversees unfair or deceptive business practices related to privacy.

If the scan resulted in identity theft or fraud, report it to the Federal Trade Commission at IdentityTheft.gov and to your state's attorney general. Keep records of all communications with the business and any evidence of misuse. Some states allow private lawsuits against businesses that violate privacy laws, so consulting an attorney may be worthwhile if the harm is significant.

How scanned license data can be misused

Scanned license data is valuable to criminals and data brokers. If a business's database is breached, your full name, address, date of birth, and license number can be used for identity theft, account fraud, or sold to third parties. Hackers target retail and hospitality businesses specifically because they often store scanned licenses with minimal security.

Some businesses sell or share scanned license data with third parties without clear consent. Data brokers purchase this information and resell it to marketers, debt collectors, or other businesses. Your address and birth date, combined with your name and license number, create a detailed profile that can be used to target you for scams or sold to competitors.

Scanned license data can also be used for location tracking. If a business scans your license every time you visit, they build a record of your movements and shopping habits. This information can be sold to advertisers or used to profile you for targeted marketing. Some states are beginning to restrict this practice, but protections vary widely.

Frequently Asked Questions

Can a business scan my driver's license without asking permission?

No. A business should inform you that they are scanning your license and get your consent before doing so. If they scan without telling you, that may violate your state's privacy law. However, if scanning is part of their standard process and you proceed with the transaction, courts often interpret that as implied consent. Ask before the scan happens if you want to refuse.

What should I do if a business refuses to serve me because I won't let them scan my license?

The business has the right to refuse service if the scan is part of their transaction process. However, if they are scanning for age verification only, ask if they have an alternative method, such as manual ID check or a different verification tool. Some states require businesses to offer alternatives to scanning. If you believe the refusal violates your state's law, contact your state's attorney general.

How do I know if my state has laws about license scanning?

Contact your state's attorney general's office or visit your state legislature's website and search for "driver's license" and "privacy" or "data retention." Some states have specific statutes governing how long businesses can keep scanned license data; others have no rules at all. Your state's consumer protection agency can also tell you what protections exist in your state.

Can I request that a business delete my scanned license data?

You can ask, and some businesses will comply. However, if your state has no law requiring deletion and the business's privacy policy does not promise it, they are not legally required to delete the data. If your state does have a deletion requirement, you can request compliance and file a complaint with your state's attorney general if the business refuses.

Is it safer to refuse a license scan or to allow it?

Refusing a scan eliminates the risk that the business will store or misuse your data. However, you may lose the transaction or face inconvenience. Allowing a scan creates a record, but reputable businesses with strong security practices pose minimal risk. The safest approach is to scan only when necessary, ask what data they are capturing, and choose businesses with clear privacy policies.