Driver's Privacy Protection Act of 1994
DPPA
Other · Government records
The DPPA limits disclosure of personal information in state driver and vehicle records to listed permissible uses, such as law enforcement, insurance, and certain business verification, and requires express consent for uses like marketing. It binds private recipients and resellers, not just state agencies.
- Where
- Federal
- Citation
- 18 U.S.C. 2721-2725
- Status
- In force
- In force since
- 1997-09-13
- Last amended
- 2000-10-23
- Enforced by
- U.S. Department of Justice (criminal fines; civil penalties against states); private civil actions
- People can sue
- Yes
- Penalties
- Private action for actual damages but not less than $2,500 liquidated damages, punitive damages for willful or reckless violations, and fees; criminal fines; civil penalties up to $5,000 per day against noncompliant state DMVs.
- Applies to
- State motor vehicle departments and their officers, employees, and contractors
- Any person who obtains, discloses, or uses personal information from motor vehicle records (resellers, data brokers, businesses)
Practices it requires
- Obtain, disclose, or use personal information from motor vehicle records only for a permissible use listed in the Act.18 U.S.C. 2721(b), 2722(a)
- Highly restricted personal information (as defined in 18 U.S.C. 2725(4), e.g., photographs, Social Security numbers, medical or disability information) requires express consent except for limited uses.18 U.S.C. 2721(a)(2)
- Use for bulk marketing or surveys requires the individual's express consent.18 U.S.C. 2721(b)(12)
Other duties
- Authorized recipients who resell or redisclose must keep records of each recipient and permitted purpose for 5 years.18 U.S.C. 2721(c)
- Individuals may sue persons who knowingly obtain, disclose, or use their information for an impermissible purpose.18 U.S.C. 2724
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: State DMV civil penalty ($5,000/day, 18 U.S.C. 2723(b)) was not fetched | 2721(b)(12) consent wording was read only in part
Research reference, not legal advice.