A parking operator photographs a license plate, runs a routine owner lookup through a data vendor, and mails a payment notice. An insurer’s online quote tool pre-fills a driver’s license number to speed up the customer experience. A state agency’s website runs a standard advertising pixel. None of these practices appear significant at first glance, yet each became the basis for a plaintiff to assert claims on behalf of a putative class under the 1994 Driver’s Privacy Protection Act (“DPPA”).

More than 30 years after its enactment, the DPPA remains a privacy statute of continued focus by the plaintiffs’ bar, including particularly Florida, Georgia, New York, and California, among other states. Because the statute provides liquidated damages of $2,500 per violation without requiring proof of actual harm, a single data flow repeated across thousands of drivers can quickly translate into eight- or nine-figure exposure. And the DPPA reaches far beyond state motor vehicle departments: it applies to any person or business that knowingly obtains, uses, discloses, or rediscloses personal information derived from motor vehicle records for a purpose the statute does not permit.

For in-house counsel, the challenge is that DMV-sourced data often enters a company indirectly, through data brokers, vendors, analytics tools, or business partners, and its origin may not be obvious to the business teams using it. This article outlines the DPPA’s core framework, including its permissible uses and redisclosure recordkeeping obligations; traces how DPPA litigation has evolved from its roots in marketing and solicitation into data breach, website tracking, and automated license plate reader (“ALPR”) cases; and offers practical steps legal and compliance teams can take now to identify and reduce DPPA exposure.

I. DPPA Background

The Driver’s Privacy Protection Act of 1994, 18 U.S.C. §§ 2721–2725, is a federal statute that limits how state departments of motor vehicles (“DMVs”) disclose personal information from driver and vehicle records. It also limits how anyone else may obtain, use, disclose, or redisclose that information.

Section 2721(a) bars a state DMV, and its officers, employees, and contractors, from knowingly disclosing personal information obtained in connection with a motor vehicle record except as provided in subsection (b). Section 2722(a) separately makes it unlawful for any person to knowingly obtain or disclose personal information from a motor vehicle record for any use not permitted under § 2721(b).

Section 2724(a), in turn, creates a private right of action against any person who “knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter.”

Section 2721(b) enumerates 14 permissible uses, including use for motor vehicle or driver safety; use by a licensed private investigative agency or licensed security service for a purpose otherwise permitted under subsection (b); and certain uses for which the State has obtained the express consent of the person to whom the information pertains.

Redisclosure is governed separately. Section 2721(c) permits an authorized recipient of personal information (other than a recipient under subsection (b)(11) or (12)) to resell or redisclose the information only for a use permitted under subsection (b), excluding uses under subsection (b)(11) or (12). Any authorized recipient that resells or rediscloses personal information (other than a recipient under subsection (b)(11)) must keep, for five years, records identifying each person or entity that receives the information and the permitted purpose for which it will be used, and must make those records available to the DMV upon request.

The DPPA defines “personal information” as information that identifies an individual, including an individual’s photograph, Social Security number, driver identification number, name, address (but not the five-digit ZIP code), telephone number, and medical or disability information. Although the statute does not expressly list email addresses, the Eleventh Circuit has held that email addresses are personal information because they identify an individual.

II. DPPA Litigation: Then and Now

Congress enacted the DPPA in response to growing concerns about the misuse of personal information held by state DMVs. Two concerns predominated. The first was the threat posed by stalkers using DMV data. The incident most often credited with spurring the legislation was the 1989 murder of actress Rebecca Schaeffer, whose stalker obtained her home address from California DMV records through a private investigator. See 145 Cong. Rec. S14533–02.

The second concern was the states’ common practice of selling personal information to businesses engaged in direct marketing and solicitation, which remains one of the most developed areas of DPPA litigation.

In a 2013 decision, the U.S. Supreme Court addressed a case in which attorneys obtained motor vehicle records containing vehicle purchasers’ personal information and used it to send letters inviting the recipients to join lawsuits against automobile dealerships. The attorneys argued that their conduct fell within the litigation exception in § 2721(b)(4), which permits use in connection with any civil, criminal, administrative, or arbitral proceeding, including investigation in anticipation of litigation. The Supreme Court disagreed. It held that the DPPA’s exceptions are to be read narrowly and that, although obtaining and using the information may serve multiple purposes, solicitation of clients is not a permissible use under (b)(4) where, as there, solicitation was the “predominant purpose” of obtaining and using the information.

While marketing and solicitation cases remain prevalent, plaintiffs’ firms are increasingly testing the 1994 statute against modern data practices. In the data breach context, plaintiffs have repeatedly added DPPA claims to negligence suits against companies whose systems were hacked. Results have been mixed and turn largely on whether the company itself knowingly “disclosed” the information. In 2024, the Eastern District of Pennsylvania dismissed a DPPA claim in a consolidated data breach litigation because the complaint alleged only that inadequate server security allowed hackers to steal data, not a knowing disclosure by the company.

By contrast, the Eastern District of New York allowed a DPPA claim to proceed in a data breach litigation against an auto insurer where plaintiffs alleged that the companies affirmatively auto-populated or transmitted driver’s license numbers through online quote forms or portals without adequate safeguards, conduct closer to a knowing disclosure than a passive server vulnerability. The line between affirmative and passive disclosure has become a central battleground in these cases.

A second, more recent wave of cases targets tracking technology on state DMV websites. Plaintiffs allege that social media and professional networking platforms violate the DPPA by obtaining tracking identifiers when users visit DMV websites and then using that data for advertising.

Courts have been skeptical. In 2023, the District of South Carolina held that a user’s platform ID generated by a tracking cookie did not come “from” a motor vehicle record, as the DPPA requires, because the ID resulted from the user’s independent decision to use the platform rather than from information the DMV provided. Similarly, the Northern District of California dismissed a DPPA claim because the plaintiff failed to explain how URLs and user-entered information collected by tracking technology qualified as a “motor vehicle record.” These decisions limit the DPPA’s reach in the digital-tracking context, although the statute’s damages provision gives plaintiffs continued incentive to test the theory.

The newest DPPA cases target commercial use of ALPRs. Since 2024, plaintiffs have filed numerous suits against parking companies that obtain DMV data to issue parking notices. A typical complaint alleges that cameras capture license plates, the company runs a “DMV lookup” through data brokers, and the company then uses the resulting owner information to mail payment demands. Federal courts in Florida, including in the Southern and Northern Districts of Florida, have allowed these claims to survive motions to dismiss in decisions issued in 2025 and 2026.

III. Key Risks in DPPA Litigation & Takeaways for Businesses

These litigation trends carry practical consequences. The DPPA’s damages structure makes it particularly attractive for class actions or mass arbitrations: the statute provides a private right of action with liquidated damages of $2,500 per violation, making it a powerful supplement to common-law claims that otherwise require proof of actual harm. And the statute reaches any person who knowingly obtains, uses, or discloses DMV-sourced information for an impermissible purpose, not just DMVs themselves. As class counsel continue to test new theories, businesses should take care.

Companies that collect, license, buy, sell, or use driver or vehicle data should determine whether any of it originated in motor vehicle records. Private entities, including data brokers, insurers, law firms, employers, and private investigators, that obtain or use DMV-sourced information should confirm that each use is a permissible one under § 2721(b). Those that resell or redisclose the information must also confirm that each downstream recipient has a permissible use and must keep records of those redisclosures for five years (unless they received the information under subsection (b)(11)). The DPPA’s limits on marketing and solicitation absent express consent also significantly restrict the ability of direct marketers and attorneys to use DMV data for outreach. Finally, companies should be familiar with any state-law analogues to the DPPA.

Squire Patton Boggs’ Data Disputes team has significant experience defending DPPA claims and helping businesses navigate overlapping federal and state requirements. Stay tuned to Privacy World for further developments.