The Hidden Market in DMV Records

DMV Data in the Identity Supply Chain

Data brokers acquire the vast majority of their records from public filings and commercial sources. Think property deeds, court cases, utility sign-ups, and online purchases. But DMV records remain a critical link in the chain:

• They anchor names to verified physical addresses.
• They provide date of birth and driver’s license numbers, key identifiers across industries.
• They connect vehicles, households, and locations, often used to triangulate a person’s movements or worth.

Combined with voter rolls and property records, DMV files give brokers one of the strongest “identity backbones” available.

Federal Requirements for DMV Databases

Under the REAL ID Act, every state DMV must maintain a motor vehicle database that centralizes sensitive personal information. Federal regulations require these databases to include:

• All data fields printed on state-issued driver’s licenses and IDs, plus each card’s serial number and Social Security number.
• Full legal names (including recorded name history), without truncation.
• Machine-readable zone (MRZ) data not shown on the card itself.
• Complete driver histories, covering violations, suspensions, and license points.

In addition, states are required to secure this personally identifiable information (PII) in accordance with federal standards (6 CFR § 37.33).

This mandate means that every state DMV is not just issuing licenses, but also managing a high-value database containing names, SSNs, driver histories, and other identifiers—making it a prime target for both data brokers and threat actors.

Risk Implications

By requiring states to centralize and retain this breadth of personal data, the federal mandate creates a uniform layer of exposure across the country. Every DMV database contains:

• SSNs — among the most sensitive identifiers, heavily traded by fraud actors.
• Driver histories — data points that can be linked with insurance, employment, and background checks.
• Untruncated legal names — useful for identity correlation and cross-database matching.
• Hidden machine-readable fields — often overlooked but highly valuable to data brokers.

Because these elements are mandated for every state, attackers know exactly what they’ll find if they gain access. And while the regulation requires security controls, history shows DMV databases have been breached or accessed through weak points in connected systems.

For data brokers, these DMV records are gold: they provide verified identity anchors that can be combined with voter files, property records, and online exhaust to create more invasive profiles. For adversaries, the same datasets enable stalking, financial fraud, and credential theft.

Why It Matters

For consumers, this means two things:

• Exposure: DMV records can validate your address, age, and vehicle ownership. Making scams that cite those details much more believable.
• Persistence: Once DMV data leaves state control, it flows downstream into thousands of databases. Even if you wipe yourself from one broker, another may have the same record sourced from a different path.

What Needs to Change

• Transparency: Every state should publish who buys DMV data, how much revenue is earned, and for what stated purpose.
• Narrower carve-outs: The DPPA’s permitted uses are too broad, effectively opening the door to resale markets.
• Opt-out rights: Drivers should be able to restrict the sale of their personal records beyond essential government and safety uses.

Takeaway

The license plate on your car is more than a government identifier. It’s a key to an information market most people never see. States profit, brokers expand, and scammers gain credibility along the way.

Until the laws close these loopholes, assume your DMV record is already circulating in the data economy. And protect the rest of your footprint accordingly.