18 U.S.C. §§ 2721–2725 · checked 2026-10-30
Plate Lookup Law: What the DPPA Allows You to Do
The Driver’s Privacy Protection Act separates two questions that look like one: may you learn about the vehicle, and may you learn about the person. The first is generally open. The second is a short list.
What the statute actually restricts
The DPPA governs motor vehicle records held by a state DMV — permits, titles, registrations and identification cards — and the personal information in them. It does not restrict the vehicle’s own facts.
| Term | Definition in the statute | Section |
|---|---|---|
| Motor vehicle record | A record that pertains to an operator’s permit, a title, a registration or an identification card issued by a DMV | § 2725(1) |
| Personal information | Information that identifies an individual: photograph, Social Security number, driver identification number, name, address (but not the 5-digit ZIP code), telephone number, and medical or disability information | § 2725(3) |
| What is excluded | Vehicular accidents, driving violations and driver’s status are expressly outside the definition | § 2725(3) |
| Highly restricted personal information | Photograph or image, Social Security number, medical or disability information — released only with express consent or under (b)(1), (b)(4), (b)(6) or (b)(9) | § 2725(4); § 2721(a)(2) |
That exclusion in § 2725(3) is why the market you see exists. A vehicle history report built on title brands, odometer readings and accident records is outside the definition of personal information. The moment a record ties the car to a named person, it is the definition.
The fourteen permitted uses
Section 2721(b) lists the uses for which a DMV may release personal information. It is a closed list, with one state-law escape hatch at the end.
| Cite | Permitted use | What it looks like in practice |
|---|---|---|
| (b)(1) | Any government agency, court or law enforcement agency carrying out its functions | Police and code enforcement; also contractors acting for an agency |
| (b)(2) | Motor vehicle or driver safety and theft, emissions, product alterations, recalls, performance monitoring, market research | Recall campaigns, safety research, survey research |
| (b)(3) | A legitimate business verifying information the individual submitted, and correcting it, only to prevent fraud, pursue legal remedies against, or recover a debt or security interest from that individual | A lender or insurer confirming the details a customer supplied — not a general “identify this car” permission |
| (b)(4) | Civil, criminal, administrative or arbitral proceedings, including service of process and litigation preparation | A lawyer, a court order, a process server |
| (b)(5) | Research and statistical reports, provided the personal information is not published, redisclosed or used to contact anyone | Academic or policy research |
| (b)(6) | Insurers and insurance support organizations, for claims investigation, antifraud, rating or underwriting | Your own insurer handling a claim |
| (b)(7) | Notice to owners of towed or impounded vehicles | A towing company or a city telling the owner where the car is |
| (b)(8) | Licensed private investigative agencies and licensed security services, for a purpose permitted elsewhere in the list | A licensed investigator working a permitted case |
| (b)(9) | Employers verifying a commercial driver’s license holder | Trucking and bus companies |
| (b)(10) | Operation of private toll transportation facilities | Toll authorities |
| (b)(11) | Any other use where the state has obtained the person’s express consent | The individual has opted in |
| (b)(12) | Bulk distribution for surveys, marketing or solicitations, where the state has the person’s express consent | Marketing lists, with consent |
| (b)(13) | Any requester who demonstrates written consent from the individual | You authorize someone to get your record |
| (b)(14) | Any other use specifically authorized by the state’s law, if it relates to the operation of a motor vehicle or public safety | State-specific procedures, which must cite the statute |
Uses that carry risk
| What you want to do | Covered? | Why |
|---|---|---|
| Identify the owner of a car you saw | No | None of the fourteen uses covers curiosity about a vehicle. (b)(3) requires that the person gave you the information you are verifying. |
| Find the driver who hit you and drove off | No — not this way | The routes are (b)(1) through the police report and (b)(4) through a legal proceeding. |
| Check someone you are dating, or a neighbor | No | No provision covers personal or social screening, and harassment is not a motor vehicle or public safety purpose. |
| Verify a customer’s address from a plate | Only within (b)(3) | The customer must have submitted the information, and the purpose must be fraud prevention, a legal remedy, or recovery of a debt or security interest. |
| Resell or share plate data you obtained | Restricted | (c) limits resale and redisclosure to permitted uses and requires a five-year record of every recipient and purpose. |
| Publish “research” that names people | No | (b)(5) permits research only if the personal information is not published, redisclosed or used to contact anyone. |
What a violation costs. A knowing violation is punishable by a criminal fine (§ 2723(a)). A state DMV with a policy or practice of substantial noncompliance faces a civil penalty imposed by the Attorney General of up to $5,000 a day (§ 2723(b)). The individual whose record was obtained, disclosed or used for a purpose outside § 2721(b) may sue in federal district court for actual damages or liquidated damages of at least $2,500, punitive damages on proof of willful or reckless disregard, attorney’s fees and injunctive relief (§ 2724). Obtaining records by false representation is itself unlawful (§ 2722(b)).
What the person behind the plate can and cannot learn
Cannot: see, as a federal right, who requested their record or when. The statute contains no general notice requirement, so there is no federal lookup that answers “who ran my plate?”
Can, where the state uses the waiver procedure: § 2721(d) lets a state mail the record subject a copy of a request that does not fall within a permitted use, with a statement that the record will not be released unless the subject waives the privacy right. It is a state option, not a federal duty.
Can, in California: the DMV’s record-request instructions state that the department is required by Vehicle Code § 1810(b) to provide the record subject with a copy of the request. California also makes residence addresses confidential under Vehicle Code § 1808.21, released only to the subject or when a state or federal statute requires release.
Can, after the fact: the reseller’s five-year log of recipients and purposes (§ 2721(c)) is the record a § 2724 case would use to establish who obtained the data and why. That is the practical answer to “can I find out who looked me up” — through the recordkeeper and, if it comes to it, through litigation.
Retention: what the law sets, and what it does not
| Record | Who holds it | How long | Source |
|---|---|---|---|
| The reseller’s log of who received your record and why | The reseller or rediscloser | 5 years, and it must be produced to the state DMV on request | § 2721(c) |
| The DMV’s own copy of your record | The state | Not set by the DPPA — state records law decides | Statute silent |
| Your record in NMVTIS and in provider reports | The provider | Provider-specific; ask before you buy | Not in the statute |
| Plates and VINs you enter on this site | This site | Plates are not sent or stored; VIN results are cached by VIN; usage events are deleted after 120 days | Privacy policy |
Note what the table does not contain: the DPPA sets no retention period for the DMV’s own copy of your record. That is state records law, and it varies.
How a lawful lookup runs, end to end
- The requester names a permitted use. California’s form INF 70 has a section headed “Purpose of request — permissible use” that lists the federal categories and requires a code citation for the state-law category.
- The agency verifies identity. The same form requires a signature and a driver’s license or ID number from the requester.
- Confidential fields stay back. California withholds residence addresses unless a statute requires release (CVC § 1808.21).
- Resale is limited. A recipient may resell or redisclose only for a permitted use, and must log each recipient and purpose for five years (§ 2721(c)).
- The record subject may get a copy, depending on the state’s procedure.
What a lookup may return without any of this, and what needs a paid report: the field comparison. A plate that resolves to nothing at all: the troubleshooting checklist.
For the requester, the state’s own form is the operative document: it carries that state’s permitted-use list, fee and signature requirement. For the record subject, the state agency holds your record and its notification procedure. What the law allows when you want the owner →
Sources
- 18 U.S.C. §§ 2721–2725, Driver’s Privacy Protection Act (U.S. Code, 2021 edition, GPO) — every section cited above; definitions in § 2725, permitted uses in § 2721(b), resale log in § 2721(c), waiver in § 2721(d), penalties in §§ 2722–2724 (checked 2026-10-30)
- California DMV form INF 70 — Request for Record Information (rev. 2/2023) — permissible-use section, signature and ID requirement, CVC § 1810(b) record-subject notice, CVC § 1808.21 confidential residence addresses, $5 automated record (checked 2026-10-30)
- NMVTIS: information for consumers (U.S. Department of Justice) — what a vehicle history report covers, which is the data outside the DPPA definition (checked 2026-10-30)
- NMVTIS: approved data providers — who may sell vehicle history reports, and to whom (checked 2026-10-30)
Questions people ask
Is it illegal to look up a license plate?
Looking up vehicle information is legal. What the DPPA restricts is personal information held in motor vehicle records — name, address, photograph, license number and similar identifiers — and it permits release only for the fourteen uses listed in 18 U.S.C. § 2721(b). Vehicle facts such as specs, recalls, title brands and odometer readings are not restricted personal information.
Can I get someone's name from a plate?
Not through a consumer product. Owner names and addresses are personal information under § 2725(3), and a service that sold them to the public would be making a disclosure outside § 2721(b). Police, insurers, courts and licensed investigators can obtain them for listed purposes.
Can the person whose plate I look up find out?
Sometimes. The DPPA has no general notice requirement. It does let a state mail the record subject a copy of a request that falls outside the permitted uses and withhold the record until the subject waives (§ 2721(d)), and some states go further: California requires its DMV to give the record subject a copy of a record request (CVC § 1810(b), stated in the instructions to form INF 70).
What are the penalties for misusing a motor vehicle record?
Criminal fine for a knowing violation (§ 2723(a)); a civil penalty of up to $5,000 a day against a state DMV with a policy or practice of substantial noncompliance (§ 2723(b)); and a civil action by the individual, who can recover actual damages or liquidated damages of at least $2,500, punitive damages on proof of willful or reckless disregard, attorney’s fees and injunctive relief (§ 2724).