This notice explains how the Driver’s Privacy Protection Act (DPPA), 18 U.S.C. §§ 2721–2725, applies to IDLeakCheck records sourced from motor-vehicle and driver records. It supplements, and is incorporated into, our Terms of Service.
Records covered
The DPPA restricts disclosure of "personal information" obtained by State Departments of Motor Vehicles in connection with motor-vehicle records. Where IDLeakCheck ingests, displays, or makes available data that originates from such records — including driver-license numbers, vehicle registration information, and certain related identifiers — that data is subject to this notice in addition to our general Terms.
Permitted uses (the fourteen § 2721(b) categories)
The DPPA permits use of covered information only for one of the fourteen purposes enumerated in 18 U.S.C. § 2721(b):
- (b)(1) — Use by a government agency, including a court or law-enforcement agency, in carrying out its functions, or by any private person or entity acting on behalf of a government agency in carrying out its functions.
- (b)(2) — Use in connection with motor-vehicle or driver safety and theft; motor-vehicle emissions; motor-vehicle product alterations, recalls, or advisories; performance monitoring of motor vehicles, motor-vehicle parts, and dealers; motor-vehicle market research activities, including survey research; and removal of non-owner records from the original owner records of motor-vehicle manufacturers.
- (b)(3) — Use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only to verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors; and, if such information is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud, by pursuing legal remedies against, or recovering on a debt or security interest against, the individual.
- (b)(4) — Use in connection with any civil, criminal, administrative, or arbitral proceeding in any federal, state, or local court or agency or before any self-regulatory body, including service of process, investigation in anticipation of litigation, and execution or enforcement of judgments and orders, or pursuant to an order of a federal, state, or local court.
- (b)(5) — Use in research activities, and for use in producing statistical reports, so long as the personal information is not published, redisclosed, or used to contact individuals.
- (b)(6) — Use by any insurer or insurance support organization, or by a self-insured entity, or its agents, employees, or contractors, in connection with claims investigation activities, anti-fraud activities, rating, or underwriting.
- (b)(7) — Use in providing notice to the owners of towed or impounded vehicles.
- (b)(8) — Use by any licensed private investigative agency or licensed security service for any purpose permitted under this subsection.
- (b)(9) — Use by an employer or its agent or insurer to obtain or verify information relating to a holder of a commercial driver’s license that is required under chapter 313 of title 49.
- (b)(10) — Use in connection with the operation of private toll transportation facilities.
- (b)(11) — For any other use in response to requests for individual motor-vehicle records if the State has obtained the express consent of the person to whom such personal information pertains.
- (b)(12) — For bulk distribution for surveys, marketing, or solicitations if the State has obtained the express consent of the person to whom such personal information pertains.
- (b)(13) — Use by any requester, if the requester demonstrates it has obtained the written consent of the individual to whom the information pertains.
- (b)(14) — For any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety.
Your attestation
When DPPA-covered data is made available to you — typically by enabling driver-license visibility on an enterprise workspace, or by accessing API endpoints that include driver-license fields — you must select and attest to a specific § 2721(b) permitted use. Your selection is recorded with your workspace, applies to all DPPA-covered records you access through it, and may not be changed without re-attestation.
Prohibited uses
You may not access, use, redisclose, or retain DPPA-covered information for any purpose other than the permitted use you attested to. Even if a use would otherwise be permitted under one of the fourteen categories, you may not use IDLeakCheck information for that use unless you have selected the corresponding category through our attestation flow.
Use of DPPA-covered data for any non-permitted purpose, including FCRA-regulated decisions (see our FCRA Notice), advertising, bulk-marketing without express consent under § 2721(b)(12), or general curiosity, is prohibited.
Resale and redisclosure
Under 18 U.S.C. § 2721(c), you may not resell or redisclose DPPA-covered information for any use not permitted under § 2721(b). If you redisclose covered information to a third party, you must (a) maintain records identifying each person or entity that receives such information and the permitted purpose for which it was obtained, for a period of five years, and (b) make those records available to the relevant State DMV upon request.
Enforcement
The DPPA carries criminal penalties under 18 U.S.C. § 2723(a) and provides a private civil cause of action under § 2724, including liquidated damages of $2,500 per violation, punitive damages for willful or reckless disregard, attorneys’ fees, and equitable relief. We may suspend or terminate any account that misuses DPPA-covered information and cooperate with civil and criminal investigations.
Reporting suspected misuse
If you believe DPPA-covered information about you has been accessed or used in violation of this notice or of the DPPA, please contact us through our Data Removal & Requests form. We will investigate and, where appropriate, refer the matter to enforcement authorities.
Changes to this notice
We may update this notice from time to time. Material changes will be announced at least 30 days in advance via email to account holders and via an in-product banner.
Contact
- Privacy and compliance: privacy@idleakcheck.com
- DPPA permitted-use questions: legal@idleakcheck.com