ID Scanning Laws by State: What You Can Record, and How Long You Can Keep It

There is no single American rule for scanning IDs at a door. There are fifty-odd of them, they were written at different times for different reasons, and a few of them contradict the assumption most venue software is built on.

This is the post that would be most useful as a definitive table of all fifty states. It is not going to be that, and it is worth saying why up front: state provisions in this area are amended frequently, several states are actively legislating on consumer data right now, and a table that was accurate when written becomes quietly wrong without any visible sign that it has. A venue operator who acts on a stale row is worse off than one who made a phone call.

So this is the structure instead — the three postures states take, the statutes worth looking up, and a method for getting an authoritative answer for your own state in about half an hour.

Not legal advice. Verify anything below against current statute and your own counsel before you rely on it.

If you want the underlying framework — CCPA, BIPA, what is actually in the barcode you just captured — that is covered in the privacy guide. This post is about the state-level variation on top of it.

The three questions every state answers separately

Almost all the confusion in this area comes from collapsing three distinct questions into one. Pull them apart and the landscape gets much simpler.

1. May you scan? Essentially always yes. Every state permits a business to electronically verify a government-issued ID for age restriction and fraud detection. This is the question people worry about, and it is the one that is settled.

2. May you retain, and what? This is where states diverge sharply, and it is the real question. Some restrict retention to narrow purposes. Some limit which fields may be kept. Some cap how long. Some are silent, which is not the same as permissive — general consumer-protection and data-breach law still applies.

3. May you use it for anything else? Uniformly no, without separate explicit consent. Selling scan data, sharing it with brokers, or building a marketing list from it is prohibited essentially everywhere and is the fastest route to a state attorney-general’s attention.

Question one is settled. Question three is settled. All of your compliance work lives in question two, which is why “is scanning legal?” is the wrong thing to be asking your lawyer.

The three postures states take on retention

Posture one: purpose-limited by statute

Some states have specific legislation governing what a business may do with data read from a driver’s licence — separate from, and often older than, their general consumer privacy law. These statutes typically enumerate the permitted purposes (age verification, fraud prevention, completing a transaction, complying with a legal requirement), and forbid retaining anything beyond what those purposes need.

Two worth knowing about:

• California — Civil Code § 1798.90.1. Governs businesses that swipe or scan a driver’s licence, limits the permitted purposes, and restricts what may be retained. It sits alongside CCPA/CPRA rather than being replaced by it, so a California venue has two frameworks to satisfy.
• Texas — Business & Commerce Code § 501.101. Addresses a business’s access to and retention of information from a driver’s licence obtained electronically.

Look these up directly rather than trusting a summary, this one included. The details that matter — which purposes qualify, what counts as retention, what the penalty structure is — are exactly what a paragraph flattens.

Posture two: liquor code says scan, privacy code says do not keep

This is the combination that produces the most confused operators, and it is extremely common.

Your alcohol control statute encourages or rewards electronic verification, often by making a scan record part of an affirmative defence — covered here. Your state privacy provision simultaneously restricts holding on to what the scan produced.

These are not actually in conflict, though they read as though they are. The resolution is that they are talking about different things:

• The liquor code wants evidence that a check occurred — a timestamp, a result, a device, a member of staff.
• The privacy code objects to holding the patron’s identity — the name, the address, the licence number.

You can satisfy both completely, and the way to do it is to keep the event and discard the person. A log saying “23:41, document verified, passed, device 2, staff member K.L.” is strong evidence and weak personal data. A log containing the full parsed record of everyone who came in is marginally better evidence and a serious liability.

Most venues that get this wrong get it wrong in the same direction: they keep everything, believing more record is more protection. Past your board’s evidentiary window it is not protection, it is exposure.

Posture three: silent

Plenty of states have no specific statute on scanning at a venue door. Silence is not permission to do as you like — general consumer protection, data breach notification, and any applicable comprehensive privacy law still apply, and the number of states with comprehensive privacy laws has grown substantially and continues to.

In a silent state, the sensible default is to behave as though you were in a restrictive one. It costs you nothing operationally, and it means a change in the law does not require a change in your process.

The biometric line, in every state

One distinction cuts across all of the above and is worth checking before anything else: is your system reading a barcode, or is it analysing a face?

Barcode parsing extracts text and is not biometric. Facial analysis — matching a live face against the card photo, or against a stored set of banned faces — collects biometric identifiers, and in Illinois in particular that triggers a statute with a private right of action and per-violation statutory damages. Several other states have followed with their own biometric provisions.

The practical requirement where it applies is written notice, a published retention and destruction schedule, and a signed release obtained before the first scan. Signage is not sufficient. If you run face matching without those, the exposure is per patron, over the entire period you ran it, and that arithmetic is what has produced the very large settlements in this area.

Face matching is a genuinely useful feature — it is the only thing that catches a borrowed genuine ID. Deploy it deliberately, with consent in place, not because it was on by default.

How long should you actually keep scan logs?

Setting aside what any specific statute mandates, the operating principle that survives in every jurisdiction:

Keep the fact of the check for as long as your licensing authority might ask about it. Keep the person’s details for no longer than the moment you needed them.

Concretely, that is three tiers:

What	Why you have it	How long
Full parsed record — name, address, licence number	You needed one field from it	Discard at parse time, if your software allows
Check event — timestamp, result, device, staff member	Your affirmative defence	Your board’s evidentiary window; set it in software
Ban list entries and incident records	A documented safety reason	Until the ban lapses, reviewed periodically

The third tier is deliberate, individual, and small — a manager adding a specific person after a specific incident. It should never be the default state of everyone who walked through the door, and it should be stored separately from routine entry logs so that purging one does not touch the other.

Whatever window you land on, enforce it in software. A retention policy that relies on someone remembering to clear records is a policy that will be found not to have run on the one occasion it mattered.

Getting a definitive answer for your state in 30 minutes

Worth more than any table, including the ones in this post:

1. Call your state’s alcohol control board. Ask two questions: what records do you expect to see at a hearing, and are there restrictions on what we may retain from a scan? Free, fast, and authoritative in a way no vendor is.
2. Look up your state’s driver’s licence data statute, if it has one, and your comprehensive privacy law if it has one of those. Read the actual text.
3. Ask your insurer. They have a view on what practice they expect, and it occasionally differs from the legal minimum in ways that affect your cover.
4. Put the answers in your written door policy, dated, and re-check annually. This area is moving.
5. Configure your software to match — retention window, which fields are kept, whether face matching is on.

Half an hour, done once a year, and you are ahead of most operators in your city.

Where we stand

We are building for the restrictive case by default, because it is the only approach that works everywhere without configuration: parse on the device, derive the answer, do not transmit the personal fields, keep the check event rather than the person, and ship without face matching in the first release so the biometric question does not arise for venues using it.

If your state has a requirement that does not fit that model, the early access list below is where to tell us — that is exactly the kind of detail that should shape the product while it can still be shaped.