Vehicle Code section 1808.3
(a)
The department may participate in the State-to-State Verification Service, or any successor system, operated by the American Association of Motor Vehicle Administrators (AAMVA), for the sole purpose of verifying and exchanging driver’s license, identification card, and driver history records with participating jurisdictions.(b)
(1)Information shared shall be limited to the minimum necessary for the purpose described in subdivision (a) and shall only include the following:(A)
True full name.(B)
Date of birth.(C)
(i)Social security account number.(ii)
For purposes of this subparagraph, the minimum pointer information provided to the State-to-State Verification Service shall be the last five digits of the social security account number.(D)
State of record.(E)
Driver’s license or identification card number.(F)
Credential type.(G)
REAL ID indicator.(H)
Commercial Driver’s License Information System indicator.(I)
Information necessary to verify and exchange driver history records, including, records of accidents, conviction, and withdrawals, information on driver’s license or permit class, endorsements, restrictions, and card issuance information.(2)
Unless otherwise required by federal law, the department shall not disclose any of the following information through the State-to-State Verification Service:(A)
Address.(B)
Photograph.(C)
Gender marker.(D)
Biometric data, including, but not limited to, fingerprints.(E)
Whether the individual holds a driver’s license or identification card issued pursuant to Section 12801.9.(3)
The department shall make publicly available on its internet website a list of the information shared with participating jurisdictions using the State-to-State Verification Service, including notice that the department will share an applicant’s prior true full names contained in its records.(c)
(1)The department shall prepare an annual report on its participation in the State-to-State Verification Service, or any successor system, annually provide the report to the budget and relevant policy committees of the Legislature, and publish the report on the department’s internet website.(2)
The report shall include all of the following:(A)
Each participating jurisdiction’s number of requests made directly to the state, and, to the extent available, disaggregated by the reason for requests made.(B)
Information on any unusual requests or patterns in the data that indicates a participating jurisdiction is utilizing the State-to-State Verification Service for unauthorized purposes.(C)
Information regarding any known and confirmed breach of contract by other participating jurisdictions, privacy or security breaches, material changes to the AAMVA policies for the State-to-State Verification Service that occur, or any known and confirmed suspension or termination of any state’s State-to-State Verification Service Agreement.(3)
The report shall be provided on or before February 1, 2028, and each February 1 thereafter. The report shall be provided without unreasonable delay, with consideration for operational, technical, or investigative needs, or other sensitive information.(d)
(1)The department shall adopt and maintain a State-to-State Verification Service Monitoring Plan to detect, prevent, and respond to requests for, or uses of, information through the State-to-State Verification Service by a participating jurisdiction for a purpose other than the purpose described in subdivision (a). The plan shall contain information on how the department will perform the following:(A)
Maintain and analyze audit logs of requests sent through or received from the State-to-State Verification Service.(B)
Review and investigate anomalous or irregular requests.(C)
Review of requests from participating jurisdictions based on risk factors or other information that reasonably indicates a potential use of the State-to-State Verification Service for a purpose other than the purpose described in subdivision (a).(D)
Limit, delay, or decline disclosure of information to a participating jurisdiction for anomalous or irregular requests.(E)
Limit, delay, or decline batch, bulk, list-based, pattern-based, automated, or exploratory requests from participating jurisdictions.(F)
Meet reporting requirements as described in subdivision (c).(2)
The department shall consult stakeholders to advise the department on the State-to-State Monitoring Plan. The advisory group shall meet on or before November 1, 2026, and twice annually thereafter, until July 1, 2030. The advisory group shall consist of the following appointees:(A)
A representative of the Department of Justice with knowledge of federal compliance.(B)
Three members appointed by the Senate Committee on Rules, who shall serve at the pleasure of the Senate Committee on Rules. These three members shall include an immigration rights advocate, a LGBTQ+ rights advocate, and a cybersecurity expert.(C)
Three members appointed by the Speaker of the Assembly, who shall serve at the pleasure of the Speaker. These three members shall include a privacy rights advocate, a reproductive rights advocate, and a civil rights expert.(3)
The advisory group shall serve until July 1, 2030, and as of that date shall be disbanded.(4)
The department shall provide the budget and relevant policy committees with a draft version of the plan by February 1, 2027, and a final plan by July 1, 2027.(e)
(1)If the department reasonably determines that a participating jurisdiction has requested or used information for a purpose other than the purpose described in subdivision (a), the department shall refer the matter to the Department of Justice.(2)
(A)If the department determines that a participating jurisdiction has requested or used information maintained in the department’s records and obtained through the State-to-State Verification Service for a purpose other than the purpose described in subdivision (a), the department shall notify the AAMVA, the Department of Justice, and each person whose record was the subject of the request or use without unreasonable delay, with consideration for operational, technical, or investigative needs, or other sensitive information, using the notice requirements pursuant to Section 1798.29 of the Civil Code.(B)
The notification shall include, but is not limited to, a description of the information that was disclosed, the time and date of the requests, and, if known, the department’s determination of the reason that a participating jurisdiction requested or used this information.(f)
The Attorney General may commence an action against the AAMVA, a participating jurisdiction, another individual or entity, or on behalf of a California resident whose information was the subject of a request unrelated to the sole purposes of the State-to-State Verification Service, to enforce the provisions of this section, including, but not limited to, an application or motion for an order enjoining ongoing or subsequent violations of this section. The Attorney General shall not commence an action pursuant to this subdivision unless the Attorney General has reason to believe the AAMVA or a participating jurisdiction intends to obtain or use information for any purpose other than verifying and exchanging driver’s license, identification card, and driver history records, as necessary, to comply with the REAL ID Act of 2005 (Public Law 109-13).(g)
(1)The department shall not participate in the State-to-State Verification Service unless the agreement with the AAMVA is consistent with this section. The department shall not agree to any amendment to the agreement with the AAMVA that reduces, conflicts with, delays, or waives, the privacy protections of California residents or the department’s ability to detect, prevent, and respond to requests for information by participating jurisdictions for a purpose other than the purpose described in subdivision (a). The department may only sign an agreement with the AAMVA, if the agreement contains all of the following terms:(A)
Requires the AAMVA to promptly provide notice to the department, if legally permitted, and work in good faith with the department in formulating a response to any requests, in the form of a subpoena or otherwise, from an entity that is not a participating jurisdiction to release, disclose, discuss, or obtain access to State-to-State Verification Service information or records.(B)
Requires participating jurisdictions to retain only the minimum necessary information that is needed for their governmental business purposes, and agree to securely destroy the remaining information that participating jurisdiction receives.(C)
Requires the AAMVA and participating jurisdictions to not share, sell, or otherwise make available information disclosed pursuant to this agreement, unless otherwise required by federal law.(D)
(i)The AAMVA shall immediately temporarily suspend a participating jurisdiction’s agreement if it determines that the participating jurisdiction has done either of the following:(I)
Incurred an unauthorized use of the State-to-State Verification Service.(II)
Violated or failed to comply with the terms of its agreement with the AAMVA.(ii)
The AAMVA shall also immediately temporarily suspend a participating jurisdiction’s agreement if the suspension is required to protect the integrity of the State-to-State Verification Service.(E)
Participating jurisdictions agree to restrict access to the State-to-State Verification Service to only their authorized state employees, agents, representatives, or contractors who need it to perform their official duties in connection with the intended use of the State-to-State Verification Service and to audit user access to the State-to-State Verification Service.(F)
Participating jurisdictions agree to retain the information for the minimum amount of time necessary, or 14 days, whichever is shorter, and retain only the minimum information that is needed for the sole purposes of this section.(2)
The department shall make publicly available on its internet website all contractual agreements with the AAMVA and other documents as necessary with consideration for privacy and security related to the State-to-State Verification Service.(3)
Any material new or modified contract or agreement governing the use, retention, or collection of data, including, but not limited to, the data elements shared with the AAMVA, shall be consistent with the authority provided in this section and any other applicable provision of state law. Prior to execution, the department shall provide at least 30 days advance written notice of any material new or modified contract or agreement subject to this subdivision to the appropriate policy and fiscal committees of the Legislature and the Joint Legislative Budget Committee.(h)
By no later than January 1, 2030, the California State Auditor shall conduct an audit of the department’s compliance with this section. In determining the timing of the audit before that date, the California State Auditor shall allow a reasonable period after the program becomes operational to support the initial program implementation and the accumulation of sufficient information for review. This section does not prohibit the auditor from initiating an audit requested by the Legislature through the Joint Legislative Audit Committee.
Source:
Section 1808.3, https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=VEH§ionNum=1808.3. (updated Jul. 13, 2026; accessed Jul. 20, 2026).
