DPPA Permissible Uses for Auto Data Buyers

What DPPA Actually Covers

Read the definitions first. 18 U.S.C. 2725 defines a motor vehicle record as a record that pertains to a motor vehicle operator's permit, title, registration, or identification card issued by a DMV. Personal information is information that identifies an individual, including photograph, Social Security number, driver identification number, name, address (but not the 5-digit ZIP code), telephone number, and medical or disability information. The same definition states that it does not include information on vehicular accidents, driving violations, and driver's status. Highly restricted personal information is photograph or image, Social Security number, and medical or disability information. Express consent means consent in writing, including electronic consent that bears an electronic signature.

Those definitions are why a make/model/year field and a registered-owner name are not the same diligence problem. Vehicle attributes can travel with a record that also carries owner identity from a motor vehicle record. Buyers evaluating auto and motorcycle data should ask which fields in the dictionary were obtained from a state motor vehicle record, which were decoded from a VIN without owner identity, and which came from warranty or other commercial sources. The statute is about personal information from those records, not about the existence of cars.

18 U.S.C. 2721(a) is the prohibition: a state DMV, and its officers, employees, or contractors, shall not knowingly disclose personal information from a motor vehicle record except as provided in subsection (b). Highly restricted personal information has a tighter rule: disclosure without express consent of the person is limited to the uses listed in subsections (b)(1), (b)(4), (b)(6), and (b)(9). If a vendor's file includes photo, SSN, or medical or disability information sourced from a DMV, treat that as a separate legal review. Do not bury it inside a generic auto SKU.

Permitted Uses Commercial Buyers Actually Hit

Subsection (b) lists specific permitted uses. It is not a general commercial-license clause. Open the statute and walk the numbered paragraphs with counsel. For marketing buyers, the paragraphs that most often matter are the ones that mention surveys, marketing, or solicitations, and the ones that require consent. 18 U.S.C. 2721(b)(12) permits bulk distribution for surveys, marketing, or solicitations if the State has obtained the express consent of the person to whom the personal information pertains. 2721(b)(11) covers other use in response to requests for individual motor vehicle records if the State has obtained that express consent. 2721(b)(13) covers use by a requester who demonstrates written consent from the individual.

That is the checkable test for a marketing or audience use of DPPA personal information: whose consent, obtained by whom, in what form, and for which fields. A vendor statement that the file is "commercially available" does not answer it. Neither does a statement that the file is useful for audience targeting. If the personal information came from a motor vehicle record, the statute's consent paragraphs are the reference, not the media plan. Pair this reading with the restricted-source RFP matrix, which places DPPA next to FCRA, GLBA, FERPA, and VPPA for procurement scoping.

Other paragraphs in subsection (b) cover government functions, motor vehicle safety and recall-related uses, limited business verification in (b)(3), litigation, research that does not contact individuals, specified insurer uses in (b)(6), towing notice, licensed private investigators for a purpose already permitted, specified employer uses related to commercial driver's licenses in (b)(9), toll facilities, and uses authorized under the law of the State that holds the record when related to motor vehicle operation or public safety. Quote the paragraph you rely on. Do not treat a neighboring paragraph as a substitute. Insurer uses and employer uses in particular are not marketing uses. Do not assume a targeting license covers them. FTC privacy and security business guidance is a separate overlay for unfair or deceptive collection and use. It does not rewrite 2721.

Vehicle Attributes Versus Owner Identity

A VIN decode that yields make, model, year, body style, and fuel type, without owner identity, is a different artifact from a registration record that names the owner and attaches a residential address. Buyers should keep those in separate columns of the dictionary. If the vendor then joins owner demographics, household income estimates, or Core Email File contact fields onto a registration-sourced owner key, the join does not erase the DPPA question on the original personal information. It adds a second permitted-use question on the append.

ZIP-only geography is called out in 2725(3): the 5-digit ZIP code is excluded from the address example in the personal-information definition. That is not a license to treat a full street address from a motor vehicle record as public. It is a reminder to read the definition instead of guessing. If your use only needs vehicle mix in a ZIP, say so in the RFP and require the vendor to withhold owner-identifying fields. If your use needs owner identity, say that too, and require a 2721(b) mapping. Ambiguous SKUs that mix both are how marketing teams inherit a record they cannot use.

GSDSI's published auto-product description states that the file is compiled from state motor vehicle registration records, warranty registration databases, and commercial data partnerships, and that records can include owner demographic profile fields. That mix is exactly why a field-level source map is the diligence artifact, not a company-wide claim. Ask which fields in the specific extract you would receive are registration-sourced personal information, which are warranty-sourced, and which are appended from other licensed files. Then take that map to counsel with the statute. Do not skip the map because the product page lists multiple source classes.

Source Attestation to Demand Before a Sample Ships

Do not request a sample of owner-identifying auto data until legal has a source map and a claimed 2721(b) paragraph for the intended use. A sample that you cannot lawfully use is still a disclosure. The data licensing red-flag guide covers permitted-use clauses and audit rights. Put the DPPA map in that exhibit. The privacy compliance hub is the on-site starting point for adjacent governance questions. Do not treat a privacy policy as a substitute for the statute.

1. Require a field-level dictionary with a source class on every owner-identifying field.
2. Require a written statement of which 2721(b) paragraph the vendor claims for your named use, or a statement that the field is not DPPA personal information and why.
3. If the claim is (b)(11), (b)(12), or (b)(13), require a description of whose consent, in what form, and how suppression of non-consenting persons is enforced.
4. If highly restricted fields are present, require them to be absent from marketing extracts unless counsel approves a 2721(a)(2) path.
5. Require redisclosure and resale language that tracks 2721(c), including the vendor's recordkeeping of downstream recipients and purposes.
6. Refuse SKU names such as public-records auto that skip the source class.

Property files are a common confusion. Assessor and recorder data is not a motor vehicle record under 2725(1). That does not make property data unrestricted. It means you should not use a DPPA memo as a stand-in for real estate data diligence. Keep the statutes on their own rows in the restricted-source matrix. The same discipline applies when auto records are joined to identity or email for activation: the join is a new use, and audience targeting copy on a product page is not a permitted-use opinion.

Redisclosure, Resale, and Recordkeeping

18 U.S.C. 2721(c) governs resale and redisclosure. An authorized recipient of personal information, with stated exceptions for recipients under (b)(11) or (b)(12), may resell or redisclose only for a use permitted under subsection (b), and not for uses under (b)(11) or (b)(12). Recipients under (b)(11) and (b)(12) have their own redisclosure rules in that subsection. Authorized recipients that resell or redisclose, with a stated exception for (b)(11) recipients, must keep records identifying each person or entity that receives the information and the permitted purpose, and must make those records available to the motor vehicle department on request. The statute states a five-year retention period for those records.

That recordkeeping rule is operational, not theoretical. If you receive DPPA personal information and send it to an agency, a clean room, a DSP, or a downstream processor, you are in the redisclosure chain. Your contract should name those recipients and purposes, and should require the vendor to support an accounting if a state DMV asks. If the vendor cannot say who else has the same extract, you cannot complete that accounting. Ask before the sample, not after onboarding.

Nothing on this page is a representation that a particular GSDSI extract, including auto and motorcycle data, is lawful for your use. GSDSI licenses data under written contract. Counsel should read 2721 and 2725, the field map, and your intended workflow together. For the broader restricted-source set, use the RFP matrix. For contract levers, use the licensing red-flag guide. Questions on a scoped review: contact.