Summary of Q4 2023 legislation relating to ID scanning or identity verification

The 2024 legislative sessions have begun in all but a handful of states. However, there has been far less activity this month than there was in the fourth quarter of last year on the regulation of scanning technology at the point of sale for tobacco and alcohol products.  

Alcoholic Beverages 

A Pennsylvania bill to require amusement parks to utilize a transaction scan device to verify the age of an individual who purchases alcoholic beverages was approved by the Governor. The bill defines transaction scan devices and would allow the amusement parks to accept identification that cannot be scanned. The law will be effective March 14, 2024. 

Current law in Wisconsin prohibits municipalities from providing alcohol retail licenses with any device capable of scanning a driver’s license or identification card issued by the Department of Transportation. Bills introduced in the Assembly and Senate bills would repeal that prohibition. Additionally, a municipality that provided such a device would not be allowed to collect or retain data derived from the device. 

Other

A New York bill that would require second-hand dealers and pawnbrokers to scan a copy of identification prior allowing a person to purchase property was referred to the Consumer Protection Committee.

Colorado H 1130 – Relating to the privacy of biometric data

Introduced in House, 01/29/2024.

The bill amends the “Colorado Privacy Act” to add protections for an individual’s biometric data by requiring a person that, alone or jointly with others, determines the purposes for and means of processing biometric data (controller) to adopt a written policy that:

• Establishes a retention schedule for biometric identifiers
• Includes a protocol for responding to a breach of security of biometric data; and
• Includes guidelines that require the permanent destruction of a biometric identifier by the earliest of certain dates.

The bill also:

• Prohibits a controller from collecting a biometric identifier unless the controller first satisfies certain disclosure and consent requirements;
• Specifies certain prohibited acts and requirements for controllers that collect and use biometric data;
• Requires a controller to allow a consumer to access and update a biometric identifier;
• Restricts an employer’s permissible reasons for obtaining an employee’s consent for the collection of biometric identifiers; and
• Authorizes the attorney general to promulgate rules to implement the bill.

Hawaii Senate Bill 1085. Relating to Biometric Information Privacy

Carried over to 2024 Regular Session, 12/11/2023

Biometric data can be used to facilitate transactions and screenings where identity verification is important. However the legislature believes that it is in the interest of public safety to ensure that a person’s biometric identifiers are properly safeguarded. Each private entity in possession of a biometric identifier or biometric information shall store, transmit, and protect from disclosure all biometric identifiers and biometric information.

Indiana S 204. Allowing beer brewers to sell and ship to consumers

Referred to Senate Committee on Public Policy, 01/09/24

Would establish a direct beer seller’s permit that allows a brewer to sell and ship beer directly to a consumer.

A direct wine seller’s permit or direct beer seller’s permit entitles a seller to sell and ship wine product to a consumer by receiving and filling orders that the consumer transmits by electronic or other means if all of the following conditions are satisfied before the sale or by the times set forth as follows:

• Proof of age by a state government issued or federal government issued identification card showing the consumer to be at least twenty-one (21) years of age. The proof under this clause may be evidenced:
  • in person;
  • by a photocopy or facsimile copy that is mailed or electronically transmitted;
  • by a computer scanned, electronically transmitted copy; or
  • through an age verification service used by the direct wine seller

The direct wine seller meets the following requirements:
Maintains for two (2) years all records of wine product sales made under this chapter.

Kansas S 253. Relating to the delivery of alcoholic beverages.

Senate Committee on Federal and State Affairs hearing scheduled for 01/31/2024

Would authorize home delivery of alcoholic beverages by licensed retailers, licensed clubs and drinking establishments and restaurants and third-party delivery services. Individuals engaged in a delivery service shall use an identification scanning software technology or an alternative approved by the director, to verify the age of the consumer upon delivery.

Massachusetts S 227. An act establishing the Massachusetts Information Privacy and Security Act

Hearing scheduled for 02/02/2024

Would establish the Massachusetts Information Privacy and Security Act.

Mississippi House Bill 100. Prohibition of using embedded technology in self-checkout terminals to scan IDs

Referred to House Business and Commerce Committee, 01/17/2024

This bill would prohibit certain retailers and establishments from using embedded technology programs in self-checkout terminals or self-service checkouts to scan information on a consumer’s driver’s license in order to verify the age of the person trying to purchase certain items. It would require the age verification to be performed by an employee of the establishment in order to complete the purchase.

Nebraska Legislative Bill 954. Relating to the Biometric Autonomy Liberty Law

Rereferred to Banking, Commerce and Insurance Committee; Notice of hearing for 02/27/2024

Would adopt the Biometric Autonomy Liberty Law.

The public’s welfare, security, and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric, confidential, and sensitive data.

Confidential and sensitive data means personal data that can be used to uniquely identify an individual or an individual’s account or property, including any biometric data, genetic marker, genetic testing data, unique identifier number used to locate any account or property, account number, personal identification number, pass code, motor vehicle operator’s license number, state identification card number, or social security number;

New Jersey Senate Bill 402. Prohibiting retail establishments from requiring IDs for purchase returns

Introduced, 12/07/2023

Would prohibit mercantile establishments from requiring certain consumer identification for the return of merchandise. No retail mercantile establishment shall require a person to display any permit, license, or identification card issued by this State or any other state or the federal government in order to return merchandise unless the person fails to provide a proof of purchase for that merchandise.  No retail mercantile establishment shall scan, photocopy, or otherwise retain a copy of a permit, license, or identification card when requiring a person to submit a permit, license, or identification card in order to return merchandise without a proof of purchase.

A retail mercantile establishment violating any provision of this act shall be subject to a civil penalty of $250 for the first offense, $500 for the second offense, and not less than $1000 for the third and each subsequent offense, to be collected in a civil action by a summary proceeding under the “Penalty Enforcement Law of 1999,” P.L. 1999, c.274 (C.2A:58-10 et seq.).

New York Assembly Bill A 2026. Relating to the sale of video games with mature ratings to minors

Referred to Assembly Consumer Affairs and Protection, 01/23/2024

Would prohibit the sale to minors of any video game that has a mature or violent rating. Sale or rental of any video game that contains any contents listed 18 in subdivision one of this section, shall be made only to an individual who demonstrates, through (a) a valid driver’s license or non-driver’s identification and issued by the commissioner of motor vehicles, the federal government, and US territory, commonwealth or possession, the District of Columbia, a state government within the US or provincial government of the dominion of Canada; or (b) a valid passport issued by the US government or any other country; or (c) an identification card issued by the US, indicating that the individual is at leas 18 years of age. Such identification need not be required of any individual who reasonably appears to be at least 30 years of age, provided, however, that such appearance shall not constitute a defense in any proceeding involving sale or rental of any video game to an individual under 18 years of age.

In any proceeding pursuant to this section, it shall be an affirmative defense that a person purchasing or renting or attempting to purchase or rent any video game described in subdivision one of this section produced a driver’s license or non-driver identification card apparently issued by a government entity or other identification pursuant to subdivision three of this section, successfully completed the transaction, and that the video game sold or rented to such person was reasonable reliance upon such identification and transaction. In evaluating the applicability of such affirmative defense, consideration shall be given to any written policy adopted and implemented by the seller to effectuate the provisions of this section. Use of any method of an electronic transaction scan shall no excuse any person operating a place of business wherein video games are sold or rented, or the agent or employee of such person from the exercise of due diligence. Notwithstanding the provisions of this subdivision, any such affirmative defense shall not be applicable in any civil or criminal proceeding, or in any other forum.

New York Assembly Bill A02045. Regarding New York city identity cards to be accepted as valid written evidence of age or identification.

Referred to Assembly Cities Committee, 01/23/2024

This bill would require New York City identity cards to be accepted as valid written evidence of age or identification. Notwithstanding any provision of law to the contrary, a valid New York city identity card shall be accepted as valid written evidence of age or identification where an individual is required to furnish written evidence of age or identification.

New York Assembly Bill 3308. Regarding the Digital Fairness Act

Referred to  Assembly Consumer Affairs and Protection Committee, 01/03/2024

See Also: New York Assembly Bill S02277

This would enact the “Digital Fairness Act” and require any entity that conducts business in New York and maintains the personal information of five hundred or more individuals to provide meaningful notice about the use of personal information.

New York Assembly Bill 02621. Relating to the use of biometric identity verification devices to purchase alcohol or tobacco.

Referred to  Assembly Economic Development Committee,  01/03/2024

See also:  Assembly Bill 06656

Referred to Senate Investigations and Government Operations Committee, 01/03/2024

Relates to the use of biometric identity verification devices for the purchase of alcoholic beverages and tobacco products; authorizes a licensee, its agent or employee to determine a person’s age when purchasing alcoholic beverages or tobacco products by use of a biometric identity verification device; establishes where the use of the device indicates that the person is under the age of twenty-one, the attempted purchase of the alcoholic beverage shall be denied.

New York Assembly Bill 03404. Relating to ID scanning for tobacco sales

Referred to Assembly Health Committee, 01/03/2024

Sale of tobacco products, herbal cigarettes, liquid nicotine, shisha or electronic cigarettes in such places, including by a vending machine, shall be made only to an individual who demonstrates, through (a) a valid driver’s license or non-driver’s identification card issued by the commissioner of motor vehicles, the federal government, any United States territory, commonwealth or possession, the District of Columbia, a state government within the United States or a provincial government of the dominion of Canada, or (b) a valid passport issued by the United States government or any other country, or (c) an identification card issued by the armed forces of the United States, indicating that the individual is at least twenty-one years of age. Such identification need not be required of any individual who reasonably appears to be at least twenty-five years of age, provided, however, that such appearance shall not constitute a defense in any proceeding alleging the sale of a tobacco product, herbal cigarettes, liquid nicotine, shisha or electronic cigarettes to an individual under twenty-one years 21 of age.

Any person operating a place of business wherein tobacco products, herbal cigarettes, liquid nicotine, shisha or electronic cigarettes are sold or offered for sale shall perform a transaction scan as a precondition for such purchases.

New York Assembly Bill A03593. Regarding Consumer Privacy Protection

Referred to Assembly Consumer Affairs and Protection Committee, 01/03/2024

See also: New York Assembly Bill 7423

Referred to Assembly Codes Committee, 01/03/2024

Enacts the NY privacy act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared.

New York Assembly Bill S00365. Regarding Consumer Privacy and Protection

Died in Assembly, returned to Senate, referred to Consumer Protection Committee, 01/03/2024

This would enact the New York Privacy Act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared. Personal information is any information in which personal data is generated from a person’s natural, biological, physical, or physiological characteristics that allow for unique identification. The de-identified data is data that cannot be reasonably be linked to a particular consumer, household, or device.

New York Assembly Bill S02204. Relating to recordkeeping requirements for second-hand dealers and pawnbrokers

Referred to Senate Consumer Protection Committee, 01/19/2024

Would require second-hand dealers and pawnbrokers to scan a copy of identification prior allowing a person to purchase property.

Such electronic record may, in the discretion of the secretary of state and in furtherance of the purposes of this article and any other applicable law or rules regulating the activities of dealers in second-hand articles, include but shall not be limited to the following information, provided in a format or in accordance with specifications as provided by rule or regulation of the secretary of state: a. The date, time, location and type of transaction; b. The name of the individual conducting the transaction for the dealer; c. Identifying information regarding the person who is present to offer property purchased by the dealer, including name, address, phone number, type of identification utilized, identification number, expiration date of identification, date of birth, sex, height, weight, eye color, hair color, race or ethnicity, distinguishing marks, digital photograph of owner, and digital photograph or scanned copy of identification utilized;

New York Assembly Bill S 3164. Relating to the prohibition of driver’s license scanning except for age verification

Referred to Senate Consumer Protection Committee, 01/30/2024

Would prohibit the scanning of driver’s license or identification card except for under certain purposes, one of which would be to verify the individual’s age when providing age-restricted goods or services to the individual.

Unlawful use of a New York state driver’s license or identification card. 1. No person, business, firm, partnership, association, or corporation, not including the state or its political subdivisions, may scan the machine-readable zone of an individual’s New York state driver’s license or identification card as defined in section four hundred ninety of the vehicle and traffic law, except for the following purposes: (a.) to verify authenticity of the driver’s license or identification card or to verify the identity of the individual if the individual pays for goods or services with a method other than cash, returns an item, or requests a refund or exchange; (b.) to verify the individual’s age when providing age-restricted goods or services to the individual; (c.) to prevent fraud or other criminal activity if the individual returns an item or requests a refund or an exchange and the business uses a fraud prevention service company or system. Information collected by scanning an individual’s driver’s license or identification card pursuant to this subdivision shall be limited to the following information from the individual: name; address; date of birth; and driver’s license number or identification card number; (d.) to record, retain, or transmit information as required by state or federal law; (e.) to transmit information to a consumer reporting agency, financial institution, or debt collector to be used as permitted by the federal Fair Credit Reporting Act, Gramm-Leach-Bliley Act, or the Fair Debt Collection Practices Act; or (f.) to record, retain, or transmit information by a covered entity governed by the medical privacy and security rules issued by the federal Department of Health and Human Services, Parts 160 and 164 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Availability Act of 1996.
2. No person, business, firm, partnership, association, or corporation, not including the state or its political subdivisions, shall retain any information obtained from scanning an individual’s New York state driver’s license or identification card, except as permitted in subdivision one of this section.

New York Assembly Bill S08401. Relating to the prohibition of Kratom sales to anyone under 21

Referred to Senate Health Committee, 01/26/2024

Would prohibit individuals who are under the age of twenty-one to purchase or possess any products containing Kratom.

Ohio H 258. Relating to increasing fines for repeatedly selling tobacco products to minors

Passed the House; referred to Senate Judiciary Committee 01/10/2024.

Would increase fines for repeatedly selling tobacco products to minors. Under this code, “age verification” means a service provided by an independent third party (other than a manufacturer, producer, distributor, wholesaler, or retailer of cigarettes, other tobacco products, alternative nicotine products, or papers used to roll cigarettes) that compares information available from a commercially available database, or aggregate of databases, that regularly are used by government and businesses for the purpose of age and identity verification to personal information provided during an internet sale or other remote method of sale to establish that the purchaser is twenty-one years of age or older.

Pennsylvania H 1096 – Amendments to the Liquor Code requiring ID scanning devices at amusement parks

Approved by Governor, 12/14/2023. Effective March 14, 2024.

An amusement park that holds a public venue license would be required to utilize a transaction scan device to verify the age of an individual who appears to be under thirty-five years of age before making a sale of liquor and malt or brewed beverages; however, an acceptable form of identification  that cannot be scanned may be accepted by the licensee. An amusement park could not sell or share data from the use of a transaction scan device, except that the licensee would be allowed to use the data to show the Enforcement Bureau that the licensee is in compliance with the law. 
The term “transaction scan device” means a device capable of deciphering, in an electronically readable format, the information encoded on the magnetic strip or bar code of an identification card.

Tennessee House Bill 1614. Relation to Protect Tennessee Minors Act

Assigned to House Criminal Justice Subcommittee, 01/10/2024.

See also: Tennessee Senate Bill 1792

Passed on Second Consideration, referred to Senate Commerce and Labor Committee, 01/29/2024

An individual or commercial entity that publishes or distributes in this state a website that contains a substantial portion of content harmful to minors is liable if the individual or commercial entity does not:
(1) Verify, using a reasonable age-verification method, the age of each active user attempting to access its website; or
(2) Verify, using a reasonable age-verification method, the age of an active user attempting to access its website again after completion of an age verified session.

A website owner, commercial entity, or third party that executes a required age-verification method shall:
(1) Retain at least seven (7) years of historical anonymized age verification data; and
(2) Not retain any personally identifying information of the active user after access to the content harmful to minors has been granted.

Tennessee Senate Bill 1643. Relating to age verification for certain material

Referred to Senate Commerce and Labor Committee, 01/10/2024Would require commercial entities that publish or distribute material on an internet website, more than one-third of which is sexual material harmful to minors, to verify that an individual attempting to access the material is 18 years of age or older.(a) A commercial entity that knowingly and intentionally publishes or distributes material on an internet website, including a social media platform, more than one-third (1/3) of which is sexual material harmful to minors, shall use reasonable age verification methods as described by § 47-18-3403 to verify that an individual attempting to access the material is eighteen (18) years of age or older.(b) A commercial entity that performs the age verification required by subsection (a) or a third party that performs the age verification required by subsection (a) shall not retain any identifying information of the individual.A commercial entity that knowingly and intentionally publishes or distributes material on an internet website or a third party that performs age verification under this chapter shall require an individual to:(1) Provide digital identification; or(2) Comply with a commercial age verification system that verifies age using:(A) A government-issued identification; or(B) A commercially reasonable method that relies on public or private transactional data to verify the age of an individual.

Washington Senate Bill 6179. Relating to biometric age verification by liquor licensees

Executive action taken in the Senate Committee on Labor & Commerce, 01/29/2024A biometric age verification system may for the purpose of this title and for the purpose of procuring liquor, be relied upon by any licensee as evidence of legal age of the person using the biometric age verification system, provided the licensee complies with the conditions and procedures prescribed herein and such regulations as may be made by the board.A biometric age verification system must: (i) Use a biometric system; (ii) Use an electronic authorization process and processes to verify the validity of a card of identification and the identity of the holder of such card of identification;

Wisconsin Assembly Bill 880. An act to amend statues relation to providing alcohol retailers with identification scanners

Read first time and referred to Assembly Committee on State Affairs, 01/03/2024

Would amend the statutes that provide alcohol beverage retailers with identification scanners. Current law prohibits municipalities from providing to alcohol beverage retail licensees any device capable of scanning a driver’s license or identification card issued by the Department of Transportation. The bill repeals this prohibition and also prohibits a municipality that provides such a device from collecting or retaining data derived from the device.

Wisconsin Senate Bill 130. Relating to scanning IDs during alcohol delivery

Representative Gustafson added as a co-sponsor, 01/10/2024

Would require an individual making a delivery of alcohol beverages to examine a customer’s identification and verify visually and by using electronic scanning technology. This has not been passed yet, but a fiscal estimate was received on 04/06/23.

Wisconsin Senate Bill 827. Relating to providing any alcohol retailers with an ID scanning device

Representative Subeck added as a Cosponsor, 01/03/2024

In relation to Assembly Bill 880, this bill would, if the prohibition is lifted, provide alcohol beverage retailers with identification scanners.

Conclusion

Statewide legislation around privacy continues to be passed in states around the country.