Overview of California ID scanning laws
California has 6 laws which we consider relevant to ID verification, in addition to other laws which may related to age verification, identity verification, KYC, privacy, and biometrics.
Can you scan IDs in California?
Yes, however, California law does contain some regulations related to ID scanning and retention of information from a scanned ID. These laws vary by use case and industry. Explicitly allowed use cases for ID scanning in California include:
- To collect or disclose personal information required for reporting, investigating, or preventing fraud, abuse, or material misrepresentation
- To verify age or authenticity of IDs
- To comply with a legal requirement to record, retain, or transmit that information
- To transmit information to payment verification companies, provided that only the name and ID number can be used or retained by the payment verification companies
The full text of California’s regulations around scanning/swiping identification can be read here.
Can you save data from a scanned ID in California?
The regulations surrounding retention of PII from a scanned ID vary by use case and industry in California.
Does California offer affirmative defense for ID scanning?
No. California has no affirmative defense laws related specifically to ID scanning. But in some instances proof that an ID was examined, which can be the form of an electronic transaction log, is considered an affirmative defense.
What types of IDs does California issue?
California issues drivers licenses and state IDs, including REAL ID. Additionally, California has the CADMV app which issues a mobile ID that has been installed by more than 1,000,000 California residents.
Individual California ID verification laws
ID scanning for alcohol sales
California does not require ID verification for alcohol sales, however proof that an ID was examined (including by an electronic scan) is considered an affirmative defense.
Age verification for tobacco sales
California requires that businesses check ID but does not require electronic scanning or verification for tobacco sales.
ID scanning for scrap yards
California requires scrapyards and pawn shops to collect information from the ID of the seller.
ID scanning for dispensaries
California requires that cannabis dispensaries check ID but does not require electronic scanning for cannabis sales.
ID verification for controlled substances
California requires that retailers who sell nitrous oxide must check ID before dispensing the product. Enacted 2003.
Age verification for social media
In 2024, California legislature proposed a law that would require age verification for social media sites. It was blocked in January 2025.
Data privacy laws in California
California has some of the most stringent privacy laws in the country, including the landmark California Consumer Privacy Act which includes substantial provisions for protection of consumer data.
Beginning January 1, 2020, the CCPA grants consumers various rights with regard to their personal information held by businesses, including:
- The right to know all data collected by a business on you;
- The right to say no to the sale of your information;
- The right to delete your data;
- The right to be informed of what categories of data will be collected about you prior to its collection, and to be informed of any changes to this collection;
- Mandated opt-in before sale of children’s information (under the age of 16);
- The right to know the categories of third parties with whom your data is shared;
- The right to know the categories of sources of information from whom your data was acquired;
- The right to know the business or commercial purpose of collecting your information;
- Enforcement by the Attorney General of the State of California;
- The private right of action when companies breach your data, to make sure these companies keep your information safe.
