US immigration authorities have accessed driver’s licenses databases across the country, searching millions of people’s photos without their knowledge, privacy researchers reported Monday.

The revelations have raised significant alarms in Utah, Vermont and Washington, in particular. Those three states have allowed undocumented immigrants to obtain driver’s IDs and permits, but also have appeared at times to work with Ice agents seeking access to those databases, according to Georgetown Law experts who obtained the government files through records requests.

“Undocumented folks are coming out of the shadows in these states to get driver’s licenses and come into compliance with the law,” said Harrison Rudolph, an associate at Georgetown’s Center on Privacy and Technology, which shared the records with the Guardian. “They are never told when they go into the DMV [department of motor vehicles] to get a license that they also may be submitting their face to Immigration and Customs Enforcement. That is a huge bait and switch and it’s deeply unfair.”

In Utah, the state DMV database was the subject of nearly 2,000 facial-recognition searches from outside law enforcement and federal agents, including Ice and the FBI, according to an analysis by the Washington Post, which first reported on the records. One official noted in the records that the Utah database included more than 5m driver’s licenses and state ID photos.

Redacted Vermont records showed that immigration authorities and other federal agents have at times received state approval to conduct searches of the DMV “facial recognition photo repository”. One file said the purpose was to compare the photos with those of suspects, and, potentially, to apprehend them.

A federal lawsuit filed in Vermont by an immigrants’ rights group alleged that migrant farmworkers were targeted for deportation after they obtained licenses, Vermont Public Radio reported earlier this year. The state DMV sent names, photos and other personal information on migrant workers to Ice, according to that suit.

A Vermont DMV spokesperson said Monday that the state had stopped the use of facial recognition software in May 2017, and that “no information has been shared” since then.

The records from Washington state also showed that immigration agents made facial recognition requests to the state’s licensing department. State officials admitted to the Seattle Times last year that the department, which issues driver’s licenses, had regularly provided Ice with photos and license applications. The Democratic governor, Jay Inslee, said at the time he was ordering a stop to the practice, though the status of that policy was unclear.

The licensing department said in a statement Monday that it only releases data for “immigration purposes” when there is a “judicial court order or subpoena”. Since 2013, the state has received 53 requests for data access, which include two from the FBI and four from Ice. When matches are found, the state “would provide limited identity information”, the statement said.

Washington is one of a handful of states across the country that has a sanctuary law on the books meant to limit cooperation between local law enforcement and immigration authorities.

There has been a growing push across the country to allow undocumented people to have licenses, with the understanding that it improves their lives and aids public safety. But that information should not be used by Ice to pursue deportations, activists said.

“It’s putting people in this impossible situation,” said Jacinta Gonzales, an organizer with the group Mijente, noting that state IDs are supposed to help undocumented people avoid arrest. “It’s a lose-lose for immigrants.”

Last week, Mijente released documents showing that Ice agents exchanged cheerful messages about upcoming raids and potential arrests, with one official writing, “Happy hunting!”

When people take driver’s license photos, they have not given consent for their images to be searched, added Sarah St Vincent, a surveillance researcher with Human Rights Watch.

“States have tried to improve people’s lives and people’s ability in this country to move around by giving them the ability to drive,” she said. “But are the states ensuring that it’s not used in a way that abuses rights?”

The FBI has also logged more than 390,000 facial-recognition searches of government databases since 2011, including DMV data, the Government Accountability Office disclosed in June. Neither Congress nor state legislatures have passed laws authorizing these types of systems, the Post noted.

There has been growing evidence in recent years that facial recognition technology can supply “false positives” and can exacerbate racial biases in the US criminal justice system.

Asked about the Georgetown records, Ice spokesman Matthew Bourke said the agency does not comment on “investigative techniques, tactics or tools”, adding, “During the course of an investigation, Ice has the ability to collaborate with external local, federal and international agencies to obtain information that may assist in case completion and prosecution efforts.”

An FBI spokesperson pointed to its recent testimony before Congress, which said: “Facial recognition is a tool that, if used properly, can greatly enhance law enforcement capabilities and protect public safety.”