Over the weekend, the U.S. took another step in the slow crawl toward normalizing databases and hidden searches as a fact of urban life. A new report from Georgetown Law’s Center on Privacy and Technology revealed that Immigration and Customs Enforcement officials requested access to DMV databases in Utah, Washington State, and Vermont, with the intention of using facial-recognition technology to scan drivers’ photos and match them against criminal and residency databases without their knowledge.

Three years ago, the center revealed that nearly half of all U.S. adults are already in the FBI’s facial-recognition database, which is largely sourced from DMV photos. The documents uncovered this week are the first confirmation that states have granted ICE specifically, not just the FBI, access to those databases.

Vermont and Utah both complied with ICE’s request, The New York Times reported; in Washington, it’s unclear whether the searches ever actually happened after being authorized.

The implications for undocumented migrants are stark: Utah, Washington, and Vermont are among the 12 states that don’t require documentation to obtain a driver’s license. What may have seemed like an olive branch to allow easier access to driving and identification now could be an invitation for investigation, arrest, or deportation.

“The purpose of driver’s licenses is to keep people safe, not to enable ICE to terrorize immigrant communities,” says Jake Snow, a technology and civil liberties attorney at the ACLU. “Neither Congress nor the states have ever legislatively authorized this conduct.”

But the surveillance apparatus is remarkable precisely because it doesn’t just ensnare those who have broken the law. When state officials hand over access to public databases with drivers’ photos or license-plate images, they aren’t just relinquishing the information of guilty parties. The vast majority of American adults have driver’s licenses. These scans will include an overwhelming number of drivers who have never been accused of a crime. DMV information essentially offers law enforcement the unchecked ability to search without a warrant. In effect, these license databases have become criminal databases, each search justified by the chance that someone documented there is guilty of crime. Everyone in them has become a suspect.

And though this is the first news of ICE using driver’s license photos for facial recognition, the agency already has plenty of access to public information via other means. For example, Vigilant Solutions, which maintains the country’s largest database of license plate photos, contracts with ICE, allowing agents to query a license plate and receive a log of everywhere it’s been spotted by license-plate-reading cameras. Vigilant also used its cameras to gather data from California malls, an action it initially denied until its parent company, Motorola, admitted that allegations were true.

All told, we are barreling toward a future where every ritual of public life carries implicit consent to be surveilled: obtaining a license, driving a car, shopping in the mall, and even walking across a college campus or city block all open one up to tracking and database matching of some kind. Opting out would mean nonparticipation in social life—a consequence much more dire than the invasion of privacy. When participating in daily life means being searched, law enforcement ceases to presume that the public is innocent.