Departments of Motor Vehicles in states around the country are taking drivers' personal information and selling it to thousands of businesses, including private investigators who spy on people for a profit, Motherboard has learned. DMVs sell the data for an array of approved purposes, such as to insurance or tow companies, but some of them have sold to more nefarious businesses as well. Multiple states have made tens of millions of dollars a year selling data.

"Under this MOU [memorandum of understanding], the Requesting Party will be provided, via remote electronic means, information pertaining to driver licenses and vehicles, including personal information authorized to be released," one agreement between a DMV and its clients reads.

"You need to learn what they’ve been doing, when they’ve been doing it, who they’ve been doing it with and how long it has been going on. You need to see proof with your own eyes," reads the website of Integrity Investigations , one private investigator firm that buys data from DMVs.

Many of the private investigators that DMVs have sold data to explicitly advertise that they will surveil spouses to see if they're cheating.

Motherboard has obtained hundreds of pages of documents from DMVs through public records requests that lay out the practice. Members of the public may not be aware that when they provide their name, address, and in some cases other personal information to the DMV for the purposes of getting a driver's license or registering a vehicle, the DMV often then turns around and offers that information for sale.

A small section of a document from the Virginia DMV showing which private investigators the DMV has data selling agreements with. Image: Screenshot.

Some of the data access is done in bulk, while other arrangements allow a company to lookup specific individuals, according to the documents. Contracts can roll for months at a time, and records can cost as little as $0.01 each, the documents add.

Multiple DMVs stressed to Motherboard that they do not sell the photographs from citizens' driver licenses or social security numbers.

“The selling of personally identifying information to third parties is broadly a privacy issue for all and specifically a safety issue for survivors of abuse, including domestic violence, sexual assault, stalking, and trafficking," Erica Olsen, director of Safety Net at the National Network to End Domestic Violence, told Motherboard in an email. "For survivors, their safety may depend on their ability to keep this type of information private."

The sale of this data to licensed private investigators is perfectly legal, due to the Driver's Privacy Protection Act (DPPA), a law written in the '90s before privacy became the cultural focus that it is today, but which critics believe should be changed. The process of becoming a licensed private investigator varies from state to state, and can be strict, according to multiple sources close to the industry. Some states, however, allow licensing to be granted on a local level or investigators to operate without a license.

The DPPA was created in 1994 after a private investigator, hired by a stalker, obtained the address of actress Rebecca Schaeffer from a DMV. The stalker went on to murder Schaeffer. The purpose of the law was to restrict access to DMV data, but it included a wide range of exemptions, including for the sale to private investigators.

"The DPPA is one of several federal laws that should now be updated," Marc Rotenberg, president and executive director of privacy activism group EPIC, wrote in an email. "I would certainly reduce the number of loopholes," he added, referring to how the law might be changed.

Do you work at a company selling data? Do you know of an abuse of DMV data? We'd love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com.

The data sold varies from state to state, but it typically includes a citizen's name and address. In others, it can also include their nine-digit ZIP code, date of birth, phone number, and email address.