No, you cannot legally run a tag number to find someone as an ordinary member of the public. Under the federal Driver’s Privacy Protection Act (DPPA), 18 U.S.C. § 2721, state motor vehicle departments are prohibited from releasing the personal information tied to a license plate unless the requester fits one of fourteen narrow exceptions, and curiosity about who owns a car is not among them. The same law makes it independently illegal for a person to obtain that information for a non-permitted purpose or to lie about their reason for asking.1Office of the Law Revision Counsel. 18 U.S. Code 2722 – Additional Unlawful Acts Violations carry a civil floor of $2,500 per lookup, plus possible criminal fines.
What the DPPA Actually Prohibits
The DPPA does two things at once. It bars every state DMV, along with its employees and contractors, from disclosing personal information from motor vehicle records except under specific permitted uses. And it separately makes it unlawful for any person to obtain or use that information for a purpose that is not permitted, or to make a false representation to get it.1Office of the Law Revision Counsel. 18 U.S. Code 2722 – Additional Unlawful Acts
That second piece is what catches ordinary people. Even if a DMV clerk hands you the record, and even if a website sells it to you, you have violated federal law the moment you obtain the information without a permitted purpose. Claiming you had a reason you did not actually have makes it worse, because false representation is its own separate violation.
The DPPA is federal, so it applies in every state. Some states layer on stricter protections, but none can offer less privacy than the federal floor.
Who Is Allowed to Access the Information
The statute lists fourteen permissible uses.2Office of the Law Revision Counsel. 18 U.S. Code 2721 – Prohibition on Release and Use of Certain Personal Information From State Motor Vehicle Records The ones that most often come up:
- Government agencies and law enforcement carrying out official functions.
- Access connected to a civil, criminal, or administrative court proceeding, including service of process, pre-litigation investigation, and enforcement of judgments.
- Insurance companies handling claims, anti-fraud work, rating, and underwriting.
- Licensed private investigators and security services, but only when the underlying purpose itself qualifies under another permitted category. A PI license by itself is not a free pass.
- Vehicle manufacturers issuing recall or safety notices.
- Businesses verifying the accuracy of information a customer already submitted, and only for fraud prevention, legal remedies, or debt collection.
- Notifying the owner of a towed or impounded vehicle.
A separate exception allows release with the vehicle owner’s express written consent. Without either a permitted use or that consent, the DMV must refuse.
What a Plate Number Can and Cannot Reveal
Motor vehicle records contain two tiers of protected information. The first is “personal information” as defined by the DPPA: name, address (excluding the five-digit ZIP code), phone number, driver identification number, photograph, Social Security number, and medical or disability information. The second is “highly restricted personal information,” a narrower subset covering photographs, Social Security numbers, and medical or disability information.3Office of the Law Revision Counsel. 18 USC 2725 – Definitions Even a qualifying requester generally cannot obtain the highly restricted tier without the individual’s express consent, unless they fall into a small set of categories such as a government agency, a court proceeding, or insurance work.
Vehicle-level details, such as make, model, year, and VIN, are associated with these records but are not themselves classified as personal information under the DPPA. Data about traffic violations, accidents, and license status is also carved out of the statute’s privacy restrictions.
What “Free License Plate Lookup” Sites Actually Deliver
Anyone searching this question has seen the ads. It helps to know what is real and what is not.
Legitimate services can lawfully show you information that is not personal information under the DPPA: make, model, year, and sometimes accident history or title status. The National Highway Traffic Safety Administration itself runs a free public VIN decoder that returns manufacturing details, recalls, and safety ratings.4National Highway Traffic Safety Administration. VIN Decoder None of that identifies the owner.
What no service can lawfully do is hand you the registered owner’s name, address, or phone number unless you qualify under a DPPA exception. A site that promises to reveal the owner’s identity to any member of the public is either overselling what it delivers, pulling data from non-DMV sources like commercial data brokers, or violating federal law. If a site makes you affirm a permissible purpose before showing results, that is the DPPA at work. If it skips that step, treat the results and the operator with caution. Using such a service to obtain owner information for a non-permitted purpose exposes you personally, not just the site.
The Legitimate Ways to Identify a Vehicle Owner
The scenario that drives most of these searches is a hit-and-run, a parking lot collision, or a driver who behaved dangerously and left. You have a plate and nothing else. Two paths actually work.
File a police report. Law enforcement has direct access to motor vehicle records under the government-agency exception and can run the plate as part of an investigation. This is the fastest and cleanest route, and it costs nothing.
If the police cannot help, or you are pursuing a civil claim, hire an attorney. Once litigation is reasonably anticipated, the court-proceedings exception permits records access for service of process, pre-litigation investigation, and enforcement of judgments.2Office of the Law Revision Counsel. 18 U.S. Code 2721 – Prohibition on Release and Use of Certain Personal Information From State Motor Vehicle Records Your attorney, or a licensed investigator working on the case, can request the records through proper channels. That is exactly the situation the exception was written for.
What will not work is calling the DMV yourself and asking for a lookup. You are not a government agency, not an insurer, and not a party to a proceeding on your own say-so. The DMV will refuse, and the law requires them to.
Penalties if You Do It Anyway
Anyone who knowingly obtains, discloses, or uses personal information from a motor vehicle record for a non-permitted purpose can be sued in federal district court by the person whose information was compromised.5Office of the Law Revision Counsel. 18 USC 2724 – Civil Action The available remedies:
- Liquidated damages of at least $2,500 per violation, regardless of whether the victim can show actual financial harm. Actual damages can be awarded instead if they are higher.5Office of the Law Revision Counsel. 18 USC 2724 – Civil Action
- Punitive damages, if the violation was willful or in reckless disregard of the law.5Office of the Law Revision Counsel. 18 USC 2724 – Civil Action
- Attorney’s fees and litigation costs.
The $2,500 minimum applies per violation, meaning each improperly obtained record is its own count. Someone who knowingly violates the DPPA is also subject to a federal criminal fine under the general fine schedule at 18 U.S.C. § 3571.6Office of the Law Revision Counsel. 18 USC 2723 – Penalties The DPPA does not authorize imprisonment for individual violations.
If Your Own Records Were Pulled
The DPPA does not include an explicit statute of limitations. Federal courts have generally applied the four-year catchall period that governs federal civil actions when no specific deadline is written into the statute. The clock likely starts when you discovered, or reasonably should have discovered, the improper access. Because unauthorized lookups happen at DMV terminals out of public view, victims often do not learn about them until the information turns up in unwanted contact, a lawsuit, or a data-breach notification.
A Note on License Plate Readers
Automated license plate readers (ALPRs) mounted on police cruisers, toll gantries, and private parking structures capture plate numbers into databases that can hold millions of records. The DPPA does not cover them. The statute governs records held by state motor vehicle departments, and ALPR databases are maintained by law enforcement, private operators, or third-party aggregators. No comprehensive federal law currently addresses ALPR collection or retention. Some states and municipalities have enacted their own limits, but coverage is uneven. If a plate is captured by an ALPR, that data sits outside the DPPA’s framework entirely.