In most of the United States, a hotel can legally copy your driver’s license at check-in. No federal law forbids it, and most states allow businesses to collect personal information when it serves a legitimate purpose like verifying identity or preventing fraud. A handful of states restrict electronic scanning of licenses, so the specifics depend on where you’re staying. The more useful question is what the hotel does with the copy once it has one, and what you can ask for at the desk to limit your exposure.
Why Hotels Ask in the First Place
The main reason is fraud prevention. The hotel wants to confirm that the person at the counter is the person who booked the room and authorized the card on file. A copied license gives the property documentation to fight a chargeback if the cardholder later disputes the charge. Without proof, the hotel absorbs the loss.
Copies also support age verification for mini-bars and age-restricted check-in policies, and they feed the guest registry that many local jurisdictions require hotels to maintain and make available to law enforcement on request.
What the Law Actually Says
Federal law leaves driver’s licenses largely unregulated on this point. There is no federal statute prohibiting a business from photocopying a state-issued license.
State law is a patchwork. Most states permit businesses to collect and retain personal information when the purpose is reasonably related to a legitimate transaction. A few states go further and restrict electronic scanning or swiping of licenses, limiting what data a business can extract from the barcode and how long it can hold that data. The practical result: in most places a hotel can photocopy your license, but in certain states the hotel may not be allowed to run it through a barcode scanner or keep the extracted data beyond what the transaction requires.
A growing number of states have also enacted comprehensive consumer privacy laws that require businesses to disclose what personal information they collect, honor requests to access or delete it, and use reasonable security to protect it. Those obligations apply to hotels the same way they apply to any business handling personal data.
What a Copy Actually Captures
The front of your license shows your full legal name, home address, date of birth, license number, physical descriptors, and signature. That alone is enough raw material for an attempted identity theft.
The barcode on the back is the bigger issue. Modern licenses carry a PDF417 barcode built to a national standard set by the American Association of Motor Vehicle Administrators, and it encodes the card’s information in machine-readable form. Mandatory fields include full name, date of birth, sex, eye color, height, complete street address, and license number, among others.1American Association of Motor Vehicle Administrators. AAMVA DL/ID Card Design Standard
A clerk glancing at your card notes a few details. A scanner captures every field, formatted and ready to be stored, searched, or stolen.
Where the Real Risk Lives
The concern isn’t usually that the hotel will misuse your information. The concern is that hotels are attractive targets because they hold concentrated personal data from thousands of guests. A breach, or a physical copy lifted from behind the front desk, can be used to open fraudulent credit accounts, file fake tax returns, or impersonate you against a financial institution. A clean image of a license can also feed the production of counterfeit ID.
The Marriott case makes the risk concrete. In October 2024, the FTC took enforcement action against Marriott International over three separate data breaches affecting more than 344 million customer records worldwide. One of those breaches exposed 339 million Starwood guest account records, including 5.25 million unencrypted passport numbers along with payment card numbers, dates of birth, and email addresses.2Federal Trade Commission. FTC Takes Action Against Marriott and Starwood Over Multiple Data Breaches
The exposure scales with how the data is handled. A copy locked up and shredded after checkout is far less dangerous than one sitting in an unsecured drawer or a shared drive that no one has touched in years.
What to Do at the Front Desk
You have room to negotiate, even when the property’s default is to copy every guest’s license.
Start by asking whether the clerk can verify your license visually instead of photocopying it. Many hotels will accept a visual check paired with your name and license number written into the system. That gives the property what it needs without leaving a full image behind.
If the hotel insists on a copy, ask two questions: how long do they keep it, and how do they destroy it? A property that can tell you it shreds paper copies or deletes digital scans within a set number of days after checkout is handling the data responsibly. A blank look tells you something too.
Consider offering a U.S. passport instead. A passport verifies your identity and age but doesn’t display your home address, which removes one of the more sensitive fields from the picture. Not every hotel will accept a passport for a domestic stay, but many will if you ask.
You can refuse outright. The hotel, as a private business, can generally refuse to complete the check-in. A middle path usually works better than a standoff: offering the license for visual inspection, or presenting a passport, gives both sides something workable.
If You Learn Your Information Has Been Exposed
If a hotel where your license was copied reports a breach, move quickly. The FTC recommends these steps for identity theft victims:3Federal Trade Commission. How to Recover from Identity Theft
- Contact each of the three major credit bureaus (Equifax, Experian, and TransUnion) to place a free security freeze, which blocks new credit accounts from being opened in your name until you lift it.
- Place a fraud alert with one bureau, which will notify the other two. The alert requires businesses to verify your identity before issuing new credit, lasts one year, and can be renewed.
- File a report at IdentityTheft.gov to generate an official FTC Identity Theft Report and receive a personalized recovery plan with pre-filled letters and progress tracking. The FTC report carries more weight with creditors and law enforcement than a self-written account.
- Pull free weekly credit reports from all three bureaus at AnnualCreditReport.com and check for accounts or inquiries you don’t recognize.
- Call the fraud department of any bank or card issuer showing unauthorized activity, freeze or close the compromised accounts, and change your login credentials.
If the breach exposed your Social Security number, also report it to the Social Security Administration’s Inspector General. For suspected tax-related fraud, file IRS Form 14039.