The barcode on the back of your driver’s license is a PDF417 two-dimensional barcode that stores a machine-readable copy of nearly every piece of information printed on the front of the card. It holds your name, date of birth, address, license number, and physical description, all in a format any compatible 2D scanner can read instantly. The data is unencrypted, which makes it fast and universal, and also means you should understand what you’re handing over before someone scans it.
What PDF417 Is
PDF417 stands for “Portable Data File” and refers to a pattern of 4 bars and spaces in a 17-module structure. Unlike the single-line barcodes on groceries, it’s a stacked, two-dimensional format that looks like a small rectangle of tightly packed horizontal lines. That layered structure lets it hold far more data than a traditional barcode or magnetic stripe.
The American Association of Motor Vehicle Administrators (AAMVA) adopted PDF417 as the standard barcode for driver’s licenses and ID cards across U.S. states and Canadian provinces.1American Association of Motor Vehicle Administrators (AAMVA). AAMVA 2020 DLID Card Design Standard That’s why a license issued in Oregon can be scanned by a system in Florida and produce the same readable data. The REAL ID Act reinforces the standard by requiring compliant licenses to carry a machine-readable 2D barcode, which makes PDF417 both an industry convention and a legal requirement for any license used to board a domestic flight.
What’s Encoded in the Barcode
The barcode carries the same biographical and credential data printed on the face of the card, organized into mandatory and optional fields defined by AAMVA. The mandatory fields include:
- Full legal name: first, middle, and last, each in its own data field.
- Date of birth, in a dedicated field every jurisdiction must populate.
- Address: street, city, state, and ZIP code as they appear on the license.
- License number, issue date, and expiration date.
- Physical description: gender, height, eye color, and in some states hair color and weight.
- License class, endorsements, and restrictions, such as motorcycle or commercial authorization or a corrective-lenses requirement.
Some jurisdictions also encode optional fields like a document discriminator, an internal code used to verify the card wasn’t duplicated or tampered with.1American Association of Motor Vehicle Administrators (AAMVA). AAMVA 2020 DLID Card Design Standard
What the Barcode Does Not Contain
A common assumption is that the barcode holds your photograph or fingerprints. It doesn’t, at least not in the mandatory encoding every state uses. The AAMVA standard defines an optional compact encoding scheme (compliant with ISO/IEC 18013-2) that could theoretically carry a portrait image or fingerprint templates in separate data groups, but that optional capability is not part of the standard PDF417 barcode on your card.1American Association of Motor Vehicle Administrators (AAMVA). AAMVA 2020 DLID Card Design Standard Your photo sits on the front of the card and in DMV databases, not inside the barcode.
One practical detail catches people off guard. The barcode reflects the information encoded when your card was printed. If you move and update your address with the DMV but don’t get a new physical card, scanning the barcode will still return your old address. The data is baked in at production and can’t be updated remotely.
Who Scans It, and Why
Law enforcement officers scan license barcodes during traffic stops more than anyone else. A scan populates their system with your license details, saves time on manual data entry, and reduces transcription errors on citations. The data can also trigger instant lookups for outstanding warrants, suspended licenses, or other flags.
Retailers and bars scan the barcode for age verification when selling alcohol, tobacco, or other age-restricted products. Instead of doing mental math on a printed birth date, the scanner confirms whether you meet the legal age. That’s why you’ll see it at grocery store self-checkouts, pharmacies, and concert venues.
At airports, the Transportation Security Administration uses Credential Authentication Technology to verify identity documents at security checkpoints. The devices read the information encoded on physical IDs and cross-reference it against flight reservation data and pre-screening status in near real time.2Transportation Security Administration. Credential Authentication Technology TSA has also been expanding support for digital IDs through Apple Wallet, Google Wallet, and Samsung Wallet at more than 250 airports.3Transportation Security Administration. Digital Identity and Facial Comparison Technology
Beyond those settings, car rental agencies use the barcode to populate rental agreements, pharmacies verify identity for controlled substance prescriptions, and financial institutions confirm identity when you open an account. The function is the same across all of them: a manual data-entry task turned into a one-second scan.
Why the Unencrypted Format Matters
The data in your license barcode is not encrypted. There is no password, no authentication layer, and no restriction on who can read it. Anyone with a 2D barcode scanner, including free smartphone apps, can decode the full contents. Every time you hand your license to a bartender, hotel clerk, or bouncer who scans it, a digital copy of your name, address, date of birth, and license number lands in whatever system is on the other end.
Where that data goes after the scan is the real concern. Some point-of-sale systems store scanned license data temporarily; others retain it indefinitely in marketing databases. A driver’s license contains enough personally identifiable information to be a foundation for identity theft, and that information reportedly sells for over $150 on the dark web. Full name, date of birth, address, and government-issued ID number together are exactly what someone needs to open fraudulent accounts.
Scanning Alone Doesn’t Catch Fakes
If you assumed scanning a barcode is a reliable way to spot a counterfeit license, it isn’t. Because the PDF417 format follows a publicly documented standard, counterfeit producers can generate barcodes that pass standard scanners. The scan only confirms the data is formatted correctly and internally consistent. It doesn’t verify the card was actually issued by a state DMV.
More advanced systems cross-reference barcode data against issuing-authority databases or analyze the encoding for subtle inconsistencies, but the basic scanners used by most bars and retail stores don’t do that. A well-made fake with a properly formatted barcode will scan as valid. That’s why establishments and law enforcement rely on additional security features like UV markings, microprinting, holographic overlays, and the physical feel of the card, rather than the barcode alone.
What the Law Protects
The primary federal law protecting driver’s license information is the Driver’s Privacy Protection Act (DPPA), codified at 18 U.S.C. § 2721. The DPPA prohibits state DMVs and their employees from disclosing personal information obtained through motor vehicle records, except for a defined set of permissible purposes such as use by law enforcement, use connected to vehicle safety and recalls, insurance claims investigations, court proceedings, and certain research. Businesses can access motor vehicle records only to verify information a person has already submitted to them, and only for limited purposes like preventing fraud or collecting a debt.4Office of the Law Revision Counsel. 18 USC 2721 – Prohibition on Release and Use of Certain Personal Information From State Motor Vehicle Records
If someone violates the DPPA, you can bring a civil lawsuit. Remedies include actual damages with a floor of $2,500 in liquidated damages per violation, punitive damages where the violation was willful or reckless, and reasonable attorney’s fees.5Office of the Law Revision Counsel. 18 USC 2724 – Civil Action The $2,500 minimum means even a small actual loss carries a meaningful penalty when a violation is proven.
Many states have their own laws restricting how businesses handle scanned license data. These typically limit collection to what’s necessary for a specific transaction like age verification, prohibit selling or sharing the information for marketing, and require secure storage. Penalties vary, and some states grant consumers a private right of action.
Mobile Driver’s Licenses and Selective Disclosure
The barcode’s biggest privacy limitation is that it’s all-or-nothing. When a bar scans your license to confirm you’re 21, it also captures your home address, full legal name, license number, and every other encoded field. You can’t share just one.
Mobile driver’s licenses (mDLs) are built to solve that. Running on the ISO/IEC 18013-5 international standard, mDLs allow selective disclosure, so you can prove you’re over 21 without revealing your exact birth date, address, or anything else the verifier doesn’t need. The mDL communicates with the verifier’s device over a secure, authenticated channel, and the issuing authority cryptographically signs the data so it can be trusted without a database lookup.
As of early 2026, roughly 20 states and territories have active mobile driver’s license programs, with more in pilot stages. Supported platforms include Apple Wallet, Google Wallet, Samsung Wallet, and state-specific apps, and TSA accepts digital IDs at over 250 airports.3Transportation Security Administration. Digital Identity and Facial Comparison Technology Adoption is still growing, and in most states the mDL supplements rather than replaces the physical card, so you’ll still need to carry your license. For anyone uncomfortable with the amount of data a single barcode scan exposes, mDLs are the first real option for sharing only what the situation calls for.