The DPPA's Private Right of Action: Elements, $2,500 Liquidated Damages and Standing

The Cause of Action in 18 U.S.C. § 2724

The civil remedy is one sentence long. Under 18 U.S.C. § 2724(a), "a person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court." The claim belongs to the driver or vehicle owner whose information it is, not to a regulator, and the statute names the federal district courts as the forum.

The Fifth Circuit reduced the sentence to three elements in Taylor v. Acxiom Corp. (2010), and repeated them in Allen v. Vertafore (2022): the defendant (1) knowingly obtained, disclosed or used personal information, (2) from a motor vehicle record, (3) for a purpose not permitted. The third element is defined by reference to the list of uses in § 2721(b), which is covered in the post on DPPA permissible uses. This post takes the first two elements, then the remedies.

Section 2722 states the matching prohibitions without attaching a remedy of its own: it is unlawful to knowingly obtain or disclose personal information from a motor vehicle record for a use not permitted by § 2721(b), and unlawful to make a false representation to obtain it. Those provisions matter chiefly through § 2724 and the criminal fine in § 2723(a), discussed below.

Knowingly Obtains, Discloses or Uses

The mental-state word attaches to the act, not to the law. In Senne v. Village of Palatine (7th Cir. 2012, en banc), the village argued it could not be liable because the officer who left a ticket on a windshield did not know anyone else would read it. The court rejected that reading: "Voluntary action, not knowledge of illegality or potential consequences, is sufficient to satisfy the mens rea element of the DPPA," citing the Third Circuit's decision in Pichler v. UNITE. The Senne majority also held that placing information in public view was a disclosure "regardless of whether Mr. Senne can establish that anyone actually viewed it."

Whether knowingly carries more weight for some defendants remains unsettled. The Second Circuit, in a 2013 opinion discussed in the resale post, described the circuits as divided: Pichler held a union end user liable although it did not know its purpose would be deemed improper, while the Sixth Circuit in Roth v. Guzman held a state DMV was not civilly liable unless it actually knew the recipient would misuse the data. The Second Circuit declined to resolve that disagreement.

"Disclose" has limits too. In Allen, Vertafore announced that files holding the driver information of about 27.7 million Texas license holders, stored on an unsecured external service, had been accessed without authorization. The plaintiffs pleaded that storing the data that way was a knowing disclosure. The Fifth Circuit affirmed dismissal because the complaint alleged no disclosure at all: nothing about "unsecured" or "external" implied exposure to public view, and "the mere fact that unauthorized users managed to access the information does not imply that Vertafore granted or facilitated that access." The court did not reach knowledge or purpose.

From a Motor Vehicle Record

The second element has decided more cases than its length suggests. In Andrews v. Sirius XM Radio (9th Cir. 2019), a used-car dealership passed a buyer's details, taken from his driver's license, to a satellite radio company that then marketed to him. The Ninth Circuit held that "the DPPA does not apply where the source of personal information is a driver's license in the possession of its owner, rather than a state Department of Motor Vehicles."

The Fourth Circuit reached the same place by a narrower route in Garey v. James S. Farrin, P.C. (2022). Personal injury lawyers had mailed advertising to drivers named in North Carolina crash reports, obtained from police agencies and data brokers. Noting that courts are divided on whether a license is itself a motor vehicle record, the court took no position and held instead that the plaintiffs had to prove the defendants obtained the information "from" a motor vehicle record. The lawyers had taken it from accident reports, and the plaintiffs had not preserved an argument that those reports were motor vehicle records, so the defendants' judgment was affirmed.

Liquidated Damages of $2,500

Section 2724(b)(1) authorizes "actual damages, but not less than liquidated damages in the amount of $2,500." The floor applies without proof of loss. Garey quoted the Eleventh Circuit's 2005 decision in Kehoe v. Fidelity Federal Bank & Trust for the proposition that "proof of actual damages is not necessary for an award of liquidated damages," and noted that the defendants did not contend otherwise.

The subsection opens with "The court may award," and the size of aggregate exposure is the open question. In Maracich v. Spears the complaint sought damages for more than 30,000 people who received solicitation letters. The Supreme Court stated that whether § 2724, "after a careful and proper interpretation, would permit an award in this amount, and if so whether principles of due process and other doctrines that protect against excessive awards would come into play, is not an issue argued or presented in this case." In Senne, Judge Posner's dissent made the same point from the other side, observing that parking tickets were "each now worth $2,500."

Punitive Damages and Fees

The remaining remedies in § 2724(b) are listed separately and carry their own conditions:

• Punitive damages under (b)(2), "upon proof of willful or reckless disregard of the law." This is the only remedy in the section that states a heightened mental state.
• Attorneys' fees and costs under (b)(3): "reasonable attorneys' fees and other litigation costs reasonably incurred." Like every item in the subsection, it is framed as something the court may award.
• Preliminary and equitable relief under (b)(4), "as the court determines to be appropriate."

Equitable relief carries its own standing requirement. In Garey the Fourth Circuit held that the plaintiffs could pursue damages but not an injunction, because obtaining their information from past crash reports was "a fait accompli" and a future violation depended on a chain of events, another accident and another report, too speculative to support prospective relief.

Standing After TransUnion

Before TransUnion LLC v. Ramirez, the Seventh Circuit held in Graczyk v. West Publishing Co. (2011) that Congress had defined the relevant injury as the obtainment, disclosure or use of a person's information, so plaintiffs alleging a prohibited disclosure had standing. TransUnion (2021) required instead a close historical or common-law analogue for the asserted harm, a test analysed in our post on TransUnion and concrete harm.

Garey applied that test to the DPPA. The Fourth Circuit agreed with the district court that the alleged harms were "closely related to the invasion of privacy, which has long provided a basis for recovery at common law," relying on its earlier TCPA decision in Krakauer v. Dish Network, and held the plaintiffs had Article III standing to seek damages.

Holmes v. Elephant Insurance Co. (4th Cir. 2025) shows the limit. Hackers took driver's license numbers of nearly 3 million people through an insurer's quoting tool, which auto-filled data drawn partly from DMV records, and the consolidated complaint pleaded a DPPA claim among five class claims. The court decided standing only. Two plaintiffs who found their license numbers on the dark web had suffered a harm analogous to public disclosure of private facts and could seek damages. The other two could not: risk of future misuse was not imminent for them, and time spent monitoring or emotional distress could not supply standing on their own. The broader case law is collected in the privacy standing and damages guide.

Criminal Fines and Civil Penalties Against States

Two public enforcement provisions sit in § 2723. Subsection (a) states that "a person who knowingly violates this chapter shall be fined under this title." It authorizes no imprisonment and names no amount. Title 18's general provisions supply the ceilings: § 3559(a)(9) classifies an offense for which no imprisonment is authorized as an infraction, and § 3571 caps an infraction fine at $5,000 for an individual and $10,000 for an organization, subject to the alternative fine of twice the gross gain or loss in § 3571(d).

States sit outside § 2724 altogether. Section 2725(2) defines "person" to exclude "a State or agency thereof," which the Supreme Court noted in Reno v. Condon. What reaches a state instead is § 2723(b): a state department of motor vehicles "that has a policy or practice of substantial noncompliance" is subject to a civil penalty imposed by the Attorney General of not more than $5,000 a day for each day of substantial noncompliance. The statute gives that remedy to the Attorney General, not to drivers.

Frequently Asked Questions