DPPA & FCRA Driver Consent: What the Law Requires (with Sample Language)

Pulling a Motor Vehicle Record on a commercial driver without first obtaining the driver's signed written consent is a federal civil violation. The consent requirement comes from two overlapping laws that govern, separately, the DMV record itself and its use for employment screening: the Driver's Privacy Protection Act (DPPA) at 18 USC §§2721–2725, and the Fair Credit Reporting Act (FCRA) at 15 USC §1681. Each law has independent requirements, each carries independent penalties, and each is enforceable in private civil litigation by the driver whose record was pulled. The fix is straightforward: a clean, dated, signed consent on file before the pull. Get the form right once and you can reuse it on every driver.

This guide explains what each law requires, where the requirements overlap and where they diverge, and shows what compliant consent language looks like. Use it as a reference when you build your DQ file template.

The Driver's Privacy Protection Act (DPPA)

The DPPA is the federal law that governs DMV records as a category. It was enacted in 1994 and has been amended several times since.

18 USC §2721(a) — A State department of motor vehicles, and any officer, employee, or contractor thereof, shall not knowingly disclose or otherwise make available to any person or entity personal information, as defined in 18 USC §2725(3), about any individual obtained by the department in connection with a motor vehicle record, except as provided in subsection (b) of this section.

The general rule: DMV records are private, and the state cannot release them, period. The exceptions in §2721(b) are what allow employer screening:

18 USC §2721(b)(2) — For use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; performance monitoring of motor vehicles, motor vehicle parts and dealers; motor vehicle market research activities, including survey research; and removal of non-owner records from the original owner records of motor vehicle manufacturers.

18 USC §2721(b)(9) — For use by an employer or its agent or insurer to obtain or verify information relating to a holder of a commercial driver's license that is required under chapter 313 of title 49.

The §2721(b)(9) exception is the one that authorizes carriers to pull an MVR on a CDL holder for §391.23/§391.25 purposes. For non-CDL drivers, motor carriers typically rely on §2721(b)(2) (driver safety) or §2721(b)(1) (use by a government agency).

Across both clauses, the practical compliance posture is the same: you must have a permissible purpose, and the standard way to document it is the driver's written, signed consent.

18 USC §2721(b)(13) — For any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety.

18 USC §2724 — A person who knowingly obtains, discloses, or uses personal information from a motor vehicle record, for a purpose not permitted under this chapter, shall be liable to the individual to whom the information pertains.

Penalties under §2724 include actual damages of not less than $2,500 per violation, attorney's fees, and punitive damages. Statutory liability accrues per record — pulling fifty MVRs without consent is fifty separate violations.

The Fair Credit Reporting Act (FCRA)

The FCRA layers on top of the DPPA whenever the MVR is used for employment screening. It treats the record (and the company that pulled it) as a "consumer report" and "consumer reporting agency" respectively, and imposes a separate disclosure-and-consent regime.

15 USC §1681b(b)(2) — A consumer reporting agency may furnish a consumer report for employment purposes only if (A) the person who obtains the report from the agency certifies to the agency that (i) the person has complied with paragraph (3) [the disclosure-and-authorization rule] and that the information contained in the report will not be used in violation of any applicable Federal or State equal employment opportunity law or regulation.

15 USC §1681b(b)(2)(A) — A person may not procure a consumer report, or cause a consumer report to be procured, for employment purposes with respect to any consumer, unless (i) a clear and conspicuous disclosure has been made in writing to the consumer at any time before the report is procured or caused to be procured, in a document that consists solely of the disclosure, that a consumer report may be obtained for employment purposes; and (ii) the consumer has authorized in writing the procurement of the report by that person.

The key FCRA points:

• The disclosure must be a "stand-alone" document — it cannot be buried in the employment application or a general waiver.
• The disclosure must be "clear and conspicuous."
• The driver's authorization must be in writing.
• If you intend to take adverse action based on what the report shows (the §391.15 disqualification analysis), you must follow the §1681b(b)(3) pre-adverse-action process: provide the driver with a copy of the report and a summary of FCRA rights before making the final decision.

FCRA penalties for negligent or willful violations sit at $100 to $1,000 per violation under §1681n, plus attorney's fees and punitive damages.

Where DPPA and FCRA overlap

For a motor carrier pulling an MVR on a hire, both laws apply simultaneously:

• DPPA tells the DMV they may release the record (because there is a permissible purpose and consent on file).
• FCRA tells the carrier they may use the record (because they made the stand-alone disclosure and obtained written authorization).

A single consent document, drafted to satisfy both, is the practical solution. The disclosure must be stand-alone for FCRA, must specifically authorize the MVR pull for DPPA, and must include the driver's signature and date.

Sample consent language

Below is a compliant template. It is not legal advice and you should have your own counsel review the language for your specific jurisdiction, but it covers every element required by both DPPA and FCRA.

DRIVER AUTHORIZATION TO RELEASE MOTOR VEHICLE RECORD

I, [DRIVER FULL LEGAL NAME], holding driver's license number
[LICENSE NUMBER] issued by the State of [ISSUING STATE], hereby:

(1) ACKNOWLEDGE that [CARRIER NAME] ("the Company") has informed
me, in this stand-alone document, that a consumer report, including
a Motor Vehicle Record (MVR) and, where applicable, a Commercial
Driver's License Information System (CDLIS) report, may be obtained
for employment purposes from the issuing-state Department of Motor
Vehicles and from AAMVA;

(2) AUTHORIZE the Company, and any consumer reporting agency
acting on its behalf, to obtain such reports for the purpose of
evaluating my qualifications for employment as a commercial motor
vehicle driver, including any subsequent annual reviews required
by 49 CFR §391.25;

(3) UNDERSTAND that this authorization is given pursuant to the
Driver's Privacy Protection Act (18 USC §2721(b)(9)) and the Fair
Credit Reporting Act (15 USC §1681b(b)(2)) and that the report
obtained under this authorization will be used only for the
purposes stated above;

(4) CERTIFY that all information I have provided in connection
with my application for employment is true and complete to the
best of my knowledge.

___________________________________
Driver signature

___________________________________
Date

___________________________________
Print name

A few drafting notes:

• The disclosure paragraph (item 1) is what makes the document "stand-alone" under FCRA §1681b(b)(2)(A)(i). Do not stack this onto the bottom of the application.
• The authorization paragraph (item 2) covers both the initial pre-employment check and the annual §391.25 reviews, which means you do not need to re-collect consent every year.
• The DPPA citation (item 3) lets the DMV match the request against the §2721(b)(9) permissible-purpose exception.

Retention and re-consent

Keep the signed consent in the DQ file under §391.51 for the entire period the driver is employed plus three years. If a driver materially changes role, asks to revoke consent, or is terminated and rehired, collect a fresh consent under the same template.

Where FastDriverScreening fits in

Our checkout flow includes the DPPA + FCRA-compliant attestation built into the order — when you submit, the order receipt records that you held the driver's consent at the time of the pull. You can attach your own signed driver consent to the file, or use the stand-alone template our DQ File package includes. Either way, the consent layer is solved before the pull happens, which is exactly where the DPPA and FCRA both want it.