New AI Litigation for Using Driver’s Licenses and ID Cards as Training Data

New privacy class action litigation in Illinois and a number of other states is targeting organizations that use driver’s license and state ID card information to train AI models. 

Most of the suits cite the Illinois Driver’s License Act (IDLA) and Illinois Identification Card Act (IICA), which restrict the ways private companies can use Illinois driver’s licenses and ID cards.

What the Lawsuits Allege

The claims allege: 

• Providers of identity verification services use Illinois-issued driver’s licenses and ID cards not only to verify identities, but also to train the AI models used to perform the services. 
• The IDLA and IICA do not permit this kind of secondary use of Illinois driver’s licenses and ID cards because:
  • The use is unrelated to the transaction for which the ID card information was obtained, and;
  • The providers did not obtain express permission from the consumers to use information from their driver’s licenses and ID cards to train an AI system. 
• Violating the IDLA or IICA entitles plaintiffs to recover damages of $250 or more per violation (plus attorney’s fees and costs of bringing the action). 

The Claims May Spread to Other Companies and Other States

To date, the lawsuits have focused on companies that provide identity verification services, but it is possible that other suits will target companies that integrate third-party identity verification services into their own products and offerings (particularly where the services are white labeled). 

In addition, a number of states other than Illinois restrict how companies can use state driver’s licenses and ID cards and the information on those cards, particularly in relation to scanning such documents. This could provide a basis for additional claims in other states with private rights of action, depending on how the services interact with state driver’s licenses and ID cards.

If you are an identity verification services provider or a company using identity verification services through a third-party provider, we recommend revisiting disclosures made and consents obtained, as well as the ways in which the services are processing driver’s licenses and other state ID cards, to enhance protections against these claims and suits.  

If you have questions about this development, please contact the authors (Aravind Swaminathan, Sulina Gabale, Nick Farnsworth, Peter Graham) or other members of the Orrick team.