BOSTON -- ABOUT 10,000 people a week go to The Rack, a bar in Boston
favored by sports stars, including members of the New England Patriots.
by one, they hand over their driver's licenses to a doorman, who swipes
through a sleek black machine. If a license is valid and its holder is over
21, a red light blinks and the patron is waved through.
But most of the customers are not aware that it also pulls up the name,
address, birth date and other personal details from a data strip on the
of the license. Even height, eye color and sometimes Social Security number
"You swipe the license, and all of a sudden someone's whole life as we
know it pops up in front of you," said Paul Barclay, the bar's owner. "It's
Mr. Barclay bought the machine to keep out underage drinkers who use
ID's. But he soon found that he could build a database of personal
information, providing an intimate perspective on his clientele that can
useful in marketing. "It's not just an ID check," he said. "It's a
Now, for any given night or hour, he can break down his clientele by
age, ZIP code or other characteristics. If he wanted to, he could find out
how many blond women named Karen over 5 feet 2 inches came in over a
weekend, or how many of his customers have the middle initial M. More
practically, he can build mailing lists based on all that data - and keep
track of who comes back.
Bar codes and other tracking mechanisms have become one of the most
powerful forces in automating and analyzing product inventory and sales
the last three decades. Now, in a trend that alarms privacy advocates, the
approach is being applied to people through the simple driver's license,
carried by more than 90 percent of American adults.
Already, about 40 states issue driver's licenses with bar codes or
magnetic stripes that carry standardized data, and most of the others plan
to issue them within the next few years.
Scanners that can read the licenses are slowly proliferating across the
country. So far the machines have been most popular with bars and
convenience stores, which use them to thwart underage purchasers of alcohol
In response to the terrorist attacks last year, scanners are now also
being installed as security devices in airports, hospitals and government
buildings. Many other businesses - drugstores and other stores, car- rental
agencies and casinos among them - are expressing interest in the
The devices have already proved useful for law enforcement. Police
departments have called bars to see if certain names and Social Security
numbers show up on their customer lists.
The electronic trails created by scanning driver's licenses are raising
concerns among privacy advocates. Standards and scanning, they say, are
dangerous combination that essentially creates a de facto national identity
card or internal passport that can be registered in many databases.
"Function creep is a primary rule of databases and identifiers," said
Barry Steinhardt, associate director of the American Civil Liberties Union,
citing how the Social Security number, originally meant for old-age
benefits, has become a universal identifier for financial and other
transactions. "History teaches us that even if protections are incorporated
in the first place, they don't stay in place for long."
But companies that market the scanning technology argue that it poses
threat to privacy.
"It's the same information as the front of the license," said Frank
Mandelbaum, chairman and chief executive of Intelli- Check, a manufacturer
of license-scanning equipment based in Woodbury, N.Y. "If I were to go into
a bar and they had a photocopier, they could photocopy the license or they
could write it down. They are not giving us any information that violates
Machine-readable driver's licenses have been introduced over the last
decade under standards set by the American Association of Motor Vehicle
Administrators, an umbrella group of state officials.
Under current standards, the magnetic stripe and bar codes essentially
contain the same information that is on the front of the driver's licenses.
In addition to name, address and birth date, the machine-readable data
includes physical attributes like sex, height, weight, hair color, eye color
and whether corrective lenses are required. Some states that put the
driver's Social Security number on the license also store it on the data
The scanning systems present a challenge to efforts by state and federal
governments to limit the amount of information that can be released by
departments of motor vehicles. In 1994, Congress passed the Driver's Privacy
Protection Act, largely in response to the murder of Rebecca Schaeffer,
actress who was killed in 1989 by an obsessed fan who had found her unlisted
address by using California motor vehicle records.
Before the law was adopted, states were selling driver's license
information to direct marketing companies, charities and political
campaigns. Businesses selling, for example, fitness products and plus-size
clothing were able to focus on customers within a given range of height
While the privacy act staunched the flow of information from state motor
vehicle departments, there are only spotty controls over how businesses
create such databases on their own. In Texas, the driver's licenses can
electronically scanned for age verification, but the information cannot
downloaded from the machine. In New York, businesses are only allowed to
store name, birth date, driver's license ID number and expiration date for
the purpose of age verification. Many states require people to give consent
to be on marketing lists, but businesses generally interpret consent to
not actively removing their names from a list.
When Mr. Barclay, the bar owner, saw a demonstration of Intelli-Check
(news/quote)'s driver's license scanner at a trade show in 1999, he was
surprised. "It had never dawned me that that strip had information on it,"