State guide

California ID scanning law: what BPC 25660 and Civil Code 1798.90.1 say

Last reviewed September 2026

For bars, restaurants and other businesses that scan IDs: what California’s Business and Professions Code § 25660 and Civil Code § 1798.90.1 say about checking IDs and scanned license data.

What the law says

The defense (§ 25660(a), (b)(1))

Section 25660(b)(1) says proof that the licensee, or their employee or agent, “demanded, was shown, and acted in reliance upon bona fide evidence, or utilized a biometric system” is a defense to a criminal prosecution for conduct forbidden by § 25658 (which makes it a misdemeanor to sell, furnish or give alcohol to a person under 21), § 25663 or § 25665, and to license suspension or revocation proceedings based on it.

Under § 25660(a), “bona fide evidence” is a document issued by a federal, state, county or municipal government, or a subdivision or agency of one, including “a valid motor vehicle operator’s license,” that contains the person’s name, date of birth, description and picture; a valid passport issued by the United States or a foreign government; or a valid identification card issued to a member of the Armed Forces that includes a date of birth and picture.

Scans as evidence (§ 25660(b)(3))

Since January 1, 2026, under AB 509, § 25660(b)(3) says the use of age-verification software or a device “that fails to identify a false identification card, shall be considered evidence” in a prosecution or license proceeding, provided the ID is bona fide evidence and “was physically inspected, is seemingly legitimate, and matches the physical appearance of the customer.”

Subdivision (c)(3) defines that use as “scanning the magnetic strip or the barcode” on the ID. ABC’s summary of AB 509 says the bill “simply makes it additional evidence” when a licensee uses such a device or software, provided they “inspected the ID and met the other requirements” of § 25660. How this applies to a particular case is a question for your attorney.

Scanned license data (Civil Code § 1798.90.1)

Section 1798.90.1(a)(1) says a business “may scan or swipe a driver’s license or identification card issued by the Department of Motor Vehicles” for four purposes: to verify age or the authenticity of the card; to comply with a legal requirement to record, retain or transmit the information; to transmit information to a check service company for payment approval; and to collect or disclose personal information that is required for reporting, investigating or preventing fraud, abuse or material misrepresentation.

Subdivision (a)(3) says a business “shall not retain or use any of the information obtained by that electronic means for any purpose other than as provided herein.” Under (c), a violation is a misdemeanor punishable by up to one year in county jail, a fine of up to $10,000, or both. It covers any business scanning a DMV-issued card, not only ABC licensees. Whether a particular use fits a listed purpose is a question for your attorney.

RBS certification (§§ 25680–25686)

Since July 1, 2022, alcohol servers and their managers at on-premises licensees need a Responsible Beverage Service (RBS) certification within 60 calendar days of employment, valid for three years (§ 25680(a), § 25682(a)(2), § 25681(e)). ABC’s regulation counts “checking patron identification” at an on-premises licensee as serving alcoholic beverages (Cal. Code Regs. tit. 4, § 160(b)(17)(A)).

What it means at the counter

A barcode scan reads the data encoded on a card, not the front of the card or the person holding it. The § 25660(b)(3) conditions quoted above, that the ID was physically inspected, is seemingly legitimate and matches the physical appearance of the customer, are about the card itself and the person presenting it.

Where Check ID fits

Check ID reads the barcode on US and Canadian driver’s licenses and ID cards, checks the birth and expiry dates against your rules, and shows a clear result, such as Verified, Underage or Expired ID. Your staff make the call. It can’t tell whether a card is genuine: a well-made fake can carry a valid barcode.

A scan record never keeps the name, date of birth, address, ID number or a picture of the ID. It keeps the result, the age in whole years, the issuing state or country and document type, and when and how the ID was scanned. From version 3.0, it also keeps the REAL ID indicator as the card encodes it. Free and Pro scan history covers 7 days on your device or in your own iCloud, and can be turned off. Check ID for Teams (coming soon) also records the venue, the device and which staff member ran the scan, and keeps records for two years by default.

Repeat-entry alerts use a one-way code made from the ID’s barcode. With Check ID for Teams, a code made from a passport chip also goes to our servers, but a passport scan doesn’t raise a repeat-entry alert at the door. These codes are still derived from personal data. On the device, codes older than 7 days are cleared at the first scan after the app restarts. With Check ID for Teams, our servers delete their copy after the repeat-entry window (4 hours by default). Guest lists hold names your team adds on purpose. Security & data shows what each plan keeps and what our own analytics include. Whether these records fit § 1798.90.1, or a scan counts as evidence under § 25660(b)(3), is a question for your lawyer.

Frequently asked questions

Sources

• Cal. Bus. & Prof. Code § 25658, § 25660 (as amended by AB 509), § 25680, § 25681 and § 25682, retrieved September 2026.
• Cal. Civ. Code § 1798.90.1, retrieved September 2026.
• AB 509 (Stats. 2025, ch. 264), bill text, retrieved September 2026.
• Cal. Code Regs. tit. 4, § 160 (text via Cornell LII), retrieved September 2026.
• California ABC, 2025 Chaptered Legislation, Responsible Beverage Service Training Program and RBS Frequently Asked Questions, retrieved September 2026.
• California DMV, CA DMV Wallet, retrieved September 2026.