By Justin Seyl, NATMI Certified Director of Safety, 25+ years in CDL compliance.
Here's the short answer: employers don't need a driver's signed permission slip to pull a motor vehicle record straight from a state DMV, as long as the request fits one of the permissible uses written into the Driver's Privacy Protection Act. But the second you route that same record through a consumer reporting agency for employment purposes, a different federal law kicks in, and that one generally requires a standalone disclosure and written authorization before the report is procured. Under 18 U.S.C. 2724(b), a court can award actual damages, but not less than $2,500 in liquidated damages, against someone who knowingly obtains or uses DMV personal information for a purpose the DPPA doesn't permit, so this isn't something to wing.
What Consent Do Employers Need Before Pulling an MVR?
I've built my career on CDL compliance files, and the mistake I see over and over is employers treating "we need an MVR" like it's one simple task instead of two separate legal questions. What does the DPPA let you request? And what does the Fair Credit Reporting Act require you to disclose if a third party is pulling it for you? Mix those up and you've either violated a federal privacy statute or set yourself up for an FCRA lawsuit over a missing disclosure form. MVRs Online built its whole process around keeping those two tracks straight on every file we touch, and the drivers and employers who come to us after a problem almost always waited too long to ask the question before they ordered.
What Does the DPPA Actually Allow Employers to Do?
The Driver's Privacy Protection Act, 18 U.S.C. 2721, starts from a flat prohibition: state DMVs can't hand out personal info from a motor vehicle record to just anyone. Then it carves out a list of permissible uses, and two of them are the whole ballgame for employers.
Subsection (b)(9) lets an employer, or its agent or insurer, get or verify information about a commercial driver's license holder that is required under chapter 313 of title 49. That's the one most freight operations and CDL employers lean on. Subsection (b)(3) covers a broader, non-CDL-specific use: verifying the accuracy of personal info an individual already handed you. If a candidate wrote their license number and address on an application, (b)(3) lets you confirm it matches what the state has on file.
Neither provision requires the driver's handwritten consent as a federal prerequisite, strictly speaking. The catch is "highly restricted personal information", defined in 18 U.S.C. 2725(4) as a photograph or image, Social Security number, and medical or disability information. Under 2721(a)(2), the DPPA blocks release of that category without express consent except for uses under (b)(1), (b)(4), (b)(6) and (b)(9), so (b)(3) doesn't make the list. So here's the honest answer: don't try to parse this distinction yourself case by case. Lean on your state's DMV form and your CRA's intake process, because they're built to handle exactly this line.
Do States Add Their Own MVR Consent Rules?
Yes, and this is where I see employers get tripped up even after they've read the federal statute correctly. The DPPA sets the floor, not the whole fence. States run their own DMV paperwork on top of it, and that paperwork may make you name the specific permissible use you're relying on or include the driver's written permission before the state will release the record.
I've seen this play out differently state to state. Some DMVs want a signed certification form naming the DPPA subsection you're invoking, and requirements beyond that differ. The exact form and process vary by state, so the practical move is simple: pull the current request form from the licensing authority in the state where the driver holds a license, read what it actually asks for, and don't assume the form from one state works in another.
What Does FCRA Require When You Use a Consumer Reporting Agency?
If you're ordering the MVR yourself straight from a state DMV, you're operating under the DPPA alone. If you're going through a consumer reporting agency, which is how many employers get driving records, the Fair Credit Reporting Act layers a separate set of requirements on top, and these aren't optional.
Under 15 U.S.C. 1681b(b)(2)(A), you need a clear and conspicuous written disclosure to the applicant before you procure the report, and that disclosure has to live in a document that consists solely of the disclosure. Notice that word: solely. You can't bury it in the middle of a job application or tuck it into a liability waiver. It has to stand on its own. The same provision requires the applicant's written authorization, which can appear on that same standalone document. One exception matters for trucking: under 1681b(b)(2)(B) and (C), an applicant for a position covered by DOT hours-of-service rules who applies by mail, phone or computer can get notice and give consent orally, in writing or electronically.
Then, before you take any adverse action based in whole or in part on what the report shows (denying the job, pulling an offer, ending employment), 15 U.S.C. 1681b(b)(3)(A) requires you to give the person a copy of the report and a written description of their FCRA rights in the form the CFPB prescribes. Check with your CRA that you're issuing the current version.
What Do FMCSA Rules Require for CDL Holders' Driving Records?
Separate from the DPPA and FCRA, if you're a motor carrier regulated by FMCSA, 49 CFR 391.23 requires a pre-employment inquiry within 30 days of hire to each licensing authority where the driver held a license over the prior three years, pulling that driver's three-year record. It doesn't stop at hiring. 49 CFR 391.25 requires you to pull each driver's MVR again at least once every twelve months, and the rule specifically tells you to give great weight to violations like speeding, reckless driving, and operating under the influence. Both records then have to sit in the driver qualification file under 49 CFR 391.51, which lists the pre-employment MVR and the annual MVR as required documents.
One thing worth flagging if you've been in this business a while: 49 CFR 391.27, the old annual self-certified list of violations, was rescinded by FMCSA effective May 9, 2022, in its final rule at 87 FR 13192. If your safety manual still treats it as an active requirement, that's outdated. The annual MVR pull under 391.25 carries that function on its own now.
If you're staring at a stack of pre-employment and annual MVR requests and you're not sure your consent paperwork lines up with both the DPPA and the state form, that's the moment to stop guessing. Get your request in front of us through MVRs Online's ordering platform before you submit it to the state, and we'll check it against the current requirements for that license's issuing authority.
How MVRs Online Helps You Get This Right
We don't just process MVR orders and move on. When a file lands with us, we check whether the request is actually built to meet DPPA's permissible-use standard, whether the state's own consent form is filled out the way that state's DMV wants it, and whether an FCRA disclosure is needed because the record's flowing through a consumer reporting process. If something's missing (a signature, a standalone disclosure, the right permissible-use code), we flag it before the request goes out, not after a driver or applicant pushes back.
We also help employers raise disputes when a record looks wrong: a violation that belongs to someone else, a reinstated license showing as suspended, a reporting error from the state itself. Corrections are requested at the source, with the licensing authority, not papered over.
FAQ
Does an employer need written consent to order an MVR directly from a state DMV?
Not always under federal law, since the DPPA's permissible uses in 18 U.S.C. 2721(b)(9) and (b)(3) don't themselves require the driver's signature. Most state DMVs require their own consent or certification form anyway, so check the issuing state's current MVR request process before you submit anything.
What's the difference between DPPA consent and FCRA consent?
DPPA governs what a state DMV can release and to whom, under 18 U.S.C. 2721. FCRA governs what happens when a consumer reporting agency pulls the record for employment purposes, generally requiring a standalone written disclosure and written authorization under 15 U.S.C. 1681b(b)(2) before the report is procured.
What is 49 CFR 391.23 and does it change the consent question?
49 CFR 391.23 requires motor carriers to pull a new driver's three-year motor vehicle record within 30 days of hire. It doesn't override DPPA or FCRA consent rules. It sits alongside them, so you still need the right permissible-use basis and, if a CRA is involved, the FCRA disclosure and authorization.
Do employers have to pull MVRs every year, or just at hiring?
Both. 49 CFR 391.25 requires motor carriers to pull each driver's MVR at least once every twelve months on top of the pre-employment check under 391.23, and both copies need to sit in the driver qualification file under 49 CFR 391.51.
Is the old annual violation self-certification form still required?
No. 49 CFR 391.27, which required drivers to self-certify an annual list of violations, was rescinded by FMCSA effective May 9, 2022 (87 FR 13192). The annual MVR pull under 391.25 now covers that purpose on its own.
What happens if an employer skips the FCRA disclosure before pulling an MVR through a CRA?
You're exposed to FCRA liability for failing to meet 15 U.S.C. 1681b(b)(2)'s standalone disclosure and written authorization requirements, separate from any DPPA exposure. Get the disclosure right before you order, because the statute requires it before the report is procured.
Get Your Next MVR Request Checked Before You Submit It
Don't wait until a disputed violation or a missed disclosure lands on your desk to find out your MVR process has a gap. Order your next motor vehicle record check through MVRs Online, and we'll walk the request against the DPPA permissible-use standard, your state's current form, and FCRA if a consumer reporting agency is involved, before it ever reaches a driver's file.
Justin Seyl is a NATMI Certified Director of Safety and NATMI Certified Audit Specialist with more than 25 years in CDL compliance. He has personally overseen the review of over 650,000 citations and directed more than 10,000 Safety Fitness Determination upgrades. He is the founder of CDL Consultants, CDL360 and CDL Manager.
This article is general information, not legal advice.
Sources
- 49 CFR Part 391.23
- 49 CFR Part 391.25
- 49 CFR Part 391.51
- 49 CFR Part 391.27
- 18 U.S.C. 2721, 2724, 2725 (DPPA)
- 15 U.S.C. 1681b (FCRA)