How Long Should a Hotel Keep a Guest ID Scan? CCPA, CPRA and the New State Laws

A guest hands over a driver's license at 11 p.m. The agent scans it, the image lands in the property management system, and the guest heads upstairs. Then nothing happens. In a lot of hotels, that scan simply stays there for years.

In 2026, that default is a liability. California's updated CCPA regulations took effect on January 1, three more state privacy laws went live on the same day, and two more states have signed laws that start in 2027. All of them push in the same direction: keep personal data only as long as you need it, and be ready to explain why.

This guide answers how long a US hotel should keep a guest ID scan, separates what the law requires you to keep from what you are simply holding out of habit, and gives you a retention schedule you can take to counsel.

Short answer: No federal law sets a single retention period for guest ID scans. Keep the guest register data your state or city requires (in the examples below, anywhere from 90 days to 3 years), keep folios and registration cards for your state's tax audit period, and keep the full ID image only as long as a documented purpose needs it. For most hotels, that means checkout plus a short dispute window. Publish the period in your privacy notice and delete on schedule.

Why guest ID retention matters more in 2026

Three things changed at once.

First, California raised the bar. The California Privacy Protection Agency's updated CCPA regulations were approved in September 2025 and took effect on January 1, 2026. They require documented risk assessments for processing sensitive personal information, which includes driver's license and passport numbers. For processing that was already underway before 2026, the assessment must be done by December 31, 2027, and the first attestations are due to the agency by April 1, 2028. Larger businesses also face annual cybersecurity audits, phased in by revenue, with the first submissions due in 2028.

Second, the state map filled in. Indiana, Kentucky and Rhode Island switched on their laws on January 1, 2026, which brings the count of states with comprehensive privacy laws to 20 (counting Florida's narrower statute). Oklahoma signed its law in March 2026, effective January 1, 2027, and Alabama followed in April 2026 with a law that starts May 1, 2027.

Third, enforcement got real. State regulators have moved from warning letters to paid settlements, and several states have let their "cure periods" expire. Those periods used to give businesses time to fix a problem before penalties applied. That buffer is disappearing.

For hotels, the practical result is simple. An archive of ID images from past stays is now a line item of risk with no matching benefit.

What is actually inside a guest ID scan

A scan is not one piece of data. It is a bundle, and each part carries a different level of risk.

• Identity basics: full name, date of birth and home address.
• Document identifiers: driver's license or passport number, expiry date, issuing state or country.
• The photo printed on the document.
• Nationality, and for visa holders, immigration details.
• Barcode or MRZ data. The barcode on the back of a US license can include physical descriptors such as height and eye color.
• A biometric template, if your kiosk or tablet matches the guest's face against the ID photo.

Most hotels need only a small slice of this. A register law may ask for a name and address. Fraud prevention may need the document number for a limited time. Almost nobody needs the guest's eye color. Good retention starts with knowing which fields you capture and why.

What US law requires hotels to keep

Guest register laws

Many states, and some cities, require lodging businesses to keep a guest register. The rules vary widely:

• Maine requires the register and a record of departures to be kept for two years and made available to the licensing authority. Innkeepers may ask guests for a driver's license or other ID showing name and residence.
• Pennsylvania requires a register showing each guest's name, residence and dates of arrival and departure for three years, and lets the hotel require valid identification at registration.
• Florida requires a chronological guest register. The state licensing division says it must be available for inspection for two years.
• Los Angeles requires hotels to keep a guest record on the premises for 90 days, and sets out specific fields for guests who check in at an electronic kiosk.

Notice what these laws ask for: facts about the stay, such as a name, a residence and the dates. Few of them require you to keep a picture of the ID itself. That distinction drives the whole retention schedule below.

It is also worth knowing that in City of Los Angeles v. Patel (2015), the US Supreme Court struck down a rule that let police inspect hotel registers on demand without a chance for review. The Court left the record-keeping duty itself in place. You still have to keep the register. You just are not required to hand it over without proper process.

Tax and folio records

Occupancy tax audits create a separate clock. The Texas Hotel & Lodging Association, for example, lists registration cards and folios among the records Texas hotels should keep for four years for state and local hotel tax purposes. Your state's period may differ, so confirm it with your accountant. Again, this covers the billing record, not a stored image of the guest's license.

Card disputes

A signed registration card and a verified ID help you win a chargeback. Card network dispute windows commonly run around 120 days from the transaction. That is a sound reason to keep verification evidence for a few months after checkout. It is not a reason to keep it for five years.

What CCPA and CPRA say about retention

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), is the strictest general framework most US hotel groups deal with. Five points matter for ID scans.

1. You must disclose retention periods. At or before the point of collection, a covered business must tell consumers how long it plans to keep each category of personal information, or the criteria it uses to decide. It may not keep that information longer than is reasonably necessary for the purpose it disclosed. "We keep it indefinitely" does not meet that standard.

2. ID numbers are sensitive personal information. The CPRA added a category called sensitive personal information. It expressly includes driver's license, state ID card and passport numbers, along with biometric data used to identify a person. That puts most guest ID scans in the highest-risk bucket under California law.

3. Risk assessments now apply. Under the regulations that took effect in 2026, processing sensitive personal information is one of the activities that triggers a formal risk assessment. If your hotels scan California guests' IDs, expect this to apply to you. The assessment has to weigh the privacy risk against the benefit, which is hard to do honestly for an ID image kept years after checkout.

4. Breach exposure is personal. The CCPA gives consumers a private right of action when certain unencrypted data, including driver's license and passport numbers, is stolen because a business failed to maintain reasonable security. Statutory damages start at $100 and go up to $750 per consumer per incident, before inflation adjustments. Multiply that by every guest in an old image archive and the math becomes obvious.

5. California limits what you can do with scanned licenses. Separate from the CCPA, California Civil Code section 1798.90.1 says a business may scan or swipe a DMV-issued driver's license or ID card only for listed purposes, such as verifying age or the document's authenticity, complying with a legal duty to record, retain or transmit the information, and preventing fraud. The business may not retain or use that information for any other purpose, and a violation is a misdemeanor. Feeding scanned license data into marketing lists is off the table.

The CCPA applies to for-profit businesses that do business in California and meet at least one threshold, the best known being annual gross revenue above $25 million (adjusted for inflation). Many hotel management companies and brands clear that bar. Smaller independent owners may not, but Civil Code 1798.90.1, the breach rules and other states' laws can still apply.

The other state privacy laws hotels should watch

As of 2026, comprehensive privacy laws are in effect in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. Oklahoma and Alabama join in 2027.

Most follow a similar model, and three features matter for ID data.

Data minimization. Most of these laws limit collection to what is adequate, relevant and reasonably necessary for the purpose you disclosed. Maryland goes further than any other state: its law restricts collecting or processing sensitive data unless it is strictly necessary to provide or maintain a product or service the consumer asked for.

Sensitive data. Most state laws treat citizenship or immigration status, and biometric data used for identification, as sensitive. A passport or visa scan can reveal citizenship status. A face match creates biometric data. Processing sensitive data generally requires consent unless an exemption applies. Most laws exempt processing needed to comply with a legal obligation or to prevent fraud, which covers a legitimate register or an ID authenticity check. The exemption covers that purpose. It does not cover keeping the scan forever.

Biometric rules with fixed deadlines. If your kiosk matches faces to ID photos, specific biometric laws may set hard limits:

• Illinois (BIPA) requires written consent, a public retention schedule, and destruction once the purpose is satisfied or within three years of the person's last interaction, whichever comes first. It also allows private lawsuits.
• Colorado added biometric rules to its privacy law effective July 1, 2025. They apply to any business that collects biometric identifiers, regardless of the law's usual size thresholds. Businesses need a written policy and must delete biometric identifiers at the earliest of three points: when the original purpose is satisfied, 24 months after the person's last interaction, or within 45 days of deciding the data is no longer necessary.
• Texas requires destruction of biometric identifiers within a reasonable time, and no later than one year after the purpose for collecting them expires.

The safest design is not to store face templates at all. Match, record the result and discard the template.

A sample retention schedule for guest ID data

Use this as a starting point for a conversation with your counsel. Periods depend on your states, your cities and your own legal holds.

How to put the schedule into practice

A policy that lives in a binder does nothing. These are the steps that make it real.

• Automate deletion. Set purge rules in your ID scanning software and PMS so data expires without anyone remembering to delete it.
• Store the image apart from the register fields. If the ID image and the register entry are separate records, you can purge the image at 90 days and keep the register for the full statutory period.
• Mask document numbers. Show agents only the last few characters. Limit full views to managers, and log the reason for each view.
• Shut down side channels. Photocopies in a drawer, ID photos emailed to the night auditor, pictures on an agent's personal phone and scans saved to a shared drive all defeat your schedule. Train for this and check for it.
• Update your privacy notice. List the categories of ID data you collect, why, and how long you keep each one. Under the CCPA, this is required.
• Handle deletion requests properly. You can decline to delete data a law requires you to keep, such as the register. You should still delete what you are not required to keep, such as the ID image, and tell the guest what remains and why.
• Tighten vendor contracts. Your ID scanning, kiosk and PMS providers should be bound by service provider terms that limit their use of guest data and support your retention rules.
• Document your risk assessment. If you process California guests' ID numbers, write down the purpose, the risks, the safeguards and the retention period. That document is your evidence.
• Test it. Pick a guest who stayed 18 months ago and see what your systems still hold. The answer is often surprising.

How Samsotech supports compliant ID retention

Samsotech's passport and ID scanners read driver's licenses, passports and ID cards into structured fields, so your team works with the data points a register actually needs instead of loose images. The VICAS Hospitality platform and our paperless registration cards replace printed forms and photocopies, which removes the side channels that break most retention policies.

Every Samsotech deployment is configured to local data privacy and ID retention requirements, and the same approach carries through contactless check-in, self-service kiosks and document authentication with eValidate. If you are building a retention schedule across several US properties, talk to our team about how purge rules and field-level controls can be set per state.

For more on the operational side, read How Hotels Can Stay Compliant Without Slowing Down and The Hidden Risks of Manual ID Verification in 2026.
 

Frequently asked questions

Is it legal for a US hotel to scan a guest's ID?

Generally, yes. Several states expressly allow hotels to require identification at registration, including Maine and Pennsylvania. In California, electronic scanning of a DMV-issued license or ID card is limited to the purposes listed in Civil Code 1798.90.1, such as verifying authenticity, meeting a legal record-keeping duty and preventing fraud. Tell guests why you scan and how long you keep the data.

How long can a hotel keep a copy of a guest's driver's license?

Only as long as a documented purpose requires it. Register laws usually require facts about the stay, not the image. For most hotels, keeping the image for checkout plus a short dispute window, often 30 to 120 days, and then purging it is easier to defend than open-ended storage.

Can we use ID scan data for marketing or loyalty enrollment?

In California, data from a scanned DMV license cannot be used for purposes outside the list in Civil Code 1798.90.1, and marketing is not on it. In other states, reusing ID data for a new purpose conflicts with purpose limitation rules and would need fresh notice or consent. Collect marketing data separately and with the guest's agreement.

What should we do if a guest asks us to delete their ID scan?

Delete what you are not legally required to keep, such as the ID image, and keep what a law requires, such as register entries or tax records. Tell the guest what you kept and which law requires it. Record the request and your response.

Are the rules different for international guests' passports?

The US has no general federal rule requiring hotels to record or report foreign guests' passport details, unlike many countries in Europe and the Middle East. Passport numbers are sensitive personal information under the CCPA, and citizenship or immigration status is sensitive data under most state privacy laws, so passport scans deserve the same short retention and tight access as license scans.

Does the CCPA apply to a franchised hotel?

It applies to each business that meets the CCPA thresholds and decides how personal information is used. Franchisees, management companies and brands can each have obligations depending on who collects and controls the data. Map the data flow and assign responsibility in your agreements.

NOTE: This article is general information, not legal advice. Retention periods depend on your states, cities and specific circumstances. Confirm your schedule with qualified counsel.

Sources and further reading

• California Privacy Protection Agency: CCPA regulation updates (effective January 1, 2026)
• California Civil Code section 1798.90.1 (driver's license scanning)
• Maine Revised Statutes Title 30-A, section 3821 (guest register)
• Pennsylvania 48 Pa.C.S. section 1311 (guest register)
• Los Angeles Municipal Code section 41.49 (hotel registers)
• Colorado HB24-1130 (biometric identifiers)
• Oklahoma SB 546 signing announcement