Alabama ID scanning laws

Is it legal to scan IDs in Alabama?

Yes. Alabama allows ID scanning and expressly requires scanning technology in some settings.

For most bars, restaurants and retailers, Alabama neither requires nor prohibits scanning a driver's license or ID card. A venue may therefore use a scanner as part of its age-verification workflow.

Specialty vape retailers are different. They must use an ABC Board-approved third-party age verification service to scan each customer's driver's license or ID card at the door. Alcohol delivery services must also have ID scanning software, or a Board-approved alternative, available at the point of delivery.

Alabama's encoded-data fraud law targets unauthorized scanning done with intent to commit an unlawful act or defraud, rather than ordinary age verification.

Do you have to check IDs in Alabama, and when?

The answer depends on what is being sold and how the sale happens.

Which IDs provide protection in Alabama?

Alabama does not create an ID-based defense, but it does limit which credentials staff may accept as proof of age.

For alcohol, tobacco, vape and consumable hemp, the accepted list includes:

For ordinary age checks, that list defines what staff may rely on as proof. Specialty vape entry is narrower because the mandatory scan must be of a driver's license or nondriver ID card.

Can you keep data from an ID scan in Alabama?

Yes for ordinary bars, restaurants and stores, with important exceptions for specialty vape and delivery workflows.

Outside specialty vape retailers, Alabama does not set a general scan-specific field list or retention period. Records that combine a customer's name with an ID number still need to be handled under the state's broader data-security rules.

Specialty vape scanning software must keep a record that the scan occurred and its result, but it may not sell or retain the customer's personal data. Alcohol delivery software works differently and must retain the recipient's name, date of birth and signature.

What other Alabama laws reach the data you keep?

Stored ID data already falls under Alabama's breach-notification framework, and a broader privacy act arrives in 2027.

A customer's name stored with a driver's license, state ID, passport or military ID number is sensitive personally identifying information under Alabama's breach law. Businesses holding it must use reasonable security, provide required breach notices and dispose of the records securely when they are no longer being retained.

The Alabama Personal Data Protection Act takes effect May 1, 2027 and generally reaches businesses above its data thresholds, with an exemption for businesses with fewer than 500 employees that do not sell personal data. Where it applies, biometric data used to identify a person is treated as sensitive data.

Does scanning give you a defense if you serve a minor in Alabama?

The scanner itself does not create a defense, but Alabama's Responsible Vendor program can protect the alcohol license in qualifying cases.

Alabama does not provide a general good-faith or scan-based defense to an underage alcohol sale. The tobacco and specialty vape rules likewise make clear that accepting an ID or using the required scanner does not by itself release the permit holder from responsibility.

The meaningful protection is training-based. A qualifying Responsible Vendor can avoid license suspension or revocation for an employee's underage sale when the statutory conditions are met and the employee completed the required training. An electronic ID workflow can help staff perform and document checks consistently, but the statutory protection comes from the Responsible Vendor framework.

Can a customer refuse an ID scan in Alabama?

For ordinary bars, restaurants and stores, Alabama does not create a specific right to refuse a scan or require a manual alternative.

Venue policy therefore governs much of the ordinary workflow, provided any proof of age the venue accepts is one of the qualifying credentials.

Specialty vape retailers are different. The scan is a condition of entry, so a customer who declines the required scan cannot be admitted. Alabama's digital driver's license rules also make clear that presenting the credential on a phone does not consent to access to anything else on the device.