State-by-State ID Verification Compliance Requirements (2026)

State-by-State ID Verification Compliance Requirements

If you operate a business that checks IDs whether you’re running a bar, a cannabis dispensary, a convenience store, or an online platform you are dealing with one of the most fragmented compliance landscapes in the U.S. right now. There is no single federal law that governs how businesses verify identity. Instead, you get a patchwork of state mandates, industry-specific rules, and privacy restrictions that often point in different directions.

This guide covers what businesses actually need to know: employment verification, physical ID scanning, age verification, and data privacy rules by state, by industry, and with the 2026 updates included.

Two Separate Compliance Worlds

Before getting into specifics, it helps to understand that “ID verification compliance” covers two distinct legal territories that are often confused:

Employment verification — governed by federal Form I-9 rules and state E-Verify mandates. This applies when you’re hiring.

Customer ID verification — governed by state scanning laws, industry regulations (alcohol, tobacco, cannabis, gaming), and privacy statutes. This applies when you’re selling.

Both matter. Both have penalties. And the rules for each vary dramatically by state.

Employment Verification: E-Verify and Form I-9

Every U.S. employer must complete Form I-9 for every new hire — no exceptions. The form requires employees to present identity and work authorization documents within three business days of their start date. That part is federal and uniform.

E-Verify is different. It’s a web-based DHS system that cross-checks I-9 data against federal records. At the federal level, E-Verify is voluntary for most private employers unless you hold a federal contract with FAR clause 52.222–54, in which case enrollment is mandatory.

Where it gets complicated is at the state level.

States That Require E-Verify for All or Most Private Employers

As of 2026, eleven states mandate E-Verify for most or all private employers: Alabama, Arizona, Florida, Georgia, Mississippi, Missouri, North Carolina, South Carolina, Tennessee, Utah, and Virginia. Penalties in these states are serious Arizona will permanently revoke a business license for repeat violations, and North Carolina can impose civil fines exceeding $10,000 per infraction.

• Mississippi requires proof of E-Verify enrollment to obtain a business license.
• South Carolina mandates E-Verify for all employers.
• North Carolina applies to private employers with 25 or more employees (a pending bill, HB 1214 from May 2026, would lower that threshold to 5 employees and add audit authority).
• Utah requires it for employers with 150 or more employees, plus all public employers and contractors.

States That Require E-Verify Only for Public Contractors

Many states stop short of a full private employer mandate but still require E-Verify for anyone doing business with the state. These include Colorado, Idaho, Indiana, Iowa, Minnesota, Nebraska, Oklahoma, Pennsylvania, and Texas, among others.

Indiana passed the FAIRNESS Act (SEA 76) in March 2026, effective July 1, 2026. It doesn’t mandate E-Verify outright but creates a safe harbor for employers who use it meaning E-Verify adoption is effectively the only reliable defense against a violation claim.

Ohio added a new requirement effective March 2026: E-Verify is now required for all nonresidential construction contractors.

States That Restrict E-Verify Use

California is the notable outlier. Under Assembly Bill 1236, state and local governments are prohibited from requiring private businesses to use E-Verify. Employers who voluntarily use it must apply it to all new hires consistently misuse carries penalties up to $10,000 per violation.

Illinois allows voluntary use but requires employer training, workplace posters, and strict procedural compliance. It also prohibits using E-Verify as a pre-screening tool during recruitment.

New York City’s 2026 proposal (Int. 0210–2026) would prohibit E-Verify use before a conditional job offer and restrict reverification practices.

Multi-State Employers

If you operate across state lines, the cleanest approach is to enroll nationally in E-Verify and apply it consistently to all new hires. This avoids having to track which state’s rule applies to which location. The system is free, enrollment takes minutes, and consistent use is the strongest protection against audit exposure. Federal enforcement expanded in 2025 USCIS special agents now have direct authority to investigate employers without referral to ICE, which has accelerated audit timelines considerably.

Record retention is also a real requirement: most states mandate keeping E-Verify case numbers and results for at least three years.

Customer ID Verification: Physical Scanning Laws

When it comes to checking customer IDs, the compliance picture shifts from employment law to a mix of industry regulations and state privacy statutes.

The baseline across most states: businesses are permitted to scan government-issued IDs for age verification. What varies is what you can do with that data afterward.

The One State Where Scanning Is Prohibited

New Hampshire stands alone it is the only state where scanning a customer’s ID is prohibited for any purpose. Businesses there must rely on visual inspection only.

States With Affirmative Defense Provisions

Several states offer a legal benefit to businesses that use electronic ID scanning: if a scanner confirms an ID as valid and the customer turns out to be underage anyway, the business may be shielded from liability. This “affirmative defense” protection exists in states including Texas, Florida, and others with alcohol compliance frameworks that recognize electronic verification as evidence of due diligence.

Texas enacted Senate Bill 650 (the Deshawn Jagwan Act), which specifically requires the use of electronically readable information to verify purchaser age in retail alcohol sales — making electronic scanning not just a protection but a legal requirement for that industry.

Utah implemented the most significant alcohol compliance change of 2026: a 100% ID law effective January 1, 2026, requiring ID checks for every alcohol purchase regardless of the buyer’s apparent age. Whether the customer is 21 or 75, they present an ID. Bars are now required to use electronic scanning, and the permissible data display is restricted — scanners can only show staff the minimum fields needed for verification.

Cannabis: Strict by Default

Cannabis dispensaries operate under some of the tightest ID verification requirements in any retail sector. Nevada’s Cannabis Compliance Board makes electronic scanning the standard method. Most legal cannabis states require age verification at point of sale (21+) and maintain audit trail documentation that ties each transaction to an ID verification event.

The 2026 compliance pressure for cannabis retailers specifically is retention: keeping ID scan records long enough to survive a regulatory audit, but not so long that state privacy laws create exposure. Data minimization is now a live compliance issue, not just a best practice.

What Businesses Cannot Do With Scanned Data

This is where most businesses get into trouble not in the scanning itself, but in what they do with the data afterward.

California (CCPA): Businesses cannot use scanned ID data for advertising or sell it to third parties. Strict purpose limitation applies.

New York: Prohibits swiping or scanning an ID unless for a legally defined purpose, and restricts storage and resale of that information.

Washington: Personal information from a scanned ID cannot be stored unless authorized by law or with documented consumer consent, and only for the stated purpose at collection.

The general rule across most states: collect what you need, use it for the purpose you collected it for, retain it only as long as legally required, then delete it. Selling or sharing scanned ID data for marketing is legally risky in most states and prohibited in several.

Online Age Verification: The Fastest-Moving Area

This is where compliance requirements have expanded most aggressively. Between 2022 and 2026, more than 25 states enacted laws requiring age verification for adult content sites or social media platforms. What started with Louisiana in 2022 is now a broad national trend.

The U.S. Supreme Court’s 2025 decision in Free Speech Coalition v. Paxton upheld Texas’s age verification statute (H.B. 1181), which requires websites with substantial sexually explicit content to verify user age before granting access. That ruling cleared a constitutional path for similar laws in other states, and the 2026 legislative session has seen a wave of new mandates.

States with active online age verification requirements as of mid-2026 include Louisiana, Texas, Utah, Montana, Arkansas, Mississippi, Virginia, North Carolina, Kansas, Kentucky, Indiana, Idaho, Oklahoma, Nebraska, South Dakota, Arizona, and others. California’s SB 976 requires compliance by December 31, 2026.

For businesses operating in this space, compliance is not just about age gating it’s about how you verify. Most laws accept government-issued ID verification, transactional data (credit card history, public records), or third-party verification services. The catch: collecting biometric data for verification triggers a separate layer of state privacy law.

Biometric Verification and State Privacy Laws

If your age verification method involves a face scan or biometric estimation:

Illinois BIPA (Biometric Information Privacy Act) requires prior written consent and a publicly posted data retention schedule before any biometric data is collected. Liability follows possession — if your vendor scans and stores the data, you are still potentially liable.

Texas CUBI (Business and Commerce Code § 503.001) prohibits capturing biometric identifiers for commercial purposes without informing the individual and obtaining consent. Penalties reach $10,000 per day of non-compliance, up to $250,000 if a minor accesses harmful content as a result.

Washington MHMDA (My Health My Data Act) makes violations a per se breach of the Washington Consumer Protection Act — opening the door to treble damages up to $25,000 per plaintiff and attorneys’ fees.

The practical takeaway: if you’re using a third-party verification vendor that does facial estimation, your vendor contract needs to explicitly prohibit data resale and restrict third-party disclosure. The liability for what your vendor does with the data does not automatically stay with them.

Federal Tobacco 21 (T21)

One area where the federal standard is actually uniform: tobacco and vapor products. The Tobacco 21 law, passed in December 2019, raised the minimum purchase age to 21 nationwide. There are no state exemptions, no grandfathering, and no wiggle room. The FDA enforces it at retail locations directly.

The practical effect is that tobacco, vapor, and alcohol now share the same age threshold in most contexts 21 which simplifies training for retail staff. Anyone under 21 cannot legally purchase any of them, full stop.

What Compliance Actually Looks Like in Practice

Running through the legal landscape is useful, but enforcement happens at the transaction level. These are the things regulators and auditors actually look for:

Consistency is the most common compliance failure. Businesses that use E-Verify for some hires but not others, or scan IDs at some transactions but not others, expose themselves immediately. Selective application is treated as evidence of discriminatory or negligent practice.

Documentation survives audits. If you verify an ID and it turns out to be fraudulent, your defense lives entirely in your records — what your scanner logged, what your staff was trained to do, and whether you followed your own documented procedures.

Data minimization is increasingly scrutinized. Storing more ID data than you need, for longer than you need it, is a liability in states with active privacy enforcement. Build your retention schedule before regulators ask about it.

Vendor accountability is underappreciated. If you outsource identity verification — whether for hiring or age gating — your compliance obligations do not transfer. Review vendor contracts for data handling terms, audit rights, and breach notification timelines.

Key Resources

• DHS E-Verify official system and state requirement maps
• USCIS Form I-9 instructions and updates
• FTC guidance on consumer data and business compliance

State requirements update frequently — particularly E-Verify legislation, which has been active in multiple state legislatures throughout 2025 and 2026. Any compliance program should be reviewed by legal counsel familiar with the states where you operate, and updated at minimum annually.