Last Updated on September 8, 2026 by Craig Allen Keefner
New TIG Intelligence report examines 26 ID-scanning and identity-verification vendors, data-retention practices, breach exposure and what kiosk deployers should be asking before the next ID is scanned.
You can purchase report for $99. 32 pages 2026. Member get free.
The most important question about an ID scanner may no longer be whether it can detect a fake driver’s license.
It may be:
What happens to the driver’s license after the scan is complete?
That question moved rapidly to the foreground following the reported exposure of more than 153 million U.S. and Canadian driver’s licenses tied to IDScan.net. The data reportedly offered for sale went well beyond extracted name, address and date-of-birth fields. Each record included six document images—front and back under visible, infrared and ultraviolet light—along with timestamps.
For the kiosk and self-service industry, however, the bigger issue isn’t one vendor.
It’s architecture.
The scan doesn’t have to become a permanent record
ID scanning now sits underneath a growing number of self-service applications: age verification, visitor management, patient check-in, hospitality, car rental, casino and gaming applications, retail, transportation and unattended access.
In some systems, document processing occurs locally. In others, images are sent to customer-controlled infrastructure. Cloud identity-verification platforms, meanwhile, may send the document to vendor-controlled systems by design.
And sometimes retention is simply a configuration choice.
The new TIG Insights & Intelligence — ID Scanning and Identity Verification in Self-Service report examines that distinction across 26 vendors and four architecture tiers, covering North America, Europe and APAC.
The four tiers are:
- Edge reader hardware — document readers and scanners where storage is determined primarily by the integrator.
- On-premises plus cloud systems sold to venues — where the image may reside in the vendor cloud, venue storage or nowhere depending upon configuration.
- Cloud IDV APIs and platforms — verification services where images generally reach vendor-controlled cloud infrastructure.
- Check-in and visitor platforms — applications in which ID capture is one part of a broader visitor, patient or customer workflow.
That distinction matters because the report finds that where the document image can ultimately reside may be a better predictor of potential mass-exposure consequences than company size or the number of security certifications a vendor holds.
Retention is the issue hiding in plain sight
One of the report’s central findings is that retaining an ID image is not necessarily a technical requirement of identity verification.
According to documentation reviewed for the report, IDScan.net’s default for new customers was to retain records in its cloud. Its Basic plan had a purge setting that could not be changed from “Do not delete.” Yet the company also offered a fully tokenized mode capable of saving zero information from each scan.
The zero-retention capability existed. The default did not use it.
Other vendors take different approaches.
Within the same architecture tier, TIG found systems that state the station stores nothing and sends the record to customer-controlled storage; systems offering on-device modes where PII does not leave the device; jurisdiction-specific retention schedules; and systems capable of zero retention while defaulting to retention.
That makes retention a procurement and product-management decision, not simply a cybersecurity issue.
Certification isn’t the same as data minimization
Another important distinction is between security certification and retention discipline.
IDScan.net held ISO/IEC 27001:2022 and SOC 2 Type 2. Across the 26 vendors examined, TIG found certification density correlated more closely with company size and sales channel than with retention practices. Ten of the 26 vendors reviewed published no ID-image retention information, while only eight published a concrete default retention period.
SOC 2 and ISO 27001 remain important.
But they don’t answer a very basic kiosk procurement question:
Why are we storing this image in the first place?
The kiosk integrator can’t ignore the issue
The situation becomes especially interesting at the hardware level.
For many edge ID readers, there is no inherent vendor-hosted image repository. The reader captures the document and passes the resulting data or image downstream.
That shifts the responsibility.
As the report puts it:
“The reader is not the risk — the integrator is.”
When a kiosk OEM specifies a reader, the data-governance obligation can effectively move to whoever develops the host application. TIG found that five of seven Tier 1 vendors publish nothing about image retention—which may be entirely appropriate for a component whose storage behavior is determined downstream.
The problem occurs when nobody explicitly owns that downstream decision.
Eight questions for the next ID-scanning RFP
The practical implication for kiosk manufacturers, integrators and deployers is straightforward.
An RFP should no longer stop at document authentication accuracy, supported IDs, barcode parsing, UV/IR capability, facial matching and transaction speed.
Data lifecycle belongs in the specification too.
Buyers should establish, in writing:
Where does the complete ID image go? Who controls the storage? Is anything retained by default? What is the default retention period? Can retention be set to zero? Is zero retention available on every subscription tier? Who is responsible for deletion? What happens to backups, derived biometric information and associated metadata?
The full report includes an eight-question procurement screen, along with an unattended-terminal addendum.
TIG Intel Insight: The scan is not a record
The underlying lesson may be surprisingly simple.
A driver’s license presented to a kiosk is an input to a transaction. It does not automatically need to become a permanent database record.
There are legitimate reasons for retaining information—fraud investigation, audit requirements, flagged-patron systems, repeat-visit recognition and regulatory obligations among them.
But retention should be an explicit decision with an identified purpose, owner and deletion policy.
As the TIG report concludes:
“A kiosk that verifies an ID and keeps nothing cannot become the source of a 153-million-record listing.”
