Okay, I have to say this one plainly: I, like a lot of you, have had my own data breached and sold off to data brokers before. And I never once got a notification telling me it happened. I found out the way most people find out, secondhand, piecing it together after the fact. For a long time I assumed that was just how these things worked, that companies quietly lose your data and you're just supposed to find out eventually or not at all.

So when the IDScan story broke this week, I went looking for the actual reason that keeps happening, and it's not what I expected.

Here's the news part first. IDScan, a Louisiana-based ID-verification vendor used by everything from entertainment venues to cannabis dispensaries to check customers' identity documents, disclosed on September 4 that it had detected unauthorized access to its systems around September 1[1]. It confirmed the breach involved more than 150 million driver's licenses and other government-issued IDs, full names, license numbers, passport numbers, stolen from a company most of the people affected had never directly interacted with or even heard of[1]. Brian Krebs first reported it after a dark-web platform started advertising access to over 153 million stolen US and Canadian driver's license scans. The FBI is investigating. Nine class-action lawsuits have already been filed[3].

That detail, that most affected people never had a direct relationship with IDScan, is actually the whole story. You didn't sign up for their service. Some business you used, a venue, a store, a landlord, ran your ID through them to verify you, and that's how your data ended up sitting in a vendor's cloud you never chose and never agreed to. There's no company you can point to and say "I trusted you with this," because you didn't, not knowingly.

So back to why I never got notified about my own breach. It turns out all 50 US states have data breach notification laws, but they are genuinely not the same law copy-pasted fifty times. Foley & Lardner's own legal analysis is blunt about it, a one-size-fits-all approach to notification will not work, because states differ on what triggers a legal breach in the first place, what has to be in the notice, how fast it has to go out, and what penalties apply if a company blows the deadline or skips it entirely[2]. So whether you get told your ID or your data was compromised depends less on what actually happened to your information and more on which state's notification law happened to apply to the company that lost it.

That's the part that actually bothers me. The harm to you is the same regardless of your zip code. The chance you find out about it isn't.

If you want to know exactly what your own state actually requires, whether a company even has to tell you when your data gets breached, and how fast, I built that straight into the state-by-state Digital Rights Atlas.

Check your state at rowataha.com/usa-rights.html.