15 states make you keep a copy of a tattoo or piercing client's ID. 10 say who may see it, 1 says when to shred it.

In 15 states you can't just check a tattoo or piercing client's photo ID and hand it back. A copy goes into the file with the tattoo consent form, and it stays there as long as the signed form does, 2 years to 7 depending on the state. Georgia, Virginia and South Carolina are the 3 most populous; Kentucky, Oregon, Oklahoma, Utah, Iowa, Nevada, Arkansas, Mississippi, Nebraska, New Hampshire, Rhode Island and Delaware are the rest, and 13 of the 15 rules apply to piercing too, all but Iowa's and South Carolina's. That copy carries a name, a birth date, a home address and a license number, and in the file it sits next to the client's answers to the health questions. So in those 15 states the question is not whether to take it. The question is who may look at it, how long it stays, and what happens to it when you sell the shop.

10 of the 15 say who may see the copy, and 5 never do: Kentucky, Mississippi, Oregon, Rhode Island and Virginia. Oklahoma is the 1 that says when to shred it, 3 years after the work. Here is each rule in its own words, then what the driver's-license scanning laws in 9 states, 5 of them among the 15, say about a phone photo of the card.

This is a plain-language summary, not legal advice. Your local health department has the final word. Ask them, and bring your records.

The 15 states that make you keep the copy, in their own words

The ID post has every state's rule in one table. The 15 that want the copy itself say so plainly. Kentucky lists "Copy of client's government issued photo ID, if applicable" among the record's fields, for tattooing and again for piercing. Virginia's permanent record holds "a copy of the positive identification provided to the tattooer", and the piercing rule says the same of the piercer. Mississippi staples it to the form: "A photocopy of an original government-issued identification containing the date of birth of the client shall be attached to the consent form". Oregon puts it in the client record for tattooing and for piercing. Utah's comes from the criminal statute rather than the health rule: a shop accused of tattooing a minor is not guilty if it "reviews, photocopies, and retains the photocopy of an apparently valid driver license" that said 18 or older. In Utah the copy is the defense.

3 edges are worth knowing. New Hampshire is the only state whose rule names a photograph as a valid copy, and the only one that lets the client say no: keep "a photocopy, photograph, or scan of the identification provided" or, if the client refuses, a signed acknowledgment that their ID was checked. That rule was readopted on 2026-09-21. South Carolina writes the copy as an example, "a means of verification of client's identity, such as a copy of the client's photo identification" (60-111 § 801.B.1), so the copy is the safe reading rather than the only one. And Nevada's state rule wants a copy of every client's ID on the release form, while Las Vegas, which follows the Southern Nevada Health District, photocopies the ID of "patrons who are 21 years of age or younger" and notes the check on the consent form for everyone else.

New Jersey copies the ID for a minor and the parent only (N.J.A.C. 8:27-4.2(c)). Texas, Maine and Missouri write the ID down instead of copying it: Texas records the type of ID shown (25 TAC § 229.406(b)), Maine and Missouri the number. No rule anywhere mentions the back of the card, and none says a word about blacking out the license number or the address on the copy.

Who is allowed to look at the copy

10 of the 15 rules say something about keeping the record closed. 5 say nothing at all: Kentucky, Mississippi, Oregon, Rhode Island and Virginia require the copy and never say who may see it. Where a rule does speak, it mostly says who may not.

Michigan's is the fullest, filed on 2025-09-11. "All paper records must be retained in a locked filing cabinet or a locked room", electronic records are password protected, and access is limited to people at the shop "that need access to the client records in order to carry out the responsibilities of their position", to the health department, and to anyone else the law lets in. Michigan is a check-the-ID state rather than a copy state, so that rule governs the file whether or not a copy is in it.

South Carolina wants a written list. "The facility shall have a written policy designating the persons allowed to access confidential client information", and the records are "readily available to facility staff, as needed, and for Department inspections". Georgia stores the files "in a manner that prohibits access from unauthorized personnel". Arkansas says it in the counter's own terms: keep all records "private from the public and other clients", which is the binder on the counter. Iowa, Utah, Nebraska, Delaware and Oklahoma say the records are confidential and leave it there.

3 states hold the health department to the same secrecy. North Dakota: "The department and the body art establishment shall keep such records confidential". Delaware and Alabama say it in the same words. And Oregon runs the other way, toward the artist: a licensee "is responsible for maintaining and keeping copies of all client records", and a shop that keeps the records for its artists has to hand over copies on request. So in Oregon the guest artist who leaves is entitled to their own clients' files, and in Michigan the artist at the next station is not entitled to yours.

The health inspector can read the file, and 6 states let the inspector copy it

Every rule that keeps a record makes it available to the health department on request. 6 go further and let the health inspector take copies. Texas has you "permit the authorized agent or the health authority at all reasonable times access to and copying of the records". Michigan's local health department "may examine, take photographs, or make copies of the books and records". California, Colorado, Wisconsin and South Carolina say copies or true copies, and South Carolina adds that the inspector's photocopies stay confidential except to verify individuals in an enforcement proceeding. In California, hiding a record is its own violation: it is unlawful to "Conceal records or evidence, or to withhold evidence".

Where the file lives matters too. Georgia keeps records "on premises for a minimum of one year" and wants at least 1 person on site who can open them; Michigan keeps them on the premises for 1 year and Oregon for 90 days. At a convention the copies leave with the inspector: a Nevada booth "must provide copies of all client release forms to the health authority before the end of the event", and in Nevada that release form carries the ID copy.

Can the client refuse the copy, or get one of their own? Only in 3 states

Mostly neither. Michigan is the one state that hands the client a copy of the record itself, "at the time he or she is tattooed". Utah gives a copy of the completed consent form "in a printed or digital format upon a client's request". Alabama, Illinois and North Dakota give the client a copy of what they signed on health or aftercare. No other rule gives a client a right to see or copy their file later, and New Hampshire is the only one that lets the client refuse the copy in the first place.

HIPAA does not change any of that. HIPAA's own definition of who it covers is a health plan, a health care clearinghouse, or "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter". A tattoo or piercing shop is none of the 3 unless it bills a health plan electronically. The confidentiality you owe comes from your state's body-art rule, and California's own rule says so in its way: its medical-information line applies only to information "that is subject to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) or similar state laws".

How long the copy stays: 2 years to 7, and only Oklahoma shreds

No rule sets a separate clock for the copy. In all 15 states it is part of the record, so it is kept exactly as long as the record is, which in the copy states runs from 2 years to 7. 1 row carries a * after the name. That marks a medium-confidence read: New Hampshire's 7-year line sits in the rulemaking section of its statute, next to the spore-test records.

Only Oklahoma's rule says what happens when the clock runs out. Client records are "Retained for three (3) years; and (D) Destroyed by shredding or other appropriate destruction methods after three (3) years". Michigan says records may be destroyed after 3 years and lists how: shredding, incineration, or electronic deletion. New Mexico says the same of a record a shop destroys after 3 years, "shredding or appropriate destruction methods", and neither of those 2 says you must. Everywhere else the body-art rule stops at the number and general business law picks up. California has a business "dispose, or arrange for the disposal, of customer records" it no longer keeps, by shredding or erasing, and Texas puts "a civil penalty in an amount not to exceed $500 for each business record" on a record thrown out any other way. The FTC's guide for small businesses says the same thing without a penalty: "If you don’t have a legitimate business need for sensitive personally identifying information, don’t keep it."

One more thing about the clock. In a state that does not require the copy, a copy that rides inside the signed record is kept as long as the record. Alabama keeps every record and "all materials signed by the client" permanently, so an ID photo an Alabama shop folded into its signed waiver is, on the rule's own words, in the file forever.

If you sell or close the shop

6 state rules say anything about the records at a sale or a closing, and only 1 says what a sold shop does with them. Michigan: a shop that closes "is required to retain records securely for 3 years", and a shop that is sold "shall transfer their records or properly dispose of their records" depending on the terms of the sale. South Carolina makes the closing shop tell the state: the licensee "shall notify the Department in writing of the intent to close and the effective closure date", and within 10 days of closing, where the records will live. Arkansas, Maine, Ohio and Vermont say the records stay available to the state after a change of ownership or a closing (Arkansas § 10.1.9, Ohio 3701-9-04(W)). Iowa, Rhode Island and Nebraska tell the new owner to get a new permit and say nothing about the old owner's files.

A phone photo of the front of the card is not a scan; the barcode reader is

9 states have a law about scanning a driver's license: California, Florida, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Texas and Virginia, and the last 5 of those are copy states too. Those laws are about the barcode on the back of the card, and mostly not about a photograph of the front. New Jersey defines a scan as one that accesses "the barcode or any other machine-readable section of a person’s identification card". Oregon and Florida define a swipe as "passing a driver license or identification card through a device that is capable of deciphering" the magnetic strip or the bar code. Virginia reaches only "the machine-readable zone of a driver's license", Nebraska only the machine-readable information encoded on the card, and Texas the electronically readable information derived from it.

Where those laws reach, they bite. New Jersey lets a business scan to check age and then says "No retail establishment shall retain information obtained pursuant to paragraphs (1) and (2) of subsection b." Oregon, Virginia and Rhode Island say the same about an age check, and Florida too unless the client is told what is kept and consents. In Nebraska, anyone who "compiles, stores, or preserves such information except as authorized in subsection (3) or (4) of this section shall be guilty of a Class IV felony". In Texas a business may read the barcode to verify who someone is, but a business that "compiles or maintains a database of electronically readable information derived from driver’s licenses" commits a Class A misdemeanor. Oregon and Virginia add that "Any waiver of a provision of this section is contrary to public policy and is void and unenforceable", so a consent form cannot sign it away. California's law says "scan or swipe a driver’s license or identification card issued by the Department of Motor Vehicles in any electronic device" and defines neither word, so whether a phone camera is a scan there has no answer in the text.

New Hampshire is the one state where the scanning law reaches a stored photo, and it is also a copy state. Its statute makes it a misdemeanor to "Knowingly scan, record, retain, or store, in any electronic form or format, personal information" from a license unless the Department of Safety authorizes it. The Department's own rule then authorizes a business "to record, store, retain or transmit to another business entity, personal information from a driver license" with the license holder's consent, for a transaction the holder asked for, and adds that information "obtained solely from a source independent from the driver’s license, such as the individual him or herself" is outside the ban altogether. Read together, the body-art rule's refusal option looks like the consent doing the work. That is a reading of 3 texts, and it is a question for the licensing office, the OPLC, before it is a policy.

2 myths fall out of all this. It is not illegal to photograph a driver's license. What California and New Hampshire forbid is a reproduction made "in such a manner that it could be mistaken for a valid license", and 15 states require the copy. And the federal driver's privacy law does not govern the copy in your file. The 9th Circuit held in 2019 that "the DPPA does not apply where the source of personal information is a driver’s license in the possession of its owner", and the 11th Circuit said the same in 2013 about a license swiped at a store counter. That law is written against the DMV, not against you.

Where the photo goes after you take it

Not 1 of the 51 state rules mentions a phone, a camera, the cloud or email. The rules say confidential, locked, password protected, and on the premises; they were written for a drawer. So the practical question is where the photo goes after it is taken, and the phone answers that on its own. Apple: "iCloud Photos keeps every photo and video you take in iCloud", on every device on the account, and a Shared Library can "automatically share content from the camera" with up to 5 other people. Google: "You can automatically save your photos and videos to your Google Account when you turn on backup". An ID photo taken in the camera app is in all of those places before the client is out of the chair, and Michigan's locked cabinet and Georgia's unauthorized personnel are both about exactly that.

Massachusetts writes it as a rule, and it follows the client rather than the shop: its data-security regulation "applies to all persons that own or license personal information about a resident of the Commonwealth", which is a name with a license number, so a New Hampshire or Rhode Island shop holding a copy of a Massachusetts license is inside it. It wants, where feasible, "Encryption of all personal information stored on laptops or other portable devices" and access limited to the people whose job needs it.

With ours, the client photographs their own ID on their own phone, inside the form, and the copy lands inside the signed waiver with the health answers and the signature. It is not in anyone's camera roll, and it stays with the record for as long as the shop is a customer. The 3 questions every rule above asks of that file, who can open it, how long it stays, and what happens to it when the shop changes hands, are the 3 to ask of any place you keep it.

The rules that make you keep the copy are mostly rules about who must not see it. The copy is proof that you looked. The file it sits in is closed to the other clients, open to the inspector, and gone when the rule says gone, and a shop that can say all 3 of those out loud has the answer the copy was for.