Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Happens When an AI Agent Sees a Driver's License Number?
The number enters the model's context as soon as the form renders, and what happens after that is set by the vendor's retention and review rules rather than by the agent's intent. A license number is also the key to a DMV record, so put a placeholder on the page before any model reads it.
A license number reaches an agent the way any other field does. A person points the agent at a quote form, a rental agreement, an intake page or a background check, and the page draws every field it holds: the number, the birth date beside it and the address above it. The agent reads them because they are rendered, whether or not the task needs them. The screen does not mark which field the task depends on and which field merely sits beside it. The number also does something the other fields do not, because it is the key a state motor vehicle agency uses to find a record, and federal law restricts how that record leaves the agency. A staff member who types the number at a counter hands it to one system at one time; an agent filling the same form reads it, retypes it and writes it into an exchange the vendor may keep, review or export. The outcome for the organization turns on three things a buyer can check, whatever the agent's intent: what the page gave the model, how long the vendor keeps the exchange, and who approved the action the form triggered. The worked case is one license number on an insurance quote form, filled from a photograph of the card.
Key findings
- For a license number on a form to stay out of a model's context, the values on the rendered page would have to be replaced with consistent tokens before any model reads it, so the field the agent works with is LICENSE_001 rather than the number (What Is Render-Layer Tokenization?).
- It would also require a named person approving the submission the form triggers and a record of what the model received from the page, because the number opens a DMV record and the approval is the one point where a person sees the whole run (What Is an Approved Destination for AI Agent Output?).
- The vendor pages reviewed describe session clearing, training opt-outs and tenant boundaries, and none of them says the values on a rendered form are replaced before the model reads them, so the number arrives as text and every retention rule then applies to it as text (Microsoft, Vision, 2026).
- Jumio's privacy notice lists government identifiers "such as driver's license numbers, passport numbers, etc." among the data it processes for identity verification, and it says the company "will permanently destroy such biometric data" derived from images within three years (Jumio, 2026).
- Web agents in a measured evaluation "are prone to inadvertent use of unnecessary sensitive information," which is what a form with a dozen fields invites (Zharmagambetov et al., 2025).
- GPT-4 and ChatGPT "reveal private information in contexts that humans would not" in 39% and 57% of cases in that contextual-integrity test (Mireshghallah et al., 2024).
What does an agent read when a license number renders on a form?
An insurance quote form asks for the vehicle, the coverage limits, the applicant's name, birth date, address and license number, and it asks for a photograph of the card. An agent that fills the form from the photograph reads the number twice, once from the image and once from the text field it just filled, and the page renders back every value it holds. A person typing the same form looks at the number for a second and moves on; the agent carries it into a context that follows the run to the next page, the summary and the transcript.
Most of the work does not need the digits. Pricing a quote needs the vehicle, the coverage and the driving record, and the number is the key that reaches the record when the lookup runs, which happens at submission rather than while the agent compares deductibles. That split is what makes the field a candidate for a placeholder: the agent can compare, calculate and fill with LICENSE_001 on the form, and the real number can resolve at the submission step after a person approves it.
| Field on the quote form | What the quote needs | What the model receives |
|---|---|---|
| Vehicle year, make and model | All of it | The same values |
| Coverage limits | The selected limits | The same values |
| Applicant name and address | The name for the policy, the address for rating | Both, as text |
| Birth date | The date for rating | The date, as text |
| License number | The key for the record lookup at submission | The number, as text, and again from the card image |
| Photograph of the card | The number and the dates printed on it | Every field printed on the card, including the number and the birth date |
A hosted browser changes who owns the machine and not what the page draws, so the reading is the same in a local profile and in a cloud session (Who Controls What an AI Agent Sees in a Hosted or Sandboxed Browser?). What a managed browser adds is a party who can watch the session and end it, which is a control over the run rather than over the values on the page. The field that matters is the one the form renders, and it renders the number whether or not the agent needs it.
Why is a driver's license number a key rather than a label?
The Driver's Privacy Protection Act governs what a state motor vehicle agency may do with the records it holds. The statute says a state DMV "shall not knowingly disclose or otherwise make available to any person or entity" personal information, and it requires "the express consent of the person to whom such information applies" before highly restricted personal information is released (Cornell LII, 2026). It also lists permissible uses, including use "in the normal course of business by a legitimate business or its agents, employees, or contractors," which is the route an insurer takes to the record behind the number (Cornell LII, 2026).
The Act regulates the agency's disclosure, not an agent reading a private form. What it establishes for this page is narrower and still useful: the number is the handle to a record the state holds under conditions, so a copy of the number is a copy of the handle. A team that treats the field as an ordinary string misses what the number opens.
The documented case for collecting it on purpose is identity verification. Jumio's privacy notice lists government identifiers "such as driver's license numbers, passport numbers, etc." among the data it processes, along with "Images of identification documents," and it says the company "will permanently destroy such biometric data" derived from images within three years, a ceiling qualified where a law requires a shorter period or where the customer relationship ends first (Jumio, 2026). A vendor that collects the number on purpose publishes a retention rule for it; a chat assistant that reads the same number from a form publishes a setting.
Nothing about the number's role requires the agent to hold it. The lookup and the verification happen at defined steps, and the reasoning the agent does between them concerns coverage, dates and eligibility. Separating the value the agent uses from the record it points to is the distinction a form does not make (What Is the PII Wall?).
What do the vendors themselves say?
Microsoft's Copilot Vision page says "Copilot can view your screen or mobile camera feed" and that "A transcript of your conversation with Vision is stored in your conversation history," while adding that "No images are retained, transcribed, or logged," a distinction that covers the pixels and leaves the text of the exchange as the part that persists (Microsoft, Vision, 2026).
The Microsoft Edge page describes a work profile that draws on "content from the current webpage" when an organization allows it, and says "Prompts, responses, and files stay within your tenant," a boundary around the account rather than a statement about which values on a page the model read (Microsoft, Edge, 2026). The page adds that "How information is handled can vary by feature."
OpenAI's data controls page separates training from retention: "When Improve the model for everyone is off, your new conversations won't be used to train OpenAI models," and "Turning off Improve the model for everyone does not delete or hide saved chats," which answers the training question and leaves the retention question open (OpenAI, Data controls, 2026). Its Atlas page, for a browser OpenAI discontinued in August 2026 (OpenAI, Retirement, 2026), described agent mode in a logged-in profile that "can use sites you're already signed in to" and that "will pause to ensure you're watching it take actions on specific sensitive sites such as financial institutions," a pause that arrived at the action and not before the page was read (OpenAI, Agent on Atlas, 2026).
Google's Gemini Apps page states that "A subset of chats is reviewed by human reviewers" and advises users not to enter confidential information a reviewer would not want to see, a warning that places the judgment on the person typing rather than on a control over what the page renders (Google, 2026). The same page gives retention as 72 hours for temporary chats, 18 months by default and up to three years for reviewed chats, a schedule that applies to the text and says nothing about the values on the page it came from (Google, 2026).
| Page reviewed | What it states | What it leaves open |
|---|---|---|
| Copilot Vision | Screen and camera view; a transcript in conversation history; no images retained | Whether the text of the exchange holds the number |
| Copilot in Edge at work | Page content when the organization allows it; a tenant boundary | Which values on the page the model read |
| ChatGPT data controls | Training off for workspaces by default; saved chats remain | How long the exchange is kept and who can read it |
| ChatGPT Atlas agent mode (discontinued August 2026) | Logged-in sites; a pause on sensitive sites | What the page showed the model before the pause |
| Gemini Apps | Human review of a subset of chats; 72 hours, 18 months, three years | What a reviewer sees of a form the agent filled |
Who approves an action a filled form triggers?
Approval is the control buyers ask about first, and the record here splits it in two. A model that read a license number has already done the reading when any approval prompt appears. The 2025 AI Agent Index entry for Gemini Enterprise records approval requirements for decision types as "None" found, while users can pause or stop an agent, an approval design that governs the run rather than the reading (AI Agent Index, 2026). A pause lets a person stop an action; it does not return the values the model already holds.
The stronger version of the same control asks a person to watch. OpenAI's Atlas page said agent mode "will pause to ensure you're watching it take actions on specific sensitive sites such as financial institutions," a pause that arrived at the action and not before the page was read (OpenAI, Agent on Atlas, 2026). It is the most direct confirmation described in the pages reviewed, and it still sits after the read.
What the approval covers matters as much as who gives it. A named person approving a submission sees the page, the values and the destination, and the record shows who approved and when. That approval cannot reach back into the context or the transcript, both of which already hold whatever the page gave the model.
Express consent under the Act is a different decision from an agent approval. The Act's consent requirement concerns a disclosure from an agency, while the approval a team writes into a workflow concerns an action taken from a form. A program that needs both should name each one, because a signed consent for a DMV lookup does not record who let an agent submit the quote.
What record does the run leave, and who reads it?
The record a vendor keeps is a record of the conversation, not of the screen. The pages reviewed put a transcript in chat history; Google gives retention as 72 hours for temporary chats, 18 months by default and up to three years for reviewed chats (Google, 2026). A license number read from a form is text by the time it reaches that artifact, which is why training and retention give different answers.
What the record usually omits is the page as the model saw it. A transcript shows the prompt, the answer and the tool calls, and not which fields the page rendered or whether a value was a token (Does the ChatGPT Compliance API Record What the Agent Did in the Browser?). That difference decides what an auditor can answer six months later. That screen record is not unique to these assistants: none of the 86 AI security products reviewed describes recording the rendered screen an agent read, and Copilot Vision, Copilot in Edge and ChatGPT are not among the 86 (How Many AI Security Products Control What an AI Agent Sees?).
A record that answers the question holds four things: the screen with the tokens the model read, the action taken, the name of the person who approved it and the destination where a real value resolved. That record describes the exposure rather than the conversation, so an auditor can compare it against the vendor's retention schedule and see which one is longer.
What does a governed environment change?
A governed environment is a control class that acts where a page is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works on LICENSE_001 on the quote form and on every page after it. Real values resolve only at an approved destination at the moment of an approved action. A named person confirms what is tokenized and approves each submission, and every screen as tokens, every action and every approval lands in a record that exports to the organization's own monitoring. The class is defined by where it sits rather than by a feature list (What Is Render-Layer Tokenization?).
For this page's question it changes three things. The number stops being text in the context, so the transcript, the summary and any file the model writes hold LICENSE_001. The approval moves to the submission, where a person can see the real number and the destination before the quote leaves. The record describes what the model read rather than what it said. None of that depends on the vendor's retention setting, because the value that would have been retained was never on the page.
Masking does not cost the work its accuracy. Replacing identifiers with consistent pseudonyms and restoring them after the model has done its work reduces semantic utility errors by a factor of five compared with baseline techniques (Does Masking Data on Screen Break Browser Agents?). A consistent token is what makes that result possible: the same field carries the same placeholder on every page, so the agent can follow a record across a run without ever holding the value.
Its scope is the rendered page. The terminal, the IDE, the local filesystem, direct API calls and MCP sit outside it, and a license number pasted into a shell is a different control problem with different owners.
What the record shows
Control over a license number begins with what the page gives the model and continues with how long the vendor keeps the exchange. The pages reviewed describe session clearing, training opt-outs, tenant boundaries and human review, and each of them governs a later stage than the read; none of them states that the values on the rendered form were replaced before the model saw them. The Act adds a separate reason the field matters, because the number is the key to a record a state holds and discloses on terms. The practical conclusion is narrow: an agent can fill the form and price the quote from a token, and the real number can resolve at submission for the person who approves it. Run one quote form through the agent with a test license number and read the transcript for the digits; if they appear, the retention schedule is how long they stay.
Methodology and limitations
This page rests on statutory text, three research papers or datasets, and vendor documentation from Microsoft, OpenAI, Google and Jumio, plus existing RedactSure research pages. Vendor pages were read between October 21, 2026 and October 27, 2026, and each Sources line carries the date for its page. Quoted sentences are copied from the pages that state them; the Copilot Vision page is an archived copy from June 25, 2026 because its original address redirects.
No product was tested for this page. Not described in the pages reviewed means the Sources pages do not state the point, not that a vendor cannot do it. Vendor features change and the page carries its date, so a later release is unreviewed until the check above is repeated. RedactSure is deploying now with enterprise and government customers. The example describes a record type, an insurance quote form, not an organization.
Determinations about whether a form, retention period or disclosure meets the Act, a state's implementation of it or a contract belong to counsel, assessors and the organization's own compliance officers. Nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
What happens when an AI agent sees a driver's license number?
It is read into the model's context along with every other field the page draws, and it stays wherever the vendor keeps the exchange. A transcript stored in conversation history is the usual place, and a training setting does not remove it. The number is also the key to a DMV record, so there are two exposures, the read during the run and the retention after it. Both are properties of the screen rather than of the agent's purpose.
Does turning off model training delete the number from the record?
No. Training and retention are separate settings, so a conversation can be excluded from training and still be saved in the account's history. The pages reviewed describe both controls on the same help page, which is why a team that reads only the training toggle can miss the retention one. Treat the toggle as a limit on training, not as a deletion. Ask where the saved copy lives and how long it stays.
Do human reviewers ever read a form an agent filled?
At some vendors, yes. A consumer assistant's page can state that a subset of chats is reviewed by people and advise against entering confidential information a reviewer should not see. A quote form filled during a work task is the kind of text that reaches that queue, and the review can outlast the account setting meant to limit it. The reviewer reads the text, and the text holds the number.
Does the DPPA stop an AI agent from reading a license number?
No. The Act governs what a state motor vehicle agency may disclose and on what terms, and it does not govern a browser agent reading a number from a private form. What it establishes is that the number is the handle to a record the state holds under conditions, which is why the number carries more weight than the other fields on the page. A copy of the number is a copy of the handle, whichever system holds it.
What should a security team ask a vendor about what the model receives from a rendered screen?
Ask for the screen: whether the values on the page are replaced before the model reads it, what the transcript holds after the run, how long the vendor keeps it and who reviews it. Ask who approves the submission the form triggers and where that approval is recorded. A vendor that answers with a training setting has answered a different question. Ask for the answer in writing before a pilot.
Is a license number on a form as sensitive as a Social Security number?
Both should stay out of a model's context, and the practical difference is what each one opens. A Social Security number anchors credit, tax and benefits records; a license number is the key to a state driving record, and the disclosure of that record is restricted by the Driver's Privacy Protection Act. A form that collects both gives an agent two identifiers in one read. Both belong on the placeholder list, and the license number is the one a quote form asks for by default.
How RedactSure Keeps a License Number Off the Quote Form
An agent filling a quote form reads the license number and birth date beside it, and the controls reviewed above govern the action rather than the reading.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent reads the number from the field and from the photograph, and both paths land in a transcript the vendor may keep. Inside the governed environment the field is filled from a store the agent does not read, the model sees LICENSE_001 on the form and on the confirmation page, and the real number reaches the insurer's submission only after a named person approves it.
RedactSure is deploying now with enterprise and government customers. Google's own page states that reviewed chats are retained for up to three years.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A license number on a quote form stays in a vendor transcript long after the quote is priced. Bring a form your team fills and see, with test values, what the model reads, who approves and what the record holds. Book a demo