AB 509: When an ID Scanner Misses a Fake, What Counts as Evidence

Updated November 8, 2026. This article was first written in mid-October 2025, shortly after Governor Newsom signed AB 509 and before it took effect on January 1, 2026. It describes the law as enacted then. Later developments are kept separate in the “Current context” section near the end. It is general information, not legal advice.

The scanner beeped green. Now what?

Picture a Friday night at a busy door. A guest hands over a California driver’s license. The door host scans the barcode, the device shows a birthdate that makes the guest 23, and the host waves them in. Two weeks later, an ABC agent explains that the license was fake and the guest was 19.

Until now, the scan itself had no special status in California law. The licensee’s protection came from a different source: proof that staff demanded, were shown, and acted in reliance on bona fide evidence of age and identity. Assembly Bill 509 adds something new to that picture. Starting January 1, 2026, using an active ID scanner that fails to catch a fake can be considered evidence on the licensee’s behalf, but only when staff also did the old-fashioned work of looking at the card and the person.

AB 509 (Flora, Chapter 264, Statutes of 2025) was approved by the Governor and filed with the Secretary of State on October 3, 2025. It amends Business and Professions Code section 25660.

The existing defense, briefly

Section 25660(a) defines bona fide evidence of majority and identity. It includes:

• a document issued by a federal, state, county, or municipal government or agency, such as a valid driver’s license, that contains the person’s name, date of birth, description, and picture;
• a valid passport issued by the United States or a foreign government; and
• a valid identification card issued to a member of the Armed Forces that includes a date of birth and a picture.

Section 25660(b)(1) provides that proof the licensee, or an employee or agent, “demanded, was shown, and acted in reliance upon bona fide evidence,” or used a qualifying biometric system, is a defense to criminal prosecution and to suspension or revocation proceedings based on sales to, or certain other dealings with, a person under 21. Paragraph (2) requires that a biometric system be based on a review of bona fide evidence and verify and authenticate that evidence.

Those paragraphs did not change. AB 509 adds a new paragraph (3).

What AB 509 adds

The new section 25660(b)(3) reads, in part, that the use of an active age verification software or an age verification device to establish a purchaser’s age, “that fails to identify a false identification card, shall be considered evidence” in a criminal prosecution or in proceedings to suspend or revoke a license. That treatment applies only if the identification:

1. is bona fide evidence of majority and identity as described in subdivision (a);
2. was physically inspected;
3. is seemingly legitimate; and
4. matches the physical appearance of the customer.

The bill also adds a definition in section 25660(c)(3). “Use of an active age verification software or an age verification device” means scanning the magnetic strip or the barcode on the identification document to verify the data on it.

Evidence, not an automatic pass

The most important word in the new paragraph is “evidence.” The Legislative Counsel’s Digest describes the change the same way: the scanner use “is considered evidence” in proceedings against the licensee. The bill does not say the scan is a defense, and it does not say the scan is conclusive. Because the defense for reliance on bona fide evidence in paragraph (1) already exists, the new paragraph is best read as adding one more piece of evidence a licensee can offer, on the stated conditions.

In practical terms, a scan log does not replace the defense in paragraph (1), and it does not create a new, separate safe harbor. It is something a licensee can point to, along with the employee’s testimony and any video, to show that the staff member acted reasonably. A hearing officer or court still weighs all the evidence.

Why the physical inspection still matters most

Scanners read data. They do not look at faces. A good counterfeit can encode a barcode that matches the printed information on the card, and a borrowed real license will scan perfectly because it is real. AB 509 recognizes this by requiring three human checks before the scan counts for anything:

Physically inspected. Staff must actually handle and look at the card. Holding a phone up to a card through a window, or scanning without looking, does not meet that standard.

Seemingly legitimate. The card must look real to a reasonable person checking it. Peeling laminate, a photo that sits above the surface, blurry printing, or a card that feels wrong are warning signs that the scan cannot cure.

Matches the customer. The photo and description must match the person standing there. This is where borrowed IDs fail. A beep cannot tell you that the guest is shorter, younger, or has a different face than the photo.

Our earlier article on age-verified beverage purchases discussed why technology works best as a second layer, and AB 509 effectively writes that principle into the statute.

Building a door procedure that fits the new law

For licensees that already use scanners, AB 509 is a reason to tighten procedures before January rather than to change equipment. A sound sequence looks like this:

1. Take the card in hand. Ask the guest to remove it from any wallet sleeve or phone case.
2. Look at it. Check the photo, birthdate, expiration date, and the security features you have been trained to recognize. Tilt it. Feel the edges.
3. Look at the guest. Compare face, approximate height, and other descriptors with the card. Ask a question if something does not fit, such as a ZIP code or middle name.
4. Scan the barcode or magnetic strip. Note whether the data matches what is printed.
5. Decide. If any step raises doubt, refuse politely. A clean scan never overrides a bad match.

Training should make clear that the scanner is the fourth step, not the first. If staff learn to scan first and look second, they tend not to look at all.

Recordkeeping and privacy

Many scanners store scan data. For a licensee hoping to use a scan as evidence, a stored record of the date, time, and result can be useful. But data collected from identification documents is sensitive. Civil Code section 1798.90.1 allows a business to scan or swipe a DMV-issued driver’s license or ID card for listed purposes, including verifying age or the card’s authenticity, and says the business may not retain or use the information obtained that way for any other purpose. The statute makes a violation a misdemeanor. Before turning on storage features, confirm with your vendor and, if necessary, counsel what data the device keeps, how long it keeps it, and who can access it.

Whatever system you use, keep training records too. If a case ever turns on whether an employee knew how to inspect an ID, a dated record of their training will help.

Busy nights and special events

The new paragraph is most likely to matter on the nights when staff are under pressure: Halloween, college move-in weekends, holiday parties, and big games. Those are also the nights when shortcuts creep in. Our guides to Halloween costume ID checks and spring break ID checks in college towns cover staffing and line management on high-volume nights. The rule of thumb is the same with or without a scanner: if the door is too busy to look at faces, it is too busy.

Common questions

Does AB 509 require scanners? No. Nothing in the bill requires any licensee to buy or use a scanner.

Does a passing scan mean we cannot be disciplined? No. The scan is evidence that may be considered, and only when the physical inspection requirements are met.

What about phone apps that read barcodes? The definition refers to scanning the magnetic strip or barcode to verify data on the document. Whether a particular app qualifies is a question to raise with the vendor and counsel; the statute does not name products.

Does this apply to off-sale stores? The bill amends section 25660, which applies to licensees generally. Stores, bars, and restaurants can all use the evidence it describes, under the same conditions.

When does it apply? The bill was not an urgency measure, so it applies on January 1, 2026.

What to do when a fake gets through

Even good procedures will occasionally miss a high-quality fake. When the business learns that a guest under 21 was served despite a scan and an inspection, the response in the following days matters.

• Preserve evidence. Save video from the door and bar for the night in question, along with any scan records the device lawfully retained.
• Write it down. Ask the employee who checked the ID to write a dated account: what the card looked like, how it was inspected, what the scan showed, and why it seemed to match.
• Keep training records ready. A dated record showing that the employee had been trained to inspect IDs can support the business’s account.
• Talk to counsel before responding to any accusation. Our guide to ABC accusations, hearings, and appeals explains how those proceedings work, including the short deadline to respond.

None of these steps guarantees a particular result. But a licensee that can show a consistent, documented process is in a much stronger position than one that can only say “the scanner said it was fine.”

Current context as of November 8, 2026

ABC’s 2025 Chaptered Legislation summary lists AB 509 as effective January 1, 2026 and explains that it makes scanner use additional evidence rather than a new defense, provided staff inspected the ID and met the other section 25660 requirements. As of this update, the provision remains in section 25660 as enacted.

The bottom line

AB 509 gives careful licensees one more piece of evidence when a convincing fake gets through. It rewards businesses that combine technology with real inspection and penalizes no one for not buying a scanner. Train staff to handle the card, study the face, and treat the scan as confirmation. That habit protects the license far more than any device ever could.

Sources

1. California Legislature: AB 509 (Flora, Chapter 264, Statutes of 2025), chaptered text
2. California Civil Code section 1798.90.1
3. ABC: 2025 Chaptered Legislation (current note)

This article is general information, not legal advice.