Texas DMV Ties a 2023 Access Fix to Its $131M Overhaul

The Texas Department of Motor Vehicles (TxDMV) is midway through a $131 million project to rebuild the Registration and Title System (RTS) -- the database that holds every Texan's vehicle registration and title record, including name, address, and other personal identifying information.▸ A May 2026 audit⧉ from the Texas State Auditor's Office (SAO) -- the state's independent, constitutionally established auditor -- found that while that rebuild is underway, TxDMV cannot verify the financial safeguards required of the companies it lets buy bulk access to that same data, and still has not fixed a dealer-portal access weakness tied to vehicle-tag fraud that a different SAO audit flagged three years earlier.

Texas law lets TxDMV disclose vehicle registration and title data to approved companies for reasonable business uses -- a towing company identifying an impounded car's owner, an insurer processing a claim.▸ As of October 2025, the Department had 1,778 of these permitted data-disclosure contracts on its books. Forty-two of them were "bulk" contracts, carrying extra requirements because they let a company pull at least 250 records at once -- in some cases, the Department's entire database.

The Legislature toughened the privacy rules for this kind of disclosure in June 2021, requiring contracts to bar redisclosure to unauthorized recipients, force 48-hour breach notification, and spell out civil liability if data leaks.▸ Auditors tested 25 contracts, including 19 of the 42 bulk contracts, and found 22 -- 88%, including 18 of the bulk contracts -- still missing at least one of those 2021 protections. For the bulk contracts specifically, TxDMV also could not produce proof that 17 of 19 tested companies (89%) had posted the $1.0 million performance bond required to cover a breach of contract, or that 13 of 19 (68%) held the required $3.0 million in liability and cyber-threat insurance -- the money meant to be on the hook if one of these companies mishandles Texans' driving data.

TxDMV's response, filed with the audit, says it has already re-reviewed all 2,002 of its data-disclosure contracts and user-access agreements, terminating 224 for failing to reapply or lacking a valid business use, and that on April 17, 2026 it warned the remaining noncompliant companies their contracts would be cancelled within 30 days if they didn't produce the required bond and insurance.▸ Of the audit's own 22 noncompliant sample contracts, 14 had come into compliance by that date and 8 were on the clock. The Department separately told auditors it had not completed the data-maturity assessments state law has required every two years since 2021 -- only submitting its first one, for 2022, in August 2025 -- and that the Data Governance Steering Committee meant to run its data program had stopped meeting; it committed to restart the committee by August 2026.

A separate finding in the same 2026 audit traces back further: access to webDEALER, TxDMV's dealer-facing system, which a March 2023 audit⧉ examined as part of reviewing "the appropriate production and use of temporary vehicle tags."▸ TxDMV had tightened dealer licensing and added daily fraud-monitoring reports for temporary-tag production in 2022, after an internal audit found fraud risk in how tags were issued -- unrestricted system access raises the chance that tags, meant to let a newly bought car legally reach registration, get allocated improperly or fall into the wrong hands. The 2023 audit found 103 of 506 active webDEALER users (20%) couldn't be confirmed as current employees, and 22 of 112 users with administrative-level access (20%) didn't need it; TxDMV agreed to limit access to current employees only, citing thin staffing for identity-management reviews as the obstacle.

Three years later, the 2026 audit tested webDEALER access again and found 34 of 548 users (6%) still didn't need theirs -- and 17 of them are the exact same people the 2023 audit had already flagged.▸ TxDMV's own management response calls the 2023 recommendation "not fully implemented" and says webDEALER still can't generate the reports needed for a proper access review; a fix begun in September 2023 was still in pilot as of this audit, with fuller capability explicitly folded into the still-unfinished $131 million RTS project. That's a different remediation path than the bulk-contract bond and insurance gap, which TxDMV is instead working through its separate contract-termination process -- the RTS project is the Department's own cited fix for the access-control and governance findings, not the contract-verification one.