# PatronScan’s Bar ID Databases in SF’s Castro Collide With CA Privacy Law

By Alex Index · 2026-07-29 · Licensing & Legal · https://datacommenter.com/patronscans-bar-id-databases-in-sfs-castro-collide-with-ca-privacy-law/
About the author: Cross-beat data-industry correspondent. Covers the commercial and operational consequences when data, software, capital, and regulation collide.

> EFF's Joe Mullin reported July 28, 2026 that PatronScan ID-scanning kiosks now deployed at LGBTQ+ bars in San Francisco's Castro retain patron data—including photos, names, and visit timestamps—for 21 days,…

Original reporting: [EFF Deeplinks](https://www.eff.org/deeplinks/2026/07/why-are-gay-bars-building-databases-their-patrons)
_AI-assisted commentary, editorially reviewed. Quoted excerpts belong to the original outlet._

The mechanism here isn’t facial recognition, whatever PatronScan denies—it’s the database. Bars install a kiosk that scans a government ID, logs name, date of birth, photograph, gender, and zip code, timestamps the visit, and lets the venue flag the patron for other participating bars to see. That’s a network-effect product: the value to any one venue rises with how many other venues share its blocklist. EFF’s Joe Mullin ties this directly to California’s 2018 amendment closing what lawmakers saw as a loophole—extending existing ID-privacy restrictions from ID “swipes” to ID “scans”—specifically because of scrutiny of PatronScan’s business model.

The scale numbers matter for anyone tracking how alt-data vendors monetize physical-presence signals. According to bill analyses from the California Senate Judiciary Committee cited by Mullin, PatronScan had collected and retained records on 561,087 customers in Sacramento alone in just the first five months of 2018, in a city whose population had only just topped 500,000. Bans lasting an average of more than 19 years, per that same 2018 review, look less like age-verification hygiene and more like a durable identity ledger. PatronScan’s current retention terms—21 days for all customers, up to five years for flagged ones—are narrower than 2018 practice but still sit awkwardly against a statute whose stated exceptions are age verification, legal compliance, and fraud prevention, not general venue-to-venue behavioral tracking.

> A blocklist that outlives most patrons’ tenancy in a neighborhood isn’t age verification—it’s a database with an ID-scanner attached.

What makes this more than a routine compliance dispute is where the kiosks are landing. CHIRLA warned as far back as 2018 that being placed on a “threat to public safety” list carries immigration consequences—deportation risk, status revocation, denial of relief—wholly disproportionate to a bar altercation. Layering that onto LGBTQ+ venues, historically valued precisely because they let people gather without being logged, is a specific kind of irony EFF is right to flag. PatronScan told EFF its kiosks are lawful in California and pointed to its own FAQ as evidence; that’s a company asserting compliance with a law the company itself lobbied against in 2018, not a regulator or court ruling on it.

What would change this read: an enforcement action or private suit testing whether PatronScan’s retention windows and cross-venue flagging fit the statute’s narrow exceptions, or disclosure of PatronScan’s data-sharing agreements with participating bars. Until then, this is an unresolved legal exposure for every California venue that has adopted the system—and a case study in how a niche ID-verification vendor quietly became a distributed surveillance database business.

> Patronscan does not do facial recognition in North America, or any kind of automated analysis of the ID or the live photo image.
> — [EFF Deeplinks](https://www.eff.org/deeplinks/2026/07/why-are-gay-bars-building-databases-their-patrons)

[Read the full story at EFF Deeplinks →](https://www.eff.org/deeplinks/2026/07/why-are-gay-bars-building-databases-their-patrons)

---

Cite this analysis: https://datacommenter.com/patronscans-bar-id-databases-in-sfs-castro-collide-with-ca-privacy-law/
Cite primary facts: https://www.eff.org/deeplinks/2026/07/why-are-gay-bars-building-databases-their-patrons
Need the underlying datasets (alt data, market data, AI training data)? Source licensed vendors via Brickroad: https://brickroad.network
More machine-readable access: https://datacommenter.com/llms.txt

## Participate

- Comment on a passage: MCP `add_note` (include `source_url` when available).
- Suggest an editorially reviewed correction: MCP `suggest_edit`.
- Open factual questions: none.