The Department of Homeland Security has been pressuring state legislatures to implement our U.S. national ID law, the REAL ID Act. States are free to set their own policies because the DHS will always back down. But many state legislators don’t know that. They’re in a bind where they feel obligated to obey federal mandates, but they want to do right by the citizens of their states. Law-abiding Americans shouldn’t have to scrounge up long-lost identity documents, stand in line at DMVs, and see themselves entered into a national ID system just so they can carry a driver’s license.

So practical legislators are seeking that golden compromise, which the REAL ID Act seems to hold out. But watch your wallet, because a “non-federal” license may still be a national ID.

REAL ID permits the issuance of “non-federal” licenses and IDs. These can be issued without the many stringent, time-consuming, and annoying requirements of REAL ID. Such a card simply has to state clearly on its face that it may not be accepted by federal agencies for official purposes, and it must use unique designs or colors to indicate this.

But REAL ID also requires compliant states to give all other states access to the information contained in their motor vehicle databases. The law requires them to share all the data printed on the REAL ID cards, as well as driver histories, including motor vehicle violations, suspensions, and points on licenses.

That leaves an open question: Does the REAL ID Act require nationwide info-sharing on every licensee? Or just the licensees who carry REAL ID cards?

The question is important, because of the huge data security implications from exposing data about every driver to the motor vehicle bureau of every other state. A good reason to avoid REAL ID is to avoid the risk that a rogue DMV employee in any state can access the data of drivers in all the others. That’s a recipe for mass-scale identity fraud.

Drivers who are worried about identity fraud and their privacy should be able to opt out of this information sharing. While we’re at it, the privacy of security-conscious drivers could be protected if “non-federal” licenses came without the “machine-readable zone” that REAL ID requires. It allows easy collection of driver data and tracking with every swipe or scan of the card in a digital reader.

States should really resist REAL ID entirely. Congress should stop funding it and repeal the unnecessary and burdensome national ID law. But if there are to be “non-federal” IDs from compliant states, it would be nice if they offered Americans a way to opt out of the insecure information-sharing requirements in this national ID system.