Library Cards

At one point about twenty years ago, I thought about forming a small company that would use etchings on stone to authenticate important records. The stones would range in size and be etched with a unique pattern documenting the record. The properties of the stone, in combination with the pattern, would be the authentication key. The jobs of “stone courier” and “stone reader” would be a fiduciary position, akin to a lawyer or CPA (but they would be in better shape, because of all the lifting).

I did not follow up on this idea, which is of course the only reason why we now use QR codes to authenticate everything from mortgages to concert tickets, and why you don’t have to have a padded “rock bag” in place of your cell phone, as you go through the airline check-in.

Why am I starting my answer to a serious question with this silly (but real) story? Because as the question points out, there are many types of records, and they are defined by their content, not their medium. A ticket to see “Lords of the Sound,” whether on paper, your phone, or a gilded rock, is still a ticket.[1] In that same vein, a library card application record, no matter what the medium, is still a library card application record.

So, to address the first question (How would you define a Library Card Application Record?), we must first ask, “What is a library card application record, as defined by the LGS-1?”[2]

Here is how “library card application records” are referred to in the most recent version:[3]

Lawyers can be notoriously precious about definitions, but I will say that in this case, it is the record generated by the process of applying for a library card and/or borrowing privileges.

Interestingly, the term “library card” is not defined by law or regulation in New York State and is only used in Education Law Section 816, which requires public schools to disseminate library card application information to K-12 students.

Instead, Education Law Section 262 provides: Every library ... shall be forever free to the inhabitants of the municipality or district or Indian reservation, which establishes it, subject always to rules of the library trustees who shall have authority to exclude any person who wilfully [sic] violates such rules; and the trustees may, under such conditions as they think expedient, extend the privileges of the library to persons living outside such municipality or district or Indian reservation. [emphasis added]

A “library card” is, by custom (not law), the end product of the “rules” of the “privilege” of using the library. A “Library Card Application Record” is whatever was generated with the end goal of a person having the privilege to use a library card. As can be seen, it must be retained for at least three years after the card has expired.

This brings us to the second question: Does duplicating all information from a simple registration card into the ILS patron record relieve the retention period of the physical registration card?

Great question!

I have to say “no.”

Here is why:

If you read the LGS-1 closely, you will see that it does not pertain to cooperative library systems; for example, LGS-1 items 593 and 594 in the above excerpt[4] show that while a member library must retain materials received from its library system, the system has no similar obligation.

This is because cooperative library systems do not fall under the record-keeping obligations of the state’s Arts & Cultural Affairs Law,[5] the law that mandates record-keeping by government agencies and directs NYSED to maintain a schedule of document retention (the LGS-1).

The obligations in the LGS-1 fall on public libraries. So, unless the cooperative library system providing the ILS is specifically under contract to maintain the records as a vendor for the required retention period, the copy retained by the system might not meet the retention obligation of the library (even if the record is 100% duplicated).

So, with that, on to the next question:

Does retention change if there is unique information on the registration card that is not duplicated in the ILS, including signatures?

If the application information is combined with other information, the retention period could be increased. For example, here is another type of record that must be kept by a public library:

So, if a library is doubling up on its application form (online or in hard copy) and also uses it as a form for registering the right to access a special collection, the retention period could be increased.

The next question is very important: If retention applies to a simple registration card (no signatures or unique information), is it possible to define it as a temporary data transfer tool rather than an application through policy, to relieve the retention requirement?

Again, I have to answer “no.”

Here is why: the physical registration card is filled out by the library user to apply for a card, and then it is used by the library or system to initiate the digital process of entering the card holder into the ILS.

Once the person is granted a card, the library has no obligation to retain their borrowing record (except to the extent the Library decides that it is “needed”). This includes—hold on, things are about to get meta here—the record entered into the ILS based on the application.

The record that must be retained for three years after the expiration of the card is the “application,” not the ILS record that facilitates borrowing.

Consider: The application is the act of the future library user signifying that they accept the rules the library is imposing and asking for library privileges.

Entry into the ILS is the act of the library accepting the application (generally with the help of the library system, which provides the ILS) and enabling the creation of a borrowing record.

Although the two operations may record the same information at the onset, these are two separate things, with two separate retention periods (life of the card plus three years and zero years after needed, respectively).

For this reason, cooperative library systems that do not fall under the Arts & Cultural Affairs Law have to carefully identify when they are performing a record-keeping function for a member public library that does fall under the Arts & Cultural Affairs Law. Although ILS technology will impact how borrowing privileges are put into effect and used, each public library within a system should have its own policy and practice for applying for a card, and each cooperative system should make it clear (via policy or a member agreement) when it is providing a record-keeping function for a member related to that process and when it is not.[6]

Interestingly, because a library card application can signify agreement to library and/or system policy and procedure, I believe it is wise to retain application materials for at least six years after expiration, because that is the default statute of limitations for bringing an action on a contract.[7] This is true whether the application was “born digital,” created on paper, or even submitted via a gilded rock.

But that is just something to consider, not a law. Here is a sample policy including this consideration and the others discussed above.

Library card application records are records generated by a library user and/or the library or library system in furtherance of the user’s formal library privileges. 

Library card application records are confidential and private and will not be disclosed to any third party without written permission of the cardholder, or per a duly issued subpoena, court order, or warrant, unless for the operational needs of the library.

Typical information supplied on library card application records is: [username, address, optional additional contact information, optional third parties who may access confidential library records, and card type (select all that apply/add your own: temporary card, youth card, resident borrower, non-resident borrower, system card)].

The [NAME Library/NAME System] stores library card application records in the following ways: [SELECT ALL THAT APPLY: hard copy, on computers owned and controlled by the Library, on a network owned and controlled by the Library, on a confidential cloud service controlled by INSERT, and on an integrated library system maintained by the [NAME] Library System].

To ensure the proper retention and disposal of library card application records, such records are retained for not less than three (3) years after the card has been discontinued.

The following retention periods will add to and never subtract from the above period: 

For a library card or other application for permission to use non-circulating materials, such records are retained for not less than six (6) years. 

For library card application records relating to permission to use rare, valuable, or non-circulating materials, such records are retained for not less than six (6) years.

For library card application records relating to agreements to abide by a Code of Conduct, granting image rights use, third-party access to an account, or otherwise making a contractual agreement, such records are retained for not less than six (6) years.

Library card application records are disposed of within one (1) year of the expiration of the relevant retention period. Some library card application records may be retained for archival or operational purposes, but the privacy and confidentiality of such records shall continue.

Thank you for an important series of questions.

First, I'll answer the easy question: No, you are not overthinking this.

For children fortunate enough to be brought to the public library at a young age, the experience is life-altering. They grow as readers and thinkers. They see themselves as part of a community that shares resources. They start to absorb the values of privacy and information access.

All of this is imbued by the library providing and applying the factors listed in the question: the card policy, the rules around borrowing, and how the child's parents and guardians are brought into the mix.

Which brings us to the crux of the member's question:

We want to have a procedure that balances the rights of minors to read freely, with protection for our library against claims that we have checked out materials to children that the parent/guardian believes to be inappropriate.

In New York, the procedure to ensure the library is protected is simple in one way and complex in another.

It is simple because the recipe for the protection referenced is already in the law.

Just like the chemical formula for one of the molecules in lavender[1] is this:

The “formula” for a library to be protected against an assertion that a minor checked out inappropriate material is:

Of course, this is the protection from claims of criminal liability, and as we have seen, claims of criminal liability aren't the only things libraries and library workers need protection from.

So, let's re-examine the question with the idea that “protection” means from coercive tactics and civil liability,[2] not criminal prosecution.

We want to have a procedure that balances the rights of minors to read freely, with protection for our library against claims that we have checked out materials to children that the parent/guardian believes to be inappropriate.

Other than the practices described in the question (parental acknowledgement at the time a card is obtained, confirmation of age), the tactics to do this are far more complex.

How complex? Well, to go back to the chemistry analogy, the above image was for just one molecule. Here is a full suite of molecules in the essential oils of L. angustifolia (lavender): 

As case law shows, the best protection is a complex array of library practices, all working in alignment to create a beautiful whole.

What is that array?

In short, libraries: keep on doing what you do.

That said, if there is one thing to emphasize that could help guard against negative impacts from a parent displeased with a child's library choice, it would be to add to adjust the language in the parental sign-off from this:

“My child has permission to have a library card. I understand that all library collections, including adult material and internet access, are available to children. I accept responsibility for my child's use of the library and any loss incurred.” This application is retained until the cardholder becomes an adult.

To this:

1. I acknowledge that my child has applied for a library card and will be responsible for following the conditions of that card, including the Library Code of Conduct and Library User Bill of Rights.
2. I understand that materials and internet access at the library are not restricted by age, and that my child must be accompanied by a responsible adult while in the library until age 13.[3]
3. I appreciate that if I have any questions or concerns about my child's use of library services, I can contact [ADDRESS] to discuss them confidentially.
4. [IF NEEDED] I agree to pay all costs incurred by my child due to loss or damage of borrowed materials.

This change in language can do a few things. First, it changes parent/guardian “permission” to get a library card to “acknowledgement” that the child has agency to apply for access; this subtly (or not-so-subtly) removes the implication that a parent must consent for a child to get a library card.[4]

Second, it links the acknowledgement of collection/internet access to the Code of Conduct and the “unaccompanied minors” policy.

Third, by emphasizing how to address concerns, it provides a gateway for concerns to be brought forward in a proactive way.

And finally, if it is a concern, it puts the parent/guardian on the hook for damage fees.

To bring this all home: why is all of this so important?

First, the answer is: this stuff has always been important.

But second: this answer is being written in October 2024. As I write, the wave of coordinated efforts to limit access to library content continues, and children having access to that content is often cited as a motivation for those efforts.[5] While threats of criminal prosecution have been made, the more common tactics are intimidation[6] and threats to curtail funding. Any adjustment a library can make to reduce the chilling effect of those tactics is worth considering.

Thank you for a great question.

I didn't realize it in first grade, but a school library[1] is one of the first places a person experiences "the right to privacy" unmediated by a parent or guardian.

Think about it.  You go to the library and get to pick out whatever you want.  You check out books, and no one can tell you what to pick.  And aside from the person checking you out, no one has to see your selection; your records are private.

In the present day, this means that kids whose faces might be all over Facebook[2], who are attending school via computer, and who "turn off their screen," when they don't want people peeking into their home life during remote learning, still have a right to confidentiality when it comes to the library in their school. And one of the biggest symbols of that student-library relationship is their library card.

So, with all that hanging in the balance, what are the legal considerations of putting student pictures on school library cards?

As often happens in the highly regulated worlds of education, privacy, and information, the answer is: "It depends."

In this case, the factors "it depends" on are numerous; rather than itemize them, I'll summarize them with a few pointed questions:

Factor 1: What else is "on" the library card?

Depending what other information is on the library card, combining a student’s picture with it could increase the likelihood of a violation of FERPA[3], Ed 2-d, or school policy.[4]  For instance, if the card is used for not only swipe access, but access to grades, disciplinary records, and library records, also including a picture ID on it makes it sensitive, indeed.

Factor 2:  Who "owns" the library card?

Some schools, by policy, give out student identification cards, but use a school or district-wide policy to confirm that the card is simply "on loan" to the student (and must be returned at certain events, like suspension or expulsion).  Other institutions issue a card, and it becomes the student's property; this means that the card is more under that student’s control.[5]

While there is no requirement to do one way over the other, the school and library should confirm the ownership of the card in a policy, as this can impact the decision to mark the card with picture ID, as well as who has control over the card in the future.

Factor 3:  Why does the picture need to be on the library card?

Is the school so large that in order to ensure it provides library services to the right student, the card must have a photo ID?  Is it a security measure, perhaps to deter theft (of library cards, and therefore collection assets)?  Do students need to "swipe" into the library, with the library positioned to monitor that they are letting in a student who isn't supposed to be in class?  Or is the library card doing double duty as the student's general student ID?  Whatever the reason, it should be understood and clearly based in policy.  And if the reason has to do more with security at that school than the operations of the library, it is better that the function be performed by the student ID, not the library card.[6]

Factor 4:  Who will have the right or ability to view the library card?

If the library card is only required to be viewed by library staff, the inclusion of the photo is consistent with FERPA's and CPLR 4509's different but equally applicable privacy requirements.  But if a security guard, teacher(s), bus driver, or others all have to see the library card for different reasons (this relates to question number 3), or could use the card to access the student's library records, that raises the possibility of concerns.

Factor 5:  Is there a "stealth" reason for the use of the photo and name?

For some students, if they do not have documentation such as a birth certificate or social security card, a library card with a picture ID might be the most official "documentation" they have.  If a library or school is intending that their cards perform this ancillary function, this should be done with the awareness that third parties relying on the identification function still need permission for the school or library to comment on the content of the card (for students under 18, this means a waiver by parents or guardians).  However, that same student (or their parents/guardians) can choose to share their confidential education records or library records however they wish.

Okay, that's a lot of "factors," but what is the answer?

Having dragged you through all that, I will answer the member's very simple question:  Is it legal to print student photos with their names on their school library cards for circulation use?

The answer is "Yes."

But!  If the library card will be used for anything more than "circulation use" within the library, it is wise to assess precisely what the card will be used for, root that purpose in well-developed policy that considers the above factors, and evaluate if the picture—which in this case, will be a FERPA-protected education record[7]—is needed at all.  The more the card is used for functions beyond the needs of the library, the more those functions should be achieved by a separate student ID, or in the alternative, schools should make sure that library information[8] is separate and isolated from other education records accessed by or listed on the card.

Thank you for an important question.

[1] It is important to note that a "public school library" is different than a public library, or an association library, or a college library.... but ALL are subject to CPLR 4509, the law making library records private.  And while they are different, a public school library, like the college library, is subject to FERPA.

[2] I used to be such a stickler about not posting any pictures of my kids on FB.  But the loving posts of other family members eventually wore me down.  Sorry, kids, I really tried.

[3] Photos of students maintained by their institutions, like an ID photo, are confidential education records under FERPA.  https://studentprivacy.ed.gov/faq/faqs-photos-and-videos-under-ferpa

[4] For instance, if the library card is also an all-purpose student ID that also functions as a key card or has lunch money on it, a policy should clearly separate those functions and there must be a clear protocol for voiding access when the card is reported lost.

[5] Just because the school owns the physical object doesn't mean they own the rights to the student's image.

[6] This is because, as written more thoroughly in Ask a Lawyer RAQ #100, school library records are subject to both FERPA and 4509 rules of privacy.  Combining education record with library records can make it difficult to tease out the different ways the materials may need to be handled. 

[7] See footnote 3.  Yes, this is a footnote to send you to a footnote.

[8] Either in hard copy, on the card, or via digital access.

I remember getting my first library card at the Utica Public Library with my Dad, circa 1985.  It was a right of passage: something "official" before I could drive, or work, or vote; a stepping-stone to adult life.

Of course, back then, we didn't have the Child Online Privacy Protection Act, the SHIELD Act, or the GDPR.  We did have CPLR 4509[1], but if that was part of the application, I probably assumed it was what the library would use to revive me if I had a heart attack in the stacks.

But enough of Memory Lane: this question is rooted in 2020, a time of pandemic, of online ecosystems, and of growing awareness about personal privacy and data security.  During this time, a library putting in place direct access to services for children in the ways listed by the member is a critical service, and as the member points out, introduces a lot of legal factors to think about.

To answer the member's questions, let's dive into them.

Contracts and Kids

Since the relationship of a library to a patron is (among other things) contractual, and in New York a person (generally) cannot be held to a contract until they are 18[2], any terms a library wants to be able to enforce on a minor must require legal consent of a parent or guardian...and in some cases, the contract really is just with the parent or guardian (who I will call "P/G" for the sake of efficiency going forward).

This, by the way, doesn't mean a library can't let minors have a card and borrow books (or have online access, or be in the library) without the signature of a parent or guardian—it just means if you want to enforce any contractual terms against those minors (like the requirement to return borrowed books), it's best to have a P/G's consent along for the ride.

Contracts and the Internet

Most contracts—including those signed by P/Gs binding minors—can be entered into electronically,[3] and a contract signified by a library card is no exception.  So yes, a patron, including a child, can get a library card or access to services through an electronic signature. 

(Just in case you want the nation-wide definition, an "electronic signature" is "an electronic sound,[4] symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record."[5])

What about COPPA?

When a website specifically provides services to children, we often have to consider the Children's Online Privacy Protection Act, or "COPPA."  But not today, since COPPA expressly states that the law applies to "commercial" websites and online services and generally not to nonprofit entities like a library.[6]

Although nonprofit entities are generally not subject to COPPA, the FTC "encourages[7] such entities to post privacy policies online and to provide COPPA’s protections to their child visitors."  Since libraries are sticklers for privacy, this makes sense, but if your library does this when setting up online resources for minors, don't call it "compliance with COPPA," call it "doing it the right thing because we want to."[8]

Should we require a parent?

COPPA, by the way, is one of the laws that uses the age of thirteen as the cut-off age for children being able to sign up for things (commercial or otherwise) on their own.  In my experience, 13 is also the age when insurance carriers decide children transition from "vulnerable" to simply "minors."  For this reason, many content providers and services (including libraries) bar access without a parent to those under 13.

All of which is to say: while there might not be a legal requirement to involve a P/G, in general, I'd say this is a good practice.  Good—but not required.  Remember, to legally enforce any conditions[9] (collect fines), you need a P/G's signature, but if you just want to let a kid borrow a book without consequences enforceable in court, you don't.

Let's see some ID?

Okay: you're set with electronic signatures.  You know you need to get P/G into the mix for patrons under 18.  You're "Doing The Right Thing Because You Want To" when it comes to soliciting information from minors under 13.  Do you need to see identification to make things official?

That depends.

If the privileges the library card or access grants come with conditions you will need to enforce in a court of law (fines, damages), it is ALWAYS better to get some form of identification or proof of address.  I say this, because when lawyers sue, proper ID and proof of address is how they know they are suing the right person.

Similarly, if there is an age or residency requirement, or a financial element (for instance, loading money onto an account), or if a person is to have access to another's account, you might need to require ID. 

Because the need for it will vary, when to require ID is a good question for your local attorney.  From my perspective, if a person is allowed to take out more than $10,000.00 worth of library assets at a time, or a library wants to be able to collect fines, I'd want to know how to enforce a return of those items.  Similarly, if patrons are allowed to access services from third-party vendors through their library card (software programs, audio books, anything governed by a third-party license), and there are consequences for a violation, it is good to have solid information about who your patron really is.

The problem is, if you are going to require ID, you must have a solid policies and procedures that address:

• Requiring ID in a manner that does not disproportionately impact those who live in poverty, or other categories of people[10]
• Requesting ID
• Evaluating ID
• Securely retaining and routinely destroying hard copies of ID
• Securely retaining and routinely purging electronic copies of ID
• Have a plan for data breach impacting retained ID

Basically: the reason a library would require ID—aside from verifying that a person lives in the relevant area of service, or is who they say they are—is to collect damages or to legally enforce conditions the patron has agreed to as a condition of a card.  Since that is an unpleasant business, its best to avoid it whenever you can...but when it's important, it's important to do it right.

I enjoyed writing this answer, because as part of it, I got to poke around and see how different libraries are solving this issue.  I saw some great stuff, including a temporary e-access system that let the technology do all the work (requesting verification of age via click-thru, using location services to confirm location in NY, imposing conditions on digital content via function without the need for legal enforcement mechanisms).

It is good to see when the law inspires, rather than quashes, creativity and information access.  I hope your library and library system finds this helpful as you imagine new ways to connect people to vital services!

[1] Requiring libraries to not release an individual's library records to a third party.

[2] There ARE some exceptions, but unless your library is hiring a minor to act in their movie, or selling a married couple of 17-year-olds a house, they shouldn't apply here (see General Obligations Law § 3-101).

[3] (15 USCS § 7001) states: "a signature, contract, or other record relating to such transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form."

[4] This definition's use of "electronic sound" created a rabbit hole where I envisioned a series of "auditory" contract signature proceedings where a person uses their Spotify Playlist to accept contracts.

[5] 15 USCS § 7006

[6] Entities that otherwise would be exempt from coverage under Section 5 of the Fair Trade Commission Act, which most if not all libraries are.

[7] You can find this "encouragement" at https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequently-asked-questions-0

[8] A great guide for "doing the right thing" is here: https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequently-asked-questions-0#A.%20General%20Questions

[9] By "enforce conditions," I mean contractually, in a court of law.  A library can always ask a 12-year-old to pipe down, and enforce its Code of Conduct if they do not.  But to collect fees, get a P/G signature!

[10] This question is critical to a library's mission.  While there is no "right" answer, I can say that even facially neutral things such as asking for utility bills, pay stubs, or non-driver ID can alienate people within a library's area of service.  I advise maintaining a list of ID types that includes "the usual" types of ID (driver's license, ss card, birth certificate, non-driver ID), and some other types, as well (report card, lease, or any correspondence from a government agency (with private information redacted)).  The list maintained by NYPL, who clearly gets this issue, made me smile: https://www.nypl.org/help/library-card/terms-conditions.