States would have to get drivers' permission before releasing personal data from their motor vehicle records under a provision of the transportation appropriations bill approved by the Senate yesterday.

The provision is one of the most aggressive efforts in recent years to address privacy concerns by curbing the government sale of names, addresses, Social Security numbers, license photos and other personal data to direct marketers, information brokers and others.

It attempts to strengthen an earlier effort by Congress to restrict the use of drivers' information, but it also raises new questions about open records traditions and the rights of states to decide how to use information they gather.

Next month, the Supreme Court will decide the constitutionality of the Drivers Privacy Protection Act, which prohibited states from selling information drivers provided, except to direct marketers, police and some others who were listed as permissible buyers. The law, which took effect in 1997, was challenged in several states as an unconstitutional infringement of states rights.

The new, tighter restrictions were attached to an appropriations bill to try to get around those constitutional questions. The provision's sponsors believe that if states can choose to comply--as technically they can under the transportation bill, risking a possible loss of funding for projects if they don't--states'-rights issues will not be raised. The provision has few enforcement mechanisms attached, however, and would have to be renewed by Congress each year to remain in force, so it is unclear how many states will comply.

The restrictions, approved by the House on Friday, have two parts. The first requires states to obtain consent before releasing to anyone sensitive data such as details about drivers' medical conditions or disabilities, license photos or Social Security numbers. The second would require states to get permission before releasing less sensitive information--including names, ages and addresses--to a third party for marketing purposes.

The changes would take effect next June. The bill will now go to President Clinton, who is expected to sign it.

Privacy advocates and marketing specialists agreed the provision could have a broad impact on the way personal information is gathered and used, in part because it requires individuals to give consent before information is shared. "It's a huge step," said Susan Fournier, a Harvard University marketing professor.

Gregory T. Nojeim, legislative counsel for the American Civil Liberties Union, predicted it will be "the opening salvo" in a decade-long fight over privacy on the Hill. "Now, drivers will have more control over their personal information," he said.

For years, states have raised millions of dollars selling information from their motor vehicle databases. Direct marketers have relied on the records as a source of names, addresses and other information. Automobile parts dealers contact drivers with certain kinds of cars, for example, and eyeglass manufacturers target people listed as having vision problems.

Information services such Experian Information Solutions Inc., Acxiom Corp. and others have come to rely on drivers records as one layer of information they use in highly refined marketing dossiers about millions of Americans.

Now, by requiring consent from drivers, marketers worry that Congress is making it harder than ever for them to conduct business in the database age. "It's going to have a widespread impact throughout the country," said Stephen Altobelli, spokesman for the Direct Marketing Association.

Some open records advocates also worry about the impact. Gregg Leslie, acting executive director of the Reporters Committee for Freedom of the Press, an advocacy group in Virginia, said drivers' records are an important source of information about public officials and others. "The privacy interests, while important, should not outweigh the public interest," he said.

Sen. Richard Shelby (R-Ala.) began pressing for the change last spring. "Private information is too available," Shelby said, adding that the Internet has made it "easy and cheap for almost anyone to access very personal information."

"I believe there should be a presumption that personal information will be kept confidential," he said.