Automated License Plate Reader (ALPR) Laws Explained (2026)

Automated license plate readers (ALPR), most often Flock Safety cameras, photograph every passing vehicle's plate and log its location and time. No comprehensive federal law regulates ALPR; a patchwork of state retention and data-sharing statutes governs it instead, and 2025-2026 audits found federal and out-of-state agencies bypassing several of those statutes.

Scope of this article: This page covers what ALPR technology is, the federal legal gap, the Fourth Amendment case law courts are applying, a sample of state statutes, and the 2025-2026 cross-jurisdiction data-sharing controversies. It is general legal information, not legal advice, current as of July 2026, and does not catalog every state's ALPR statute.

What Is an Automated License Plate Reader?

An ALPR system pairs high-speed cameras with optical character recognition software to convert a passing vehicle's plate into searchable, timestamped data. California's statute defines an ALPR system as "a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates... into computer-readable data." Modern systems also log vehicle make, color, body type, and features such as bumper stickers, a data set the industry calls a "vehicle fingerprint."

Flock Safety, founded in Atlanta in 2017, is the dominant vendor, reporting over 5,000 client communities across 49 states and, by mid-2026, more than 100,000 deployed cameras, generally purchased by city and county governments rather than owned by Flock itself. Motorola Solutions (Vigilant Solutions) and Rekor run smaller competing networks.

Unlike red-light or speed cameras, ALPR cameras are not tied to any specific violation. Every plate that passes a live camera is logged, stored for a period set by local policy or statute, and searchable by any officer or agency with query access, whether or not the vehicle is suspected of anything.

Is There a Federal Law on License Plate Readers?

No. There is no comprehensive federal statute governing how ALPR data is collected, retained, or shared. A 2025 Congressional Research Service brief on ALPR confirms there is no comprehensive federal statute governing the technology, and that Congress has so far left the field to Fourth Amendment litigation and state and local law rather than acting directly. That leaves the Fourth Amendment, and how courts read it, as the main federal constraint.

The Supreme Court has never ruled directly on ALPR, but two decisions frame the debate. United States v. Jones, 565 U.S. 400 (2012), held that physically attaching a GPS device to a car and tracking it for four weeks was a search, reviving a trespass theory alongside the "reasonable expectation of privacy" test from Katz v. United States. Carpenter v. United States, 585 U.S. 296 (2018), held that acquiring seven days of a suspect's cell-site location records from a wireless carrier was a search requiring a warrant, declining to extend the "third-party doctrine" to a phone's comprehensive location history. Carpenter's majority called its holding "narrow" and said it did not disturb "conventional surveillance techniques" such as security cameras.

That caveat is where ALPR litigation now lives. In United States v. Martin, 753 F. Supp. 3d 454 (E.D. Va. 2024), a federal judge in Richmond declined to suppress evidence from a Flock query, rejecting the "mosaic theory" that accumulated camera hits become a Carpenter-style search, and finding a roughly 188-camera regional network "merely augment[ed] the same inherent sensory faculties of law enforcement that have existed since the Founding." In Schmidt v. City of Norfolk, No. 2:24-cv-00621 (E.D. Va.), Institute for Justice-backed plaintiffs argued Norfolk's 172-camera network was dense enough to make warrantless querying a search; a judge granted summary judgment for the city on January 27, 2026, now on appeal. No federal appellate court has decided the question.

State high courts applying their own constitutions have sometimes gone further. In Commonwealth v. McCarthy, 484 Mass. 493 (2020), the Massachusetts Supreme Judicial Court held that "[w]ith enough cameras in enough locations, the historic location data from an ALPR system... would invade a reasonable expectation of privacy," under Article 14 of the state's Declaration of Rights, though the four-camera network before it did not cross that line. That binds only Massachusetts courts, but shows the "how many cameras is too many" question has no single national answer.

State ALPR Laws: A Patchwork, Not a National Standard

Whether ALPR data can be sold, how long it is kept, and who can query it depends on the state. The table below is illustrative, not a complete 50-state survey.

Two patterns matter more than the day counts. California and Illinois specifically bar sharing ALPR data with federal or out-of-state agencies for certain purposes, a response to fears that immigration or out-of-state abortion investigations could use a state's own cameras to evade its separate substantive law. And most states have no ALPR-specific statute at all, leaving use to individual department policy.

Watch out: A statute restricting your local department's own use of ALPR data does not necessarily stop a federal or out-of-state agency from reaching that data through a shared vendor-hosted database if access controls are misconfigured. Several controversies below happened for exactly this reason.

The Flock Safety Data-Sharing Controversies of 2025-2026

Starting in mid-2025, state audits and lawsuits found that Flock Safety's networked database structure let agencies query other agencies' ALPR data far more broadly than many state laws permitted.

The most consequential audit came from Illinois. Secretary of State Alexi Giannoulias's office found U.S. Customs and Border Protection had accessed Illinois ALPR data, violating the state's 2023 amendment to 625 ILCS 5/2-130 barring immigration-enforcement sharing. The audit found 14 disclosing agencies had shared data with 551 agencies outside Illinois, including in Texas, Oklahoma, Kentucky, Missouri, and Indiana; one suburban Chicago department alone logged 262 immigration-related out-of-state searches between mid-January and April 2025.

The starkest incident, documented by the Electronic Frontier Foundation, involved a Johnson County, Texas sheriff's office. After a woman's partner reported she had self-administered an abortion in April 2025, investigators ran an ALPR search across Illinois and Washington networks, both states with abortion-access protections, followed by a broader search on May 9 across more than 6,800 networks. Audit logs recorded the reason as "had an abortion, search for female," though the sheriff publicly described it as a welfare check.

California audits found similar gaps: San Jose's logs reportedly listed search reasons simply as "CBP" and "ICE," Mountain View found over 250 agencies with no data-sharing agreement had run an estimated 600,000 searches in twelve months, and Oxnard suspended its entire deployment in February 2026 after a vendor-side error let outside agencies reach data the city had restricted to "California only." By late June 2026, at least 53 US cities had canceled Flock contracts over unauthorized federal data access, according to Tech Times.

On February 26, 2026, two California drivers filed a putative class action, Javorsky v. Flock Safety, Inc., in San Francisco Superior Court, alleging federal and out-of-state agencies queried San Francisco's database more than 1.6 million times in seven months, violating California's ALPR Privacy Act, and seeking the statute's $2,500-per-violation figure. Flock Safety says it restricts access based on each customer's configured settings and attributes some unauthorized access to third-party misuse; that dispute remains unresolved in pending litigation.

Privacy Arguments Against ALPR Networks

Civil liberties groups, including the ACLU and the Institute for Justice, raise several recurring arguments against large-scale ALPR deployment, apart from any specific statutory violation.

The first is the aggregation argument credited by the Massachusetts court in McCarthy but rejected by the federal court in Martin: a dense grid of cameras capturing every vehicle's movements over months can reconstruct a person's pattern of life, including visits to a place of worship, medical provider, or attorney, without individualized suspicion. The second is retention variance: periods range from minutes in New Hampshire to years in states with no statute, so the same drive generates data with a very different useful life depending only on whose cameras captured it. The third, illustrated by the Illinois and Texas incidents above, is that a state statute is only as strong as the technical controls enforcing it, and the fourth is the near-absence of routine independent audit; the findings above came from a state audit and litigation discovery, not proactive disclosure.

Flock Safety and other vendors respond that the cameras record only what is already visible on public roads, that query logs create their own audit trail, and that the technology has aided investigations of specific crimes. Weighing those claims is an active policy debate at the city-council level in many jurisdictions, not a question this article resolves.

Can You Challenge or Opt Out of ALPR Surveillance?

There is no consumer opt-out for a public ALPR network. Cameras record any vehicle that passes, and no state statute lets a driver request removal of past scans.

Public-records requests are the main transparency tool instead. SB 34 requires California agencies to post their ALPR policy publicly, and most open-records states let a resident request a department's policy, retention schedule, and sometimes audit logs; the Illinois and California audits above came from exactly this kind of records and litigation-discovery process. If you believe your state's statute was violated, the state attorney general's office or, as in Illinois, the Secretary of State's office are the bodies that opened those audits. Some statutes, including California's, create a private right of action with statutory damages, the theory behind the pending Javorsky class action; whether specific facts support a claim is a case-specific question for a licensed attorney in that state.

Damaging or disabling an ALPR camera is different from a records request or lawsuit. News coverage in 2026 documented Flock cameras being vandalized nationwide; destroying government or vendor equipment can expose a person to criminal property-destruction charges regardless of the underlying objection, and this article does not suggest that as a course of action. The pressure points that have actually changed local ALPR policy, contract votes, state audits, legislative amendments, and civil litigation, are procedural, not physical.

This article is general legal information current as of July 2026, not legal advice. Statutes cited reflect the versions in force as of the verification date; several states amended their ALPR statutes in 2025-2026, and further amendments are likely.