California License Plate Reader (ALPR) Laws (2026)

California has a specific statute for license plate readers, added by SB 34 and effective January 1, 2016: Civil Code §§ 1798.90.5 to 1798.90.55. In one sentence, an operator of an ALPR system must keep reasonable security safeguards and a written, public usage and privacy policy, and a public agency must take public comment before starting a program and may not share the data except with another public agency.

Information reviewed September 30, 2026.

For related pages, see the California entry in the state comparison, the ALPR laws hub, Are Flock cameras legal?, What are Flock cameras?, and our California surveillance camera laws guide.

What does California's ALPR statute require of operators?

The operator duties are in Civil Code § 1798.90.51. An operator must maintain reasonable security safeguards and implement a written, public usage and privacy policy. At a minimum the policy must state the authorized purposes, the authorized job titles and training, monitoring, rules on sale, sharing and transfer, the official custodian, and accuracy measures.

It must also state "[t]he length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information."

The statute sets no statewide numeric retention period in Title 1.81.23. The retention period is whatever each operator's or end-user's policy states, apart from the California Highway Patrol rule described below.

Access is tracked separately. Under § 1798.90.52, an operator that accesses or provides access to ALPR information must keep a record of each access, including the date and time, the plate or query data used, the username and affiliation, and the purpose. It must also require use only for the purposes in its policy. An end-user's policy must include "a process for periodic system audits."

The statute's definitions carve out some entities. A transportation agency subject to Streets and Highways Code § 31490 is excluded from both the operator and end-user definitions. Persons regulated by the Gramm-Leach-Bliley Act, and permissible users under the Driver's Privacy Protection Act other than law enforcement, are excluded only from the end-user definition, not from the operator definition.

What extra rules apply to public agencies and the CHP?

A public agency that operates or intends to operate an ALPR system "shall provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before implementing the program." That requirement is in § 1798.90.55(a).

Under § 1798.90.55(b), "[a] public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law." Hosting and towing services are excluded from the meaning of sharing. The statute defines public agency to mean the state, cities, counties, and their agencies or political subdivisions, and it does not name out-of-state or federal agencies.

The California Attorney General has addressed that gap in guidance. Information Bulletin 2023-DLE-06, dated October 27, 2023, states that "SB 34 does not permit California LEAs to share ALPR information with private entities or out-of-state or federal agencies, including out-of-state and federal law enforcement agencies." The bulletin applies that reading to vendor-hosted multi-agency databases. It is guidance, not a court ruling.

The California Highway Patrol has its own statute. Under Vehicle Code § 2413(b) to (e), the CHP "may retain license plate data captured by a license plate reader (LPR) for no more than 60 days," except as evidence or for felony investigations. It may not sell the data, may use it only to locate vehicles or persons reasonably suspected of a public offense, and must report its LPR practices and disclosures in its annual auto-theft report.

Has the state tried to enforce the sharing rule?

The Attorney General's office says it has. Its January 21, 2026 press release states that on October 3, 2025 the Attorney General filed a lawsuit, California v. City of El Cajon in San Diego Superior Court, over the city's sharing of data from ALPR systems with over 100 out-of-state law enforcement agencies, which the office says is contrary to state law. On January 21, 2026 the office filed a motion to halt the sharing.

This page cannot report how the case ended. Only the press release was reviewed, and the outcome as of September 2026 was not verified.

Do these rules reach private operators, and can someone sue?

Two published Court of Appeal decisions from 2026 answer different questions, and they are described here separately.

In Bartholomew v. Parking Concepts, Inc. (Cal. Ct. App., First District, Division Five, filed February 5, 2026), the court held that a private parking-garage operator's collection and use of license plate information without implementing the statutorily required usage and privacy policy constitutes harm under the ALPR statute. The court reversed the dismissal of that claim, while the unfair competition and constitutional-privacy claims stayed dismissed. The later Mata opinion agreed with Bartholomew that a bare statutory violation is not enough, said it was skeptical of Bartholomew's "right to know" theory of harm, and did not resolve that question because the operator in Mata had published a usage and privacy policy.

In Mata v. Digital Recognition Network, Inc. (Cal. Ct. App., Fourth District, Division One, filed July 20, 2026), the court held that standing to sue under Civil Code § 1798.90.54 requires actual harm. A plaintiff whose data was collected and stored but never subject to a security breach or unauthorized access or use, and who showed no other harm, lacked standing, and summary judgment for the operator was affirmed. The opinion also states that "the ALPR statute does not restrict or place limitations on a private entity's collection or use of ALPR information" (citing Bartholomew) but that it does restrict public agencies through the public-comment and transfer rules in § 1798.90.55. Secondary reports indicate a petition for review was filed in the California Supreme Court; its status was not verified, so check whether the decision remains in effect before relying on it.

The private remedy itself is in § 1798.90.54. An individual "harmed by a violation" may sue a person who knowingly caused the harm. The court may award actual damages of not less than $2,500 in liquidated damages, punitive damages for willful or reckless disregard, attorney's fees, and equitable relief. Both decisions agree that a bare violation is not enough, but they differ on whether collecting data without any usage and privacy policy is itself harm, so a reader cannot assume that a technical violation alone supports a claim, or that it never does.

Can you request ALPR records in California?

California's public records law requires an agency to justify withholding a record by an express exemption or by showing that the public interest in nondisclosure clearly outweighs disclosure. Investigatory files of state or local police are exempt from mandatory disclosure under Gov. Code § 7923.600.

In ACLU Foundation of Southern California v. Superior Court (Cal. Aug. 31, 2017), the California Supreme Court held that ALPR scanning "does not produce records of investigations, because the scans are not conducted as part of a targeted inquiry into any particular crime or crimes." The court also held that the public interest in nondisclosure of raw scan data clearly outweighed disclosure under the catchall balancing test. It remanded on whether the data could be anonymized or redacted so that disclosure is required.

The opinion cites the older numbering, Gov. Code §§ 6254(f) and 6255(a). The current sections are 7923.600 and 7922.000. In practice, this ruling means raw scan data is difficult to obtain, while a policy, a contract, or a meeting record is a more realistic request.

What have courts said about the Fourth Amendment and ALPR data?

No California appellate holding was found that ALPR data collection is or is not a Fourth Amendment search. In People v. Gonzalez (Cal. Ct. App. Dec. 5, 2019), the defendant argued that admitting a Bay Area ALPR-database report violated the Fourth Amendment. The court said, "We need not decide whether, as the parties dispute, appellant forfeited this challenge or had a reasonable expectation of privacy in the license plate data," and held any error harmless beyond a reasonable doubt. That part of the opinion (Part I) was not certified for publication, so it is not precedent and generally cannot be cited in California courts.

What did the State Auditor find about agency policies?

The California State Auditor's Report 2019-118, dated February 13, 2020, reviewed four agencies: the Fresno Police Department, the Los Angeles Police Department, the Marin County Sheriff, and the Sacramento County Sheriff. It concluded that "the law enforcement agencies we reviewed must better protect individuals' privacy through ensuring that their policies reflect state law." It also found weaknesses in data security, sharing decisions, and user oversight. The report predates the 2023 Attorney General bulletin and the 2026 court decisions above.

What local decisions have been recorded?

The records below come from the sources named, with the dates those sources give. The list is not complete, and a status shown here can change.

• Mountain View: the city council terminated the police department's license plate camera contract, a February 24, 2026 status.
• Oakland: a December 16, 2025 council vote on the police department's network is recorded as an approval.
• San Francisco: the police department's Bulletin 24-052, dated March 20, 2024, is the record for its active program.
• Berkeley: a May 7, 2026 decision is recorded as an approval for the police department.
• Santa Cruz: the city council voted to end its contract on January 13, 2026.
• Fresno: a February 22, 2024 legislative action is recorded as an approval.
• Hayward: a May 20, 2025 legislative action is recorded as an approval.
• Santa Clara: a December 3, 2024 legislative action is recorded as an approval.

Is any California ALPR bill pending?

An earlier bill, SB 274, passed both houses in 2025 but was vetoed by the Governor on October 1, 2025. Senate Bill 1013 (2025-26), which concerns ALPR limits, was amended in the Assembly through August 27, 2026, with the last entry reading "Ordered to third reading." The legislative history, fetched September 29, 2026, shows no Assembly passage, enrollment, or chaptering, so it is not law. A formal death entry was not seen.

August 31, 2026 was the last day for each house to pass bills this session (Cal. Const. art. IV, § 10(c)), and the history re-checked September 30, 2026 still shows no Assembly passage or enrollment, so SB 1013 did not pass in the 2025-26 session.

How can you check a local system?

The statute makes several documents the place to start. Ask the agency or operator for its written usage and privacy policy, which the operator must make public, and check that it states a retention period and sharing rules. For a public agency, look for the governing body's agenda and minutes showing the required public-comment opportunity before the program began. For sharing, compare the policy with the Attorney General's 2023 bulletin. Access-log requirements exist under § 1798.90.52, but the ACLU decision suggests that raw scan data is unlikely to be released.

Frequently asked questions

Last updated: September 30, 2026. Statutes and decisions cited reflect the versions and filings reviewed on September 29, 2026.

Automated traffic enforcement cameras, which also photograph plates, are governed by separate confidentiality rules rather than the ALPR statute. For red-light cameras, Vehicle Code § 21455.5(f) provides that "photographic records made by an automated traffic enforcement system shall be confidential, and shall be made available only to governmental agencies and law enforcement agencies and only for the purposes of this article." For the speed safety system pilot programs, Vehicle Code § 22425 makes photographic and administrative records confidential, limits public agencies' use of them to the purposes of that article or assessing the system's impacts, and requires the contract with the system's manufacturer or supplier to prohibit it from "sharing, repurposing, or monetizing collected data," except as the article specifically authorizes. Both sections also let the registered owner, or the driver the owner identifies, review the photographic evidence of the alleged violation.

Section 31490 has its own rules for toll data. Its definition of personally identifiable information includes "travel pattern data," "license plate number," and "photograph," and a toll system includes a "camera-based vehicle identification system." Except as the section otherwise provides, for example for aggregated data and for sharing with other transportation agencies for interoperability, a transportation agency may not sell or otherwise provide that information to other persons or entities. Under § 31490(e) it may give the information to a law enforcement agency "only pursuant to a search warrant," with exceptions for a peace officer conducting a criminal or traffic collision investigation who has good cause to believe that the delay of seeking a warrant would cause an adverse result, and for "the date, time, and location of a vehicle license plate read" provided to a peace officer in response to a listed alert that contains the plate number. A person whose information is knowingly sold or otherwise provided in violation may sue for actual damages or $2,500 per violation, whichever is greater, or $4,000 per violation if it happened three or more times.

A separate law, the California Values Act, also bears on sharing with immigration authorities, although it never mentions plate readers. Government Code § 7284.6(a)(1)(D) bars California law enforcement agencies from using agency money or personnel for immigration enforcement purposes, including "[p]roviding personal information, as defined in Section 1798.3 of the Civil Code, about an individual, including, but not limited to, the individual's home address or work address unless that information is available to the public." The cross-referenced Civil Code § 1798.3 definition does not list license plate numbers. Section 7284.8(b) separately directs the Attorney General to publish guidance so that "any databases operated by state and local law enforcement agencies, including databases maintained for the agency by private vendors," limit the availability of their information for immigration enforcement "to the fullest extent practicable," and it says agencies "are encouraged" to adopt that guidance. This page did not review that guidance.

Frequently Asked Questions

Does California have an ALPR law?

Yes. Civil Code sections 1798.90.5 to 1798.90.55 regulate ALPR operators and end-users, effective January 1, 2016. Operators must keep security safeguards and a public usage and privacy policy.

How long can California agencies keep license plate data?

The statute sets no statewide numeric period for local agencies; each policy must state its own. The California Highway Patrol may keep license plate reader data no more than 60 days, except as evidence or for felony investigations.

Can police share ALPR data with other states or federal agencies?

Section 1798.90.55(b) allows transfers only to another public agency and only as otherwise permitted by law. The Attorney General's 2023 bulletin reads this to bar sharing with out-of-state or federal agencies.

Can I sue over an ALPR violation?

The statute allows an individual harmed by a violation to sue a person who knowingly caused the harm. In Mata (July 2026), the Court of Appeal held that standing requires actual harm. Earlier, in Bartholomew (February 2026), a different panel held that collecting plate data without implementing any usage and privacy policy is itself harm, a view Mata questioned but did not resolve.

Is the bill SB 1013 law?

Not according to the legislative history checked September 29, 2026, which shows no Assembly passage or enrollment.