Automated License Plate Reader Technology Raises Concerns Over Private Sector Compliance and Government Overreach

Automated License Plate Reader (ALPR) technology is facing increasing legal scrutiny as courts, regulators and individuals attempt to examine and expose the various ways in which license plate data is captured, collected, shared and used. Recent disputes over ALPR technology have shifted away from issues of public safety and toward whether the private sector businesses and governmental organizations, among others, that utilize ALPR adequately disclose its use and sharing, as well as implement proper safeguards around this potentially sensitive, location-based personal information.

Private Sector’s Failure to Disclose Use of ALPR Technology Can Be Sufficient to Constitute Harm to Consumers

The private sector’s use of ALPR technology is facing challenges and possible legal exposure. In February of this year, California’s First Appellate District addressed the requirements imposed by the state’s ALPR Law in Bartholomew v. Parking Concepts, Inc., and in particular addressed  what constitutes sufficient “harm” under the law to state a claim.^[1],[2] In that matter, the plaintiff alleged that a parking garage owned and operated by Parking Concepts collected his license plate data without making a privacy policy regarding the collection publicly available. First, the Court determined that the parking garage camera system constituted a ALPR system under the law – that is, that it was “a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.” But more importantly, the Court concluded that using ALPR technology without a publicly disclosed privacy policy stating when and how ALPR is collected and used violates an individual’s “right to know” of the activity, which is sufficient to allege harm under the law.

The Bartholomew decision quickly drew the attention of plaintiffs’ attorneys both in California and beyond. Because the statute provides for $2,500 in damages per violation—and, following Bartholomew, arguably requires no showing of harm beyond the violation of an individual’s “right to know”—the conditions were ripe for a surge in class action litigation.

In the wake of Bartholomew, nearly any commercial entity utilizing ALPR technology is potentially at risk: big-box retailers, grocery stores, hotels, college campuses, parking garage management companies, and the vendors of ALPR technology themselves. In just the few short months since the decision issued, scores of class actions have been filed claiming violations of the law. The allegations across many of the matters are similar in nature:  customers of businesses allege the businesses used ALPR technology to track the movements of customer vehicles without their knowledge or consent in violation of California’s ALPR Privacy Act and the California Constitution. Further, many of these suits allege that the data points collected about the consumers’ vehicles, including plate number, vehicle make, model and color, were illegally shared with law enforcement agencies and databases.

Municipalities’ Collection and Sharing of ALPR Data Questioned by California Attorney General and Private Citizens

The potential issues around ALPR technology are not limited solely to the private sector. Recently, the California Attorney General pursued litigation against the City of El Cajon alleging unlawful sharing of ALPR data with out-of-state and federal law enforcement agencies. The lawsuit highlights the AG’s concern of cross-jurisdictional access to personal data and whether the City was in compliance with state privacy regulations to the extent it did share such data. El Cajon is not alone in facing such allegations, as a number of other cities have been subjected to similar claims.

Private plaintiffs have also claimed that widespread ALPR networks create detailed tracking and location data of individuals’ movements, in essence functioning as persistent location tracking that is accessible to law enforcement. In a similar vein, privacy organizations have asserted that the City of San Jose utilized ALPR searches to permit law enforcement officers to constantly search for and reconstruct vehicle movements without judicial authorization, a process that plaintiffs contend is ripe for abuse. Other challenges to municipal ALPR programs have focused on back-end systems, including the data retention periods, search capabilities, and whether the amount of data collected and stored exceeds the purpose for collection in the first place. As concerns about ALPR technology continue to mount, several municipalities have canceled vendor contracts for the technology and discontinued ALPR use in response.

ALPR Compliance and Governance Frameworks for Businesses

Businesses and other private-sector organizations currently using or considering deploying ALPR technology should proactively evaluate their compliance obligations under state and local laws and regulations that govern sensitive personal information and location data. Initial steps toward an actionable ALPR compliance program involve:

• Evaluating and outlining the legitimate business purposes for collecting ALPR data;
• Establishing defined retention periods for ALPR data;
• Posting a privacy policy disclosing that ALPR is collected, processed and shared, if applicable, conspicuously on the business’s website and in on-location sites;
• Limiting access controls to ALPR data; and
• Reviewing any third-party vendor agreements relating to the collection, processing, use and sharing of ALPR data. 

For businesses seeking assistance evaluating their ALPR compliance requirements and governance frameworks, consultation with experienced data privacy legal counsel can help reduce regulatory and litigation exposure.

---

[1] California Civil Code §§ 1798.90.5-1798.90.55

[2] Bartholomew v. Parking Concepts, Inc., 118 Cal.App.5th 438 (Feb. 5, 2026; As modified on denial of rehearing on Feb. 27, 2026).