Police agencies across the U.S. have deployed Automated License Plate Readers (ALPRs) to capture images of passing vehicles along with time, date, and GPS coordinates. While the technology itself isn’t new (ALPRs have existed in various forms for more than 50 years , and in the U.S. since 1998 ), the surveillance landscape has shifted dramatically. Rapid advances in artificial intelligence and national data sharing have transformed police ALPRs into an interconnected, nationwide tracking network. It is pitched to city councils by law enforcement and private vendors like Flock Safety, Motorola Solutions (Vigilant), and Axon as an essential tool for solving violent crime.
In reality, it is an inherently dangerous infrastructure of mass surveillance.
Since 2012 , EFF has worked with others to expose the severe digital rights harms of ALPR systems. For example, we’ve recently documented how these camera networks allow law enforcement to search for immigrants , track peaceful protesters , target Romani communities , and track women seeking reproductive healthcare . Police also routinely use ALPRs for low-level matters like enforcing school residency requirements or investigating noise complaints . Many officers also use ALPR databases to stalk past romantic partners . Recent EFF analysis revealed officers using the system without legitimate justification—logging search reasons like "LOL" and "LMAO."
Understandably, the public backlash to police ALPR technology is accelerating, and state lawmakers across the country are taking action.
New Hampshire enacted the nation’s first state law on ALPR use in 2007, but technological advances and misconduct have driven even more recent legislative action. In 2026 alone, six states enacted laws that limit police use of ALPRs: Connecticut , Kentucky , New Jersey , New Mexico , Oregon and Washington .
This is a good start, but far more is needed. This blog presents a framework for state legislators who want to stop ALPR mass police surveillance:
Just ban it. It is incompatible with a free society and cannot be fixed. In the absence of a flat ban, reduce its harms. Most importantly: limit police use of ALPRs to real-time comparison of passing plates to hotlists; require a warrant to place a plate on a hotlist; impose strict limits on the creation and use of those hotlists; and prohibit the storage of ALPR data (and thus prevent the subsequent search and disclosure of that data). In the absence of a prohibition on storing ALPR data, reduce its harms. Most importantly, place strict limits on police storage, search, and disclosure of ALPR data. Ban three especially dangerous police practices: placement of ALPRs near sensitive locations like hospitals; purchase of ALPR data; and use of ALPR data to try to predict crime. Require transparency about ALPR mass surveillance, including: a 30-day public notice before a city procures police ALPRs; a statewide registry of all police ALPRs; and regular, public audits and statistical reports about police usage. Ensure effective enforcement of all new ALPR restraints, including by means of a private right of action and the exclusionary rule. These policy battles often unfold locally, so state legislators must ensure that state law is a regulatory floor, never a ceiling. State preemption should never force unwanted camera networks onto communities that have chosen to reject them. Local government must retain authority to enact full bans, deny funding, reject contracts, and decommission existing camera networks.
Table of Contents The Gold Standard: Statewide Bans on ALPR Mass Surveillance Strict Limits on Real-time Use of ALPRs Limits on creating hotlists Limits on using hotlists Strict Limits on Storage, Search, and Disclosure of ALPR Data Storage limits Search limits Disclosure limits Transparency Additional Restrictions Enforcement Conclusion A Note on Scope As in our previous post on ALPR policy , our focus here is ALPR mass surveillance: the continuous dragnet collection and retention of location data on innocent drivers. Different issues are raised by automated traffic enforcement (ATE) systems, such as standalone red-light or speed cameras that solely photograph and ticket specific traffic violations, without building a searchable network about uninvolved drivers. As such, state laws against ALPR mass surveillance should not cover ATE. This is the approach in at least six states: Connecticut , Minnesota , North Carolina , Oregon , Virginia , and Washington . The most common approach is to exclude ATE from the law’s definition of “ALPR.”
Of course, ATE carries risks and demands legal restrictions too. This includes tight limits on data collection, retention, usage, and disclosure—all of which should be addressed in a different statute. Lawmakers must also actively guard against vendor efforts to piggyback mass surveillance tools onto ATE contracts.
The Gold Standard: Statewide Bans on ALPR Mass Surveillance Statutory limits cannot make ALPR mass surveillance safe. Because the technology relies on the indiscriminate recording of every driver’s movements, the risks are baked into the system itself. Also, innocent motorists will be menaced by police due to false matches , bad actors will misuse location data , and sensitive personal movements will be exposed to broad government overreach. Promising harsher penalties for officer misuse cannot fix an inherently flawed architecture. Thus, state lawmakers should pursue a complete, statewide ban on ALPR mass surveillance.
First, lawmakers should prohibit all state-level law enforcement agencies from acquiring, retaining, accessing, or using ALPRs or any data derived from them.
Second, they must impose the same prohibition on county, municipal, and other local law enforcement agencies.
These prohibitions should require any agency ending an ALPR program (both state and local) to fully decommission the programs within a strict timeframe. This includes requiring agencies to: physically remove all camera hardware; revoke all user, network, and database access credentials; permanently delete all stored location data; and require vendor certification of compliance.
Third, ban the use of state funds for state or local agencies to acquire, maintain, or access ALPR systems. This must include direct appropriations, law enforcement grants, pass-through funds, and state-administered federal funds. In August 2026, Texas Governor Greg Abbott banned state agencies from spending public funds on Flock cameras.
Fourth, ban state and local agencies from installing or operating ALPRs on state-owned highways, roadways, or public properties. In August 2026, Florida’s Department of Transportation ordered the removal of all ALPRs from the right-of-way on state highways within 30 days. The order revokes all previously approved permits to install ALPRs, and bars future permits.
An outright prohibition is the only effective way to eliminate this mass surveillance. This follows the lead of municipalities across the country that have already enacted bans . However, where there’s political resistance, state lawmakers might consider a moratorium that prevents further expansion of ALPR networks.
Strict Limits on Real-time Use of ALPRs In the absence of a ban on police ALPR mass surveillance, state legislators must restrict ALPRs to real-time comparison of passing plates to hotlists. ALPR data is simply too dangerous for police to safely store, search, and disclose. An effective way to do this, as in New Hampshire , is to require deletion of ALPR data within three minutes after collection. That means no ALPR data is stored after comparison to a hotlist, and thus that no ALPR data about unmatched cars can be searched or disclosed.
A state legislature must also reduce the harms of police use of real-time ALPRs by strictly limiting the creation and use of law enforcement hotlists.
Limits on creating hotlists Roughly speaking, there are two kinds of police hotlists . An agency might link its ALPRs to external hotlists created by another agency, such as the FBI’s National Crime Information Center (NCIC) or a state’s department of motor vehicles. Also, a police agency might link its ALPRs to its own internal hotlist, created by its own officers, of people under investigation. State legislators must strictly limit both.
First , limit the kinds of external hotlists that police agencies may link to. For example, ban police agencies from linking to the NCIC’s “ immigration violator ” hotlist, which ICE uses to hunt immigrants with the ALPRs operated by police agencies across the country.
Second , if a police agency links to external hotlists, require the agency to update that link every day. Otherwise, drivers may be detained even though they have been removed from the list. This is required by Montana , Nebraska , North Carolina , and Virginia .
Third , forbid officers from adding a plate on a hotlist, absent a warrant from a judge based on probable cause and particularity. Without this judicial check on police power, an officer stalked a potential romantic partner by placing her plate on a hotlist.
As with other laws requiring a warrant (such as the federal Wiretap Act ), there should be an exception where: (1) there is an emergency involving immediate danger of death or serious bodily injury to a person; (2) there is no time to acquire a warrant; and (3) there are grounds upon which a warrant could be granted. This exception might apply, for example, when police have probable cause to believe a child has just been abducted. In such cases, the statute must require police to seek a warrant within 48 hours, and if it is denied, to immediately remove the plate from the hotlist.
Minnesota requires a warrant or an emergency to use ALPRs “to monitor or track an individual who is the subject of an active criminal investigation.” In Maine , an ALPR system may use only information based on reasonable suspicion.
Fourth , forbid officers from adding a plate to a hotlist, except in connection with a serious violent crime. This would include investigation of a murder but not pursuit of a traffic scofflaw.
Fifth , forbid officers from adding a plate on a hotlist based, in whole or in part, on: a person’s race, ethnicity, national origin, religion, immigration status, disability, sex, gender identity, or sexual orientation; their political beliefs, associations, or participation in First Amendment-protected activity; or their pursuit of reproductive, gender-affirming, or other health care. Connecticut and Washington forbid use of ALPR systems on these grounds, and Virginia forbids tracking a person based on their protected speech.
Sixth , require officers to log their entry of a plate into a hotlist. This must include the officer’s name and agency, the date of the entry, a narrative description of the reasons for the entry, any case numbers, and an upload of the warrant authorizing the entry. Oregon requires an officer to log “the specific law enforcement purpose of the entry,” and the officer’s name.
Limits on using hotlists First , if the plate of a passing car does not match a hotlist, laws must require immediate deletion of all ALPR data about that car. New Hampshire state law requires deletion within three minutes. This is the most effective way to limit ALPRs to real-time identification of vehicles and drivers of interest to police, as opposed to amassing a dangerous database of the comings and goings of the entire driving public, available later for retrospective search by police.
Second , if the plate of a passing car does match a hotlist, then limit storage, search, and disclosure of its ALPR data to what is strictly necessary to the investigation that placed the car on the hotlist.
Third , require police officers, before stopping a car because of an apparent real-time match, to visually and independently confirm that the car’s plate number, plate issu