An ALPR is conceptually simple: a camera, an OCR pipeline tuned for plates, and a database. The cameras live on police cruisers, traffic poles, parking enforcement vehicles, toll gantries, tow trucks, and — increasingly — on poles in private neighborhoods and shopping center entrances. Each read is a record: this plate, at this place, at this time. One read is unremarkable. Millions of reads, joined on the plate number, are a location history — where you live, where you work, whose driveway your car sits in overnight, which clinic or church or protest you drove to.
Who Operates the Networks
The ALPR ecosystem splits into three overlapping layers, and the distinctions matter because different rules (or no rules) apply to each.
Law enforcement systems. Police departments have run cruiser-mounted and fixed ALPR for two decades, originally to catch stolen cars by checking plates against "hot lists" in real time. The hot-list use is the advertised function; the retained scan database — every plate seen, not just the hits — is the surveillance function. Retention policies vary wildly by state and agency, from days to years to indefinite.
Commercial networks sold to police and HOAs. The most significant shift of the past several years is the rise of subscription ALPR — Flock Safety being the most prominent vendor — which sells inexpensive fixed cameras to police departments, homeowner associations, and businesses, and networks them. The pitch is the network effect: a department that buys in can search not just its own cameras but, where sharing is enabled, cameras across other jurisdictions. Thousands of communities in the US now host these cameras, and journalists have documented searches on these networks crossing state lines — including, in reporting by 404 Media in 2025, lookups whose stated reasons touched immigration enforcement and abortion-related investigations, far from the stolen-car use case the cameras were sold on.
Private data brokers. Repossession companies drive camera-equipped vehicles through parking lots and neighborhoods, scanning continuously. Vendors like Digital Recognition Network have aggregated billions of historical scans into commercial databases queryable by lenders, insurers, private investigators, and law enforcement. This layer has the least oversight of all: it's private data collection in public spaces, sold on the open market — the vehicular cousin of the location data broker industry.
An ALPR that checks plates against a hot list and discards non-matches is a targeted tool. The same camera retaining every read for two years is a time machine: it lets anyone with query access reconstruct the past movements of a person who was under no suspicion when the data was collected. The hardware is identical — the retention policy is the difference between the two technologies.
What the Law Says (Not Much, Unevenly)
In the United States, the baseline rule is uncomfortable: your license plate is government-mandated identification displayed in public, and courts have generally held that photographing it in public view is not a Fourth Amendment search. That logic was built for a world where following a car required a human in another car.
The cracks are appearing at the aggregation layer. In Carpenter v. United States (2018), the Supreme Court held that long-term cell-site location history is protected despite being held by a third party, reasoning that the whole of a person's movements reveals far more than any single observation. State courts have started applying that mosaic logic to plate readers — Massachusetts' highest court, in Commonwealth v. McCarthy (2020), accepted that a sufficiently extensive ALPR network could implicate constitutional protection, even while finding the sparse camera coverage in that case fell short. A handful of states (New Hampshire and Maine among the strictest) sharply limit retention of non-hit reads; many states have no ALPR statute at all. The result is a patchwork where your location history's legal protection depends on which side of a state line the camera stood.
The doctrinal question of the next decade: at what density does a network of individually lawful cameras become a collectively unconstitutional dragnet? Courts have begun asking; none has drawn the line.
The Function-Creep Pattern
ALPR is a textbook study in surveillance function creep, the same pattern we've covered with geofence warrants and push notification records:
- Sold for the sympathetic case: stolen vehicles, AMBER alerts, fleeing suspects.
- Retained beyond the case: every read kept, "just in case," because storage is cheap.
- Queried for everything else: civil matters, immigration enforcement, locating witnesses, monitoring protests — uses no city council voted on when it approved the cameras.
- Shared beyond the jurisdiction: networked vendors make a small town's cameras searchable by agencies a thousand miles away, exporting the surveillance posture of the most aggressive jurisdiction to all of them.
None of this requires bad faith by any individual officer. It requires only a database that exists, a search box, and the absence of a rule saying no.
What You Can Actually Do
Honesty first: you cannot meaningfully opt out of ALPR as an individual driver. Plate covers and obscuring sprays are illegal in most places and unreliable anyway. The realistic responses are civic and informational:
- Find out what's deployed where you live. EFF's Atlas of Surveillance project maps known ALPR deployments by agency. Public records requests can surface your local department's retention policy, sharing agreements, and audit logs — often revealing there are none.
- Push on retention and sharing, not existence. The politically winnable fight is usually not removing cameras but imposing short retention for non-hits, audit logging of queries, and prohibitions on out-of-state or civil-immigration sharing. Several cities have adopted exactly these limits after residents asked.
- Treat your car as an identifier. For threat models where vehicle tracking matters — domestic violence survivors, journalists meeting sources — assume the plate is logged and plan around the car, not the camera: park away from the destination, use transit or a rideshare for the sensitive leg. Our threat modeling guide covers how to reason about this proportionately.
- Remember the car itself now reports too. Modern vehicles transmit telematics independent of any roadside camera — see our piece on smart car privacy for that half of the problem.
The deeper point is the one that applies across modern surveillance: the protections that survive are the ones built into architecture, not policy. A camera network with a two-day retention rule is one council vote away from a two-year one. Communications protected by end-to-end encryption — the digital analogue of never collecting the data at all — don't have that failure mode. You can't always choose the architecture of the roads you drive on. Where you can choose the architecture, choose the one that doesn't keep the records.