License plate reader laws, state by state

Nothing in federal law sets a nationwide rule for how long an automated license plate reader may keep a record of your car, who may search it, or whether a warrant is needed first. What governs a camera on your street is a combination of the contract the local agency signed, that agency’s own policy, and whatever the state legislature has — or has not — passed.¹

The result is a patchwork. The table below covers 19 states whose ALPR-specific statutes we have read and verified against the official text; it is a floor, not a census, because legislatures keep adding to the list and a handful of older statutes are published only behind commercial paywalls. Among the states that have legislated, the range is enormous: New Hampshire requires plate data to be purged within three minutes of capture, while Georgia permits storage for up to 30 months. Both are current law.¹

Two further distinctions matter more than they first appear. Most of these statutes bind government agencies only, leaving private ALPR operators — retailers, homeowners associations, parking companies — largely unregulated; California and Utah are among the exceptions. ² And a retention cap constrains the agency that collected the data, not necessarily every agency that has already searched or received it.

Each row links to the statute itself. “Retention limit” is the maximum period the law allows captured plate data to be kept when it is not tied to an investigation, preservation request, or court order — most statutes allow longer retention in those cases. “Warrant” indicates whether a warrant or court order is required for at least some access: Limited means the requirement applies only in defined circumstances, such as tracking a specific individual or reaching data held by a private operator.

Last reviewed August 8, 2026 · 19 states with ALPR-specific statutes · 15 set an explicit retention limit

A state’s absence from this table means we have not verified an ALPR-specific statute there, not that none exists. And no statute is not the same as no rules: general privacy law, agency policy, and the vendor contract still apply.

Summaries below are drawn from the statutes themselves. Where a state has published its own review of how the law works in practice — Utah’s privacy officer and Virginia’s State Crime Commission both have — those reviews are cited in the sources.¹¹

Five states rewrote or created ALPR rules between mid-2025 and mid-2026, and they moved in the same direction: shorter retention, narrower permitted uses, and new duties to audit and disclose.

Virginia acted first. HB 2724, effective July 1, 2025, created a dedicated chapter of the state code requiring plate data to be purged 21 days after capture in a way that neither the agency nor its vendor can undo. It limits queries to crimes supported by reasonable suspicion, missing-person cases, and hot-list alerts, and it makes explicit that an ALPR alert by itself does not amount to reasonable suspicion for a traffic stop.³ Virginia’s State Crime Commission published a review of reader use as the law took effect.¹⁰

Washington followed in March 2026 with the Driver Privacy Act, which pairs a 21-day deletion rule with something most statutes lack: place-based limits. Agencies may not collect plate data at health care facilities, K–12 schools, places of worship, courts, or food banks, may not buy or sell it, and may reach privately held ALPR data only under a probable-cause warrant.⁴

Oregon’s SB 1516, signed March 31, 2026, sets a 30-day deletion rule and then turns to the vendor. Companies holding the data may not sell, share, or disclose it except for technical support, must encrypt it, and must produce recurring audits that agencies are required to publish within two days. Individuals may sue a vendor for intentional or grossly negligent misuse.⁵

New Mexico took a different angle. Its Driver Privacy and Safety Act, signed March 4, 2026 and effective that July, says almost nothing about retention and everything about purpose: an ALPR user may not sell, share, or allow access to plate data where it has reasonable belief the data may be used for immigration enforcement, to investigate protected health care activity, or to penalize constitutionally protected activity. Intentional violations carry a $10,000 penalty or actual damages, whichever is greater.¹⁵

Kentucky’s HB 58, signed April 10, 2026, is the most conventional of the group: a 90-day retention limit paired with an enumerated list of permitted uses, from criminal investigation to insurance-fraud work and training on redacted images.¹⁶

The sharpest recent fights have been less about how long data is kept than about who can search it. Illinois wrote the clearest rule: under 625 ILCS 5/2-130, an ALPR user may not share plate data with an out-of-state agency to investigate laws restricting reproductive health care, or laws that allow detention based on immigration status, and may not share it at all unless the requesting agency first files a written declaration to that effect.⁶

That rule was tested almost immediately. Reporting on an Illinois Secretary of State audit found that Flock Safety had run a pilot giving U.S. Customs and Border Protection access to Illinois cameras, and that hundreds of departments beyond those that had authorized it could reach the data.⁷ In San Francisco, a class action filed in February 2026 alleges that law enforcement agencies from outside California searched the police department’s Flock database more than 1.6 million times between August 2024 and February 2025; the complaint separately alleges, without putting a number to it, that California officers ran searches on behalf of federal agencies.⁸ Both episodes turn on the same structural fact: a network built for agency-to-agency search does not stop at the boundary of the state whose law created it.

Washington and Oregon both wrote federal-access limits into their 2026 laws, and Oregon tied its ALPR rules directly to the state’s existing sanctuary statutes.⁴⁵ Several of the municipal cancellations we track in our tracker of cities that dropped Flock followed disclosures of exactly this kind.

The constitutional question — whether continuous, warrantless plate collection is a Fourth Amendment search — is unresolved. The most-watched case is Schmidt v. City of Norfolk, brought by two Norfolk drivers represented by the Institute for Justice. On January 27, 2026, Judge Mark S. Davis granted summary judgment to the city, reasoning that the photographs available on a 21-day rolling basis from the city’s 176 cameras do not track the whole of a person’s movements, with captures typically separated by 45 to 50 minutes and several miles.⁹ The case is on appeal to the Fourth Circuit, where briefing closed in June 2026 and the ACLU, EFF, EPIC, and the Cato Institute have filed briefs supporting reversal.¹²

The Fifth Circuit reached the same conclusion more bluntly two months later. In United States v. Porter, decided March 17, 2026, it held that use of a plate reader “did not invade any reasonable expectation of privacy and did not constitute a search,” analogizing fixed readers to the beeper in United States v. Knotts rather than to cell-site tracking.¹³

Both rulings, however, predate the Supreme Court’s decision in Chatrie v. United States, handed down June 29, 2026, which held that officers conduct a Fourth Amendment search when they obtain a person’s cell-phone location history, extending the reasoning of Carpenter v. United States.¹⁴ Chatrie is not an ALPR case and says nothing about license plate readers. But it is the newest statement from the Court on location data, and the Fourth Circuit in Schmidt is the first appellate court positioned to weigh it against a camera network. That is why retention periods — three minutes in New Hampshire, 30 months in Georgia — are doing more legal work than they appear to: the longer and more complete the record, the closer it comes to the kind of comprehensive tracking the Court has treated as a search.

Every row in the table above was checked against the statute it cites, and every link points to an official legislative source where one is published free of charge. Georgia and Tennessee license their codes to a commercial publisher and have no free official online text, so those two rows link to a legal-reference copy instead.

This is a reference page, not legal advice, and legislatures move faster than any tracker. We review it roughly monthly and record the date above; if you find a statute we have missed, a citation that has gone stale, or a characterization you think is wrong, the corrections address is on our about page. For how the cameras themselves work, see what a Flock camera is, and to see where readers have been documented in your state, browse cameras by state and city.