Glossary · Privacy

ALPR & Automated License Plate Reader Privacy (2026)

By Steve Levine · Updated May 29, 2026 · 7 min read

Quick Answer

ALPR (automated license plate recognition, also called an automated license plate reader) is camera-plus-software technology that automatically scans, reads, and records vehicle license plates, tagging each one with time, date, and location. In California, the ALPR Privacy Act (Cal. Civ. Code § 1798.90.5 et seq.) regulates who may collect that data and how, requires a publicly posted usage and privacy policy with seven mandatory elements, and lets harmed individuals sue for statutory damages of at least $2,500 per person.

What ALPR Is and How It Works

An automated license plate reader uses high-speed cameras and optical character recognition (OCR) software to scan passing vehicles, isolate the license plate, and convert the characters into machine-readable text in real time. Each read is stored as a record that typically includes the plate number, a photo of the vehicle, and the precise date, time, and GPS location of the capture — and sometimes the vehicle's make, model, color, and distinguishing features.

Unlike a traffic or red-light camera, which records a single moment only when a violation is detected, ALPR cameras read every vehicle that passes, continuously, whether or not anything is wrong. When many cameras are networked together, the individual reads can be combined into a searchable history that maps where a given vehicle has been over days, weeks, or months. That aggregation — not any single plate capture — is what raises the core privacy concern.

California's ALPR Privacy Act

California enacted its ALPR Privacy Act in 2015 (effective January 1, 2016) through Senate Bill 34, codified at Cal. Civ. Code § 1798.90.5 and following sections. The Legislature recognized that a license plate number combined with location and timestamp data, collected over multiple points in time, can reveal not just where a person is but their entire pattern of movement — often without the person ever knowing the data was collected.

The Act applies to ALPR operators (those who operate ALPR systems) and ALPR end-users (those who access the data), and — importantly — it reaches private commercial entities, not just police departments. Covered parties must maintain reasonable security procedures and practices and must publicly post a usage and privacy policy containing seven mandatory elements.

The Seven Required Policy Elements

Under the Act, an ALPR operator's publicly posted usage and privacy policy must address, at a minimum, the following:

  1. Authorized purposes. The specific purposes for which the ALPR system and the information it collects may be used.
  2. Authorized users and training. A description of who is allowed to use or access the system and the training those users must complete.
  3. Monitoring for compliance. How the system and its data are monitored to ensure the policy and the law are followed.
  4. Data-sharing rules. The purposes of, the process for, and the restrictions on sharing ALPR information with outside parties, including law enforcement.
  5. Custodian. The title of the official custodian, or owner, of the ALPR system responsible for implementing the policy.
  6. Accuracy. The measures used to keep ALPR information accurate and to correct errors.
  7. Retention and destruction. The length of time ALPR information is retained and the process for destroying it when that period ends.
A policy that simply does not exist, or that is posted but omits one or more of these elements, is what plaintiffs in recent ALPR cases point to as the violation.

Your Rights and the $2,500 Statutory Damages

The ALPR Privacy Act provides a private right of action: an individual who has been harmed by a violation can sue directly. The statute sets statutory damages of not less than $2,500 per person, and also allows for actual damages, injunctive relief, and other remedies. Statutory damages matter because they fix a floor — a plaintiff generally does not have to prove a specific out-of-pocket dollar loss to recover the statutory amount.

These are damages a court may award if a violation is proven; they are not a guaranteed payment and not money that becomes available just because a lawsuit was filed. As with any litigation, a defendant can dispute liability, and nothing is owed unless and until a court (or a settlement) says so.

Bartholomew — Is the Missing Policy Itself the Harm?

A recurring legal question in ALPR cases is whether a person is "harmed" simply by having their plate captured under a non-compliant policy, or whether they must show the data was actually misused. In Bartholomew v. Parking Concepts, Inc. (Cal. Ct. App., decided February 5, 2026, modified February 27, 2026), the California Court of Appeal held that collecting and maintaining individuals' ALPR information without implementing and publicly posting the required policy is itself a harm, because it deprives those individuals of the right to know which entities are collecting their data and how it is used.

Under that reasoning, the failure to post a compliant policy is the injury, and the $2,500 figure reflects a legislative judgment that harm here does not require a measurable monetary loss. One question the court expressly left open: whether a policy that is posted but omits some required elements causes the same harm as having no policy at all. That issue is still being litigated, and outcomes may vary case to case.

ALPR Class Actions Being Filed

ALPR privacy rules are increasingly being tested in proposed class actions against private operators — particularly retailers alleged to have run license plate cameras in their parking lots without a compliant California policy. The most prominent recent example is Home Depot, named in proposed class actions in the Northern District of California in 2026 over the alleged use of Flock Safety ALPR cameras at its California stores.

Being named in a complaint is not a finding of wrongdoing. At the complaint stage there is no settlement and no claim form — allegations have to be proven, classes have to be certified, and any recovery is typically years away if a case progresses at all. Anyone promising you an ALPR "payout" on a freshly filed case is not describing something that exists yet.

Related Terms

About This Page

General legal-information about ALPR technology and privacy law, not legal advice. Statutes and case law change, and how they apply depends on the facts of a particular situation. For the controlling text, see the California ALPR Privacy Act (Cal. Civ. Code § 1798.90.5 et seq.) and the relevant court decisions. If you think your rights were affected, consult a qualified attorney in your jurisdiction.

For more open class actions keep scrolling below.

More on Privacy & Surveillance Class Actions

More Class Actions

Google Play Children's Privacy Settlement
No Proof Privacy

Google Play Children's Privacy Settlement

$8.25M · Estimated $40–$200 cash (no proof) · U.S. kids under 13 who used Google Play apps
Duke Health MyChart Pixel Privacy Settlement
Notice / PIN Privacy

Duke Health MyChart Pixel Privacy Settlement

Pro rata cash from a $3.74M fund · Duke MyChart / MyDuke Health App users (Feb 2019 – Jun 2022)
Call-On-Doc Pixel Tracking Settlement
Notice / PIN Privacy

Call-On-Doc Pixel Tracking Settlement

Up to $20 cash · California Call-On-Doc account holders and appointment bookers · ID & PIN from notice
Delta Dental Website Tracking Settlement
Notice / PIN Privacy

Delta Dental Website Tracking Settlement

Up to $16.50 cash · deltadentalcoversme.com account holders (Jan 2021 – Jan 2025) · Class Member ID required
$10.5M Lemonade Data Disclosure Settlement
Notice / PIN Data Breach

$10.5M Lemonade Data Disclosure Settlement

Pro rata cash or up to $10,000 documented loss + 3 yrs monitoring · ~190,000 driver's license numbers exposed