A California appeals court decided in February that a business which scans license plates without posting a compliant privacy policy has harmed every driver it scanned, whether or not the data was ever misused. In May the state Supreme Court declined to review that decision, leaving it as binding authority — and a statute that had generated almost no private litigation in ten years now underwrites claims worth at least $2,500 a person against parking operators, retailers and property owners.
Allegations Only · No Settlement Yet
This article describes pending class action complaints and one appellate ruling on a procedural question. The claims described below are unproven allegations. No company named here has been found liable, no class has been certified, and there is nothing to claim. This page is informational and is not legal advice.
What Changed
California has regulated automated license plate recognition since Senate Bill 34 took effect in 2016. The statute, at Civil Code section 1798.90.5 and the sections that follow, tells any ALPR operator — including a private business — to secure the data and to publicly post a usage and privacy policy containing seven specific things. It also gives individuals a private right of action with damages of not less than $2,500. For most of a decade that private right went almost unused, because of a practical obstacle: what exactly is the injury when a camera photographs a plate that anyone standing in the lot could read?On February 5, 2026, the California Court of Appeal answered that question in Bartholomew v. Parking Concepts, Inc., No. A171546, a case about a parking garage. The trial court had thrown the claim out for failure to allege harm. The Court of Appeal reversed, holding that collecting and keeping plate data without implementing and publicly posting the required policy harms the people scanned, by depriving them of the ability to know who holds their data and what is done with it. No misuse, no breach and no out-of-pocket loss required. The decision was modified on February 27.
The step that turned a favorable ruling into a filing wave came three months later. On May 13, 2026 the California Supreme Court denied review, which left the decision standing as published authority binding on trial courts across the state. Until then a defendant could argue the ruling might not survive; after it, that argument was gone.
The Seven Things the Policy Has to Say
Almost every complaint in this wave is built the same way: it does not argue that scanning plates is illegal, it argues that the operator's posted policy is missing required elements. So the seven elements are effectively the checklist plaintiffs are auditing businesses against.- Authorized purposes. What the ALPR system may be used for.
- Authorized users and training. Who may access the system, and the training required before they do.
- Monitoring for misuse. How use of the system is supervised so violations can be caught.
- Data sharing. The purposes of sharing, the process for it, and the restrictions on it — the element most often cited in these complaints, because law enforcement sharing is where the disputes are.
- The custodian. The title of the official custodian or owner responsible for implementing the policy. A named title, not a department.
- Accuracy. The measures used to keep collected data accurate.
- Retention and destruction. How long the data is kept and the process for destroying it. "As long as necessary" is the formulation plaintiffs single out as non-compliant.
The pattern in the complaints is not a business with no policy at all. It is a business with a policy that reads like a general privacy notice and quietly omits three or four of these, most often the custodian, the retention period, and any real limit on who the data goes to.
Who Is Being Sued
Defense-side client alerts published since February have described the result as a litigation surge, and have told parking operators, retailers, medical centers and commercial property owners to audit their ALPR policies. The suits fall into two groups, which matters more than it might appear.| Target | Theory | Where it stands |
|---|---|---|
| The business operating the cameras | It is the ALPR operator or end-user, so the policy duty is its own regardless of who built the system | The bulk of the filings — parking operators, retail chains, property owners |
| The camera vendor | The network operator itself shares data and cannot push the statutory duty onto its customers | Javorsky v. Flock Group, Inc., filed February 26, 2026 in San Francisco Superior Court |
The vendor-level case is the more consequential of the two, because it tests who owns the obligation. The complaint alleges that Flock Safety disclaimed responsibility for ALPR Privacy Act compliance and pointed at its customers instead, and that plate data from California cameras was reachable by out-of-state and federal agencies — including an allegation that San Francisco police cameras were searched by out-of-state agencies more than 1.6 million times over a seven-month span. Those are allegations in a complaint that has not been tested, and the company disputes the claims.
On the retail side, OCA covers two of these cases in their own right: the Home Depot parking lot ALPR class action in the Northern District of California, and a parallel Flock ALPR complaint against Lowe's. Those pages carry the case numbers, the specific allegations and the procedural posture for each; this page is about the rule they all rest on.
The Question Bartholomew Left Open
There is a gap in the ruling that every one of these cases has to cross, and it has not been closed by any court.Bartholomew involved a defendant that had not implemented and posted a policy. Most of the new complaints involve defendants that did post something — it just omits required elements. The Court of Appeal expressly declined to decide whether an incomplete policy inflicts the same harm as no policy at all. Plaintiffs say the answer is obviously yes, because a policy that hides the retention period and the custodian defeats the same interest in knowing. Defendants will say a published policy plainly gives notice, that partial compliance is not the statutory violation the court was describing, and that reading it otherwise converts a disclosure statute into a trap with billion-dollar consequences for a paperwork defect.
Whoever wins that argument first will set the value of every case in the wave. Until then, treat confident claims about where this is heading — in either direction — as marketing.
State Court or Federal Court Is Not a Detail
One structural point gets lost in coverage of these filings, and it may end up mattering more than the merits.Bartholomew is a California state court decision interpreting harm under a California statute. It does not decide whether that same injury satisfies Article III of the U.S. Constitution, which is what a plaintiff needs to be in federal court at all. Under the Supreme Court's 2021 decision in TransUnion LLC v. Ramirez, a statutory violation is not automatically a concrete injury for federal standing purposes, and a purely procedural violation with no real-world consequence can fail that test even where the legislature created a right to sue.
So a case filed in California state court gets the full benefit of Bartholomew. A case filed in — or removed to — federal court has to clear a hurdle Bartholomew does not address, and a federal judge could dismiss on standing without ever reaching whether the policy complied. That divergence is worth watching as these cases sort themselves out, because the same allegations may fare very differently depending on which courthouse they land in.
What This Means If You Drive in California
Practically, nothing to do, and nothing to file. Every case in this wave is at the pleading or early litigation stage, and there is no settlement, no certified class and no claim form in any of them. Whether any produces a payout is years from being answered, and most such cases resolve for a small fraction of the damages figure in the complaint.Two things are worth doing anyway. First, ignore anyone who contacts you about an ALPR payment. New filings with a big per-person number attached reliably attract fake settlement sites and phishing messages, and there is currently no legitimate ALPR claim process to participate in. Our guide on telling a real settlement notice from a fake one covers the signs.
Second, note that the disclosure the statute requires is one you can actually go read. A business running plate cameras in California is supposed to publish its usage and privacy policy, and that policy is supposed to tell you how long it keeps the data and who it hands the data to. If you want the background on how the technology works and what the statute covers, our explainer on automated license plate recognition and California's ALPR Privacy Act goes through it.
Questions
What did Bartholomew v. Parking Concepts actually decide?
That a person can sue under California's ALPR Privacy Act based on the operator's failure to implement and publicly post the required usage and privacy policy, without showing the data was misused, breached, or that they lost money. The trial court had dismissed the claim for lack of harm; the Court of Appeal reversed, holding that being deprived of the ability to know who is collecting plate data and how it is used is itself the harm the statute addresses.
Why does the May 2026 denial of review matter?
Because it removed the main source of uncertainty. Until the California Supreme Court denied review on May 13, 2026, defendants could argue the decision might be taken up and reversed, and trial courts had a reason to wait. The denial left the Court of Appeal's decision standing as published authority, which is the practical trigger for the filings that followed.
What must a California ALPR privacy policy contain?
Civil Code section 1798.90.51 requires a publicly posted usage and privacy policy covering seven elements: the authorized purposes for using the system; who is authorized to use it and the training required; how the system is monitored for misuse; the purposes of, process for, and restrictions on sharing the data; the title of the official custodian responsible for the system; the measures used to keep data accurate; and how long data is kept plus the process for destroying it.
Is $2,500 what someone actually receives?
No. It is the statutory floor a complaint asks for per person, not a payout. No court has awarded it on a classwide basis in these cases, no class has been certified, and there is no settlement or claim form in any of them. Aggregate statutory damages are also subject to reduction on due process grounds, and most cases resolve for a fraction of the theoretical exposure.
Does this apply outside California?
The statute does not. California's ALPR Privacy Act, enacted by Senate Bill 34 in 2015, applies to ALPR operators and end-users in California, and Bartholomew interprets that statute. Other states have their own and often weaker rules. The underlying practice is nationwide, but this particular claim is a California one.
Is there anything to claim right now?
No. Every case in this wave is at the pleading or early litigation stage. There is no settlement, no certified class and no claim form anywhere in it. New filings attract fake settlement sites and phishing messages, so treat any message promising an ALPR payment as a scam.
Sources
• Bartholomew v. Parking Concepts, Inc., No. A171546 (Cal. Ct. App. Feb. 5, 2026, modified Feb. 27, 2026); California Supreme Court review denied May 13, 2026• California ALPR Privacy Act — Cal. Civ. Code § 1798.90.5 et seq. (Senate Bill 34, 2015)
• Javorsky v. Flock Group, Inc., Superior Court of California, County of San Francisco (class action complaint filed February 26, 2026)
• TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), on concrete injury and Article III standing for statutory claims
• Brownstein — California's ALPR law: litigation surge following Bartholomew
• Electronic Frontier Foundation — How police use Flock Safety's ALPR network
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
