Existing law prohibits a public agency, which includes the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system.

This bill would provide that public agency does not include a transportation agency, a public transit operator, or a local department of transportation or public works department, as specified. The bill would, beginning January 1, 2026, require new, updated, expansions of, or addendums of contractual agreements with ALPR vendors, manufacturers, or suppliers to mandate that no default access is provided to any national ALPR database and that an agencys collected scans are by default not accessible to any other agency, and would impose new requirements on sharing between California state law enforcement agencies. The bill would authorize a law enforcement agency to use ALPR information only for purposes of locating vehicles or persons when either are reasonably suspected of being involved in the commission of a public offense. The bill would prohibit a public agency from retaining ALPR information for more than 60 days after the date of collection if it does not match information on an authorized hot list, as defined, and as of January 1, 2026, would require a public agency to delete all ALPR information that has been held for more than 60 days and does not match information on an authorized hot list within 14 days. By imposing new requirements on public agencies, which include local agencies, this bill would impose a state-mandated local program.

Existing law defines an ALPR operator as a person that operates an ALPR system, which does not include a transportation agency. Existing law defines an ALPR end-user a person that accesses or uses an ALPR system, which does not include, among other things, a transportation agency.

This bill would additionally exclude from the definitions of ALPR operator and ALPR end-user a public transit operator, a local department of transportation or public works department, or an airport or airport operator, as provided.

Existing law requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.

This bill would require those security procedures and practices to include safeguards for managing which employees can see the data from their systems, as specified, and requiring data security training and data privacy training for all employees that access ALPR information.

Existing law requires an ALPR operator and ALPR end-user to implement a usage and privacy policy that includes, among other things, a description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information.

This bill would require the usage and privacy policy to identify what purpose employees and independent contractors access and use ALPR information for. The bill would also require the Department of Justice to, contingent upon an appropriation of sufficient funds, conduct annual random audits on a public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented and are adhering to that usage and privacy policy.

Existing law requires an ALPR operator that accesses or provides access to ALPR information to require that ALPR information only be used for the authorized purposes described in the usage and privacy policy and to maintain a record of that access that includes, among other things, the purpose for accessing the information.

This bill would instead require that record of access maintained by the ALPR operator to include the case file number or task force name, as applicable, that justifies the search query, and would provide that no queries shall be allowed without a log entry with a valid and current case file number or task force name from the agency conducting the query.

The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

Existing law prohibits a public agency, which includes the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system.

This bill would provide that public agency does not include a transportation agency, a public transit operator, or a local department of transportation or public works department, as specified. The bill would, beginning January 1, 2026, require new, updated, expansions of, or addendums of contractual agreements with ALPR vendors, manufacturers, or suppliers to mandate that no default access is provided to any national ALPR database and that an agencys collected scans are by default not accessible to any other agency, and would impose new requirements on sharing between California state law enforcement agencies. The bill would authorize a law enforcement agency to use ALPR information only for purposes of locating vehicles or persons when either are reasonably suspected of being involved in the commission of a public offense. The bill would prohibit a public agency from retaining ALPR information for more than 60 days after the date of collection if it does not match information on an authorized hot list, as defined, and as of January 1, 2026, would require a public agency to delete all ALPR information that has been held for more than 60 days and does not match information on an authorized hot list within 14 days. By imposing new requirements on public agencies, which include local agencies, this bill would impose a state-mandated local program.

Existing law requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.

This bill would require those security procedures and practices to include safeguards for managing which employees can see the data from their systems, as specified, and requiring data security training and data privacy training for all employees that access ALPR information.

Existing law requires an ALPR operator and ALPR end-user to implement a usage and privacy policy that includes, among other things, a description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information.

This bill would require the usage and privacy policy to identify what purpose employees and independent contractors access and use ALPR information for. The bill would also require the Department of Justice to to, contingent upon an appropriation of sufficient funds, conduct annual random audits on a public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented and are adhering to that usage and privacy policy.

Existing law requires an ALPR operator that accesses or provides access to ALPR information to require that ALPR information only be used for the authorized purposes described in the usage and privacy policy and to maintain a record of that access that includes, among other things, the purpose for accessing the information.

This bill would instead require that record of access maintained by the ALPR operator to include the case file number or task force name, as applicable, that justifies the search query, and would provide that no queries shall be allowed without a log entry with a valid and current case file number or task force name from the agency conducting the query.

The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

Existing law prohibits a public agency, which includes the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system.

This bill would provide that public agency does not include a transportation agency, as specified. The bill would authorize a law enforcement agency to use ALPR information only for purposes of locating vehicles or persons when either are reasonably suspected of being involved in the commission of a public offense. The bill would prohibit a public agency from retaining ALPR information for more than 60 days after the date of collection if it does not match information on a an authorized hot list, as defined. defined, and as of January 1, 2026, would require a public agency to delete all ALPR information that has been held for more than 60 days and does not match information on an authorized hot list within 14 days. By imposing new requirements on public agencies, which include local agencies, this bill would impose a state-mandated local program.

Existing law requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.

This bill would require those security procedures and practices to include safeguards for managing which employees can see the data from their systems, as specified, and requiring data security training and data privacy training for all employees that access ALPR information.

Existing law requires an ALPR operator and ALPR end-user to implement a usage and privacy policy that includes, among other things, a description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information.

This bill would require the usage and privacy policy to identify what purpose employees and independent contractors access and use ALPR information for. The bill would also require the Department of Justice to conduct annual random audits on a public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented and are adhering to that usage and privacy policy.

The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

Existing law prohibits the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system.

This bill would prohibit a public agency from retaining ALPR information for more than 30 60 days after the date of collection if it does not match information on a hot list, as defined. By imposing new requirements on public agencies, which include local agencies, this bill would impose a state-mandated local program.

Existing law requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.

This bill would require those security procedures and practices to include safeguards for managing which employees can see the data from their systems, as specified, and requiring data security training and data privacy training for all employees that access ALPR information.

Existing law requires an ALPR operator and ALPR end-user to implement a usage and privacy policy that includes, among other things, a description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information.

This bill would require the usage and privacy policy to identify what purpose employees and independent contractors access and use ALPR information for. The bill would also require the Department of Justice to annually audit any conduct annual random audits on a public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented that usage and privacy policy.

The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

Existing law prohibits the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system.

This bill would, in compliance with specified laws, would prohibit a public agency from using an ALPR system to gather geolocation data at specified locations for immigration enforcement purposes and retaining ALPR information for more than 30 days, except in specified circumstances. days after the date of collection if it does not match information on a hot list, as defined. By imposing new requirements on public agencies, which include local agencies, this bill would impose a state-mandated local program.

Existing law requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.

This bill would require those security procedures and practices to include safeguards for managing which employees can see the data from their systems, as specified, and requiring data security training and data privacy training for all employees that access ALPR information.

Existing law requires an ALPR operator and ALPR end-user to implement a usage and privacy policy that includes, among other things, a description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information.

This bill would require the usage and privacy policy to identify what purpose employees and independent contractors access and use ALPR information for. The bill would also require the Department of Justice to annually audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented that usage and privacy policy.

The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

Existing law prohibits the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system.

This bill would, in compliance with specified laws, prohibit a public agency from entering into a contract to share ALPR information with a foreign jurisdiction or data broker, as defined, for immigration enforcement purposes, continuing any contract to share ALPR information with a foreign jurisdiction or data broker if the public agency knows that the ALPR information is being used for immigration enforcement purposes, using an ALPR system to gather geolocation data at specified locations for immigration enforcement purposes, and, if the public agency is a law enforcement agency, collecting or purposes and retaining ALPR information unless that information is related to a criminal investigation or to an individual suspected of a crime. for more than 30 days, except in specified circumstances. By imposing new requirements on public agencies, which include local agencies, this bill would impose a state-mandated local program.

Existing law requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.

This bill would require those security procedures and practices to include safeguards for managing which employees can see the data from their systems, as specified, and requiring data security training and data privacy training for all employees that access ALPR information. The bill would also require an ALPR operator or ALPR end user that is a law enforcement agency to establish a maximum data retention period for ALPR information.

Existing law requires an ALPR operator and ALPR end-user to implement a usage and privacy policy that includes, among other things, a description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information.

This bill would require the usage and privacy policy to identify what purpose employees and independent contractors access and use ALPR information for. The bill would also require the Department of Justice to annually audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented that usage and privacy policy.

The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

Existing law prohibits the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system.

This bill would state the intent of the Legislature to enact legislation that, among other things, imposes privacy protection requirements on cities, counties, and entities that use ALPR data. would, in compliance with specified laws, prohibit a public agency from entering into a contract to share ALPR information with a foreign jurisdiction or data broker, as defined, for immigration enforcement purposes, continuing any contract to share ALPR information with a foreign jurisdiction or data broker if the public agency knows that the ALPR information is being used for immigration enforcement purposes, using an ALPR system to gather geolocation data at specified locations for immigration enforcement purposes, and, if the public agency is a law enforcement agency, collecting or retaining ALPR information unless that information is related to a criminal investigation or to an individual suspected of a crime. By imposing new requirements on public agencies, which include local agencies, this bill would impose a state-mandated local program.

Existing law prohibits the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system.

This bill would state the intent of the Legislature to enact legislation that, among other things, imposes privacy protection requirements on cities, counties, and entities that use ALPR data.

 VETO  

Bill No: SB 274

Author: Cervantes (D), et al.

Enrolled: 9/17/25

Vote: 27

SENATE JUDICIARY COMMITTEE: 10-2, 4/22/25

AYES: Umberg, Arreguín, Ashby, Caballero, Durazo, Laird, Stern, Wahab, Weber Pierson, Wiener

NOES: Niello, Valladares

NO VOTE RECORDED: Allen

SENATE PUBLIC SAFETY COMMITTEE: 5-1, 4/29/25

AYES: Arreguín, Caballero, Gonzalez, Pérez, Wiener

NOES: Seyarto

SENATE APPROPRIATIONS COMMITTEE: 5-1, 5/23/25

AYES: Caballero, Cabaldon, Grayson, Richardson, Wahab

NOES: Seyarto

NO VOTE RECORDED: Dahle

SENATE FLOOR: 28-6, 9/13/25

AYES: Allen, Archuleta, Arreguín, Ashby, Becker, Blakespear, Cabaldon, Caballero, Cervantes, Cortese, Durazo, Gonzalez, Grayson, Hurtado, Laird, Limón, McGuire, McNerney, Menjivar, Padilla, Pérez, Reyes, Richardson, Rubio, Smallwood-Cuevas, Wahab, Weber Pierson, Wiener

NOES: Grove, Jones, Niello, Ochoa Bogh, Seyarto, Strickland

NO VOTE RECORDED: Alvarado-Gil, Choi, Dahle, Stern, Umberg, Valladares

ASSEMBLY FLOOR: 41-29, 9/13/25 - See last page for vote

SUBJECT: Automated license plate recognition systems

SOURCE: Author

DIGEST:

This bill requires operators and end-users of automated license plate recognition (ALPR) systems to bolster their safeguards relating to employee access and usage of such systems. This bill requires the Department of Justice (DOJ) to audit public agency operators and end-users annually to ensure compliance with their usage and privacy policies, as provided. This bill places retention limits on ALPR data, with exceptions.

ANALYSIS:

Existing law:

1. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (California. Constitution. Article. I, § 1.)
2. Defines “automated license plate recognition system” or “ALPR system” to mean a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data. “ALPR information” means information or data collected through the use of an ALPR system. “ALPR operator” means a person that operates an ALPR system, except as specified. “ALPR end-user” means a person that accesses or uses an ALPR system, except as specified. The definitions exclude transportation agencies when subject to Section 31490 of the Streets and Highways Code. (Civil (Civ.) Code § 1798.90.5.)
3. Requires an ALPR operator to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. ALPR operators must implement usage and privacy policies in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. It further requires the policies to include, at a minimum, certain specified elements. (Civ. Code § 1798.90.51.)
4. Requires an ALPR operator, if it accesses or provides access to ALPR information, to do both of the following:
   1. Maintain a record of that access, as specified.
   2. Require that ALPR information only be used for the authorized purposes described in the usage and privacy policy. (Civ. Code § 1798.90.52.)
5. Requires ALPR end-users to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. ALPR end-users must implement usage and privacy policies in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. It further requires the policies to include, at a minimum, certain elements. (Civ. Code § 1798.90.53.)
6. Provides that a public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law. For purposes of this section, the provision of data hosting or towing services shall not be considered the sale, sharing, or transferring of ALPR information. (Civ. Code § 1798.90.55.)
7. Authorizes the Department of the California Highway Patrol to retain license plate data captured by a license plate reader for no more than 60 days, except in circumstances when the data is being used as evidence or for all felonies being investigated, including, but not limited to, auto theft, homicides, kidnapping, burglaries, elder and juvenile abductions, Amber Alerts, and Blue Alerts. (Vehicle (Veh.) Code § 2413(b).)

This bill:

1. Provides that the current requirements for ALPR operators and end-users to maintain reasonable security procedures and practices must include:
   1. Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.
   2. Requiring data security training and data privacy training for all employees that access ALPR information.
2. Requires DOJ to conduct audits of public agency ALPR operators and end-users, as provided.
3. Requires that the usage and privacy policies must indicate the purpose for which specified employees and contractors are granted access to, and permission to use, ALPR information.
4. Prohibits a public agency from retaining ALPR information that does not match information on a hot list for more than 60 days after the date of collection.

Background

ALPR systems are searchable computerized databases resulting from the operation of one or more cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data. The cameras can be mobile, e.g. mounted on patrol cars, or fixed, e.g. mounted on light poles. ALPR systems allow for the widespread and systematic collection of license plate information. ALPR data can have legitimate uses, including for law enforcement purposes. Currently, at least 230 police and sheriff departments in California use an ALPR system, with at least three dozen more planning to use them. While such systems are useful, there are serious privacy concerns associated with the systematic collection, storage, disclosure, sharing, and use of ALPR data.

Current law requires operators of these systems and those using the data to implement usage and privacy policies. However, concerns have remained about the widespread collection of this data and the wildly inconsistent and opaque ways the data is used, stored, and destroyed. A scathing report from the California State Auditor confirms that police departments in the state are not complying with existing law and recommends further regulation of these systems. In fact, Attorney General Rob Bonta has recently filed a lawsuit against the El Cajon police department for “repeatedly violating state law by sharing [ALPR data] with law enforcement agencies in more than two dozen states.”^[1]

This bill implements some of the report’s recommendations by providing for audits and requiring more specific safeguards regarding employee access to ALPR systems and provides more authority for DOJ to oversee these systems. ALPR information cannot be retained by public agencies for longer than 60 days if it does not match information on a hot list.

This bill is author-sponsored. It is supported by the California Public Defenders Association. It is opposed by a coalition of law enforcement groups. For a more thorough assessment, please see the Senate Judiciary Committee analysis of this bill.

Comment

California State Auditor report uncovers disturbing lack of compliance, oversight. In response to the growing concerns with ALPR systems, the Joint Legislative Audit Committee tasked the California State Auditor with conducting an audit of law enforcement agencies’ use of ALPR systems and data.

The 2020 report focused on four law enforcement agencies that have ALPR systems in place.^[2] The report found that “the agencies have risked individuals’ privacy by not making informed decisions about sharing ALPR images with other entities, by not considering how they are using ALPR data when determining how long to keep it, by following poor practices for granting their staff access to the ALPR systems, and by failing to audit system use.” In addition, the audit found that three of the four agencies failed to establish ALPR policies that included all of the elements required by SB 34. All three failed to detail who had access to the systems and how it will monitor the use of the ALPR systems to ensure compliance with privacy laws. Other elements missing were related to restrictions on the sale of the data and the process for data destruction. The fourth entity, the Los Angeles Police Department, did not even have an ALPR policy.

The Auditor’s report calls into question how these systems are being run, how the data is being protected, and what is being done with the data. The report reveals that agencies commingled standard ALPR data with criminal justice information and other sensitive personal information about individuals, heightening the need for stronger security measures and more circumscribed access and use policies.

According to the author:

ALPRs are a form of location surveillance, the data they collect can reveal our travel patterns and daily routines, the places we visit, and the people with whom we associate and love. Along with the threat to civil liberties, these data systems pose significant security risks. There have been multiple known breaches of ALPR data and technology in recent years, indicating potential cybersecurity threats.

In a climate where the current federal administration is pursuing mass deportations of U.S. citizens and undocumented individuals alike, Automated License Plate Recognition (ALPR) is a powerful surveillance technology that can invade the privacy of all individuals and violate the rights of entire communities. When considered in bulk, ALPR data can form an intimate picture of a driver’s activities and even deter First Amendment-protected activities. This kind of targeted tracking threatens to chill fundamental freedoms of speech. ICE’s contract allowing access to ALPR databases has emerged at a critical moment when concerns are escalating regarding the implications of data collection and retention practices, as well as the ongoing operations of immigration enforcement. These developments threaten to undermine the foundational goals of sanctuary city laws meant to protect vulnerable immigrant communities within our state.

ALPR technology also poses a risk to individuals who frequent sensitive locations like health care facilities, immigration clinics, gun shops, labor union halls, protest sites, and places of worship. Using this technology to monitor and target vehicles in these areas can create a chilling effect, discouraging individuals from seeking necessary services or participating in civic engagement due to fear of being tracked or apprehended by immigration authorities. Ultimately, these practices not only compromise community trust but also undermine the very principles of safety and protection that sanctuary laws aim to uphold.

Most ALPR data is stored in databases for extended periods, often up to five years. While police departments typically maintain these databases, they are frequently managed by private companies. Law enforcement agencies that do not have their own ALPR systems can access data collected by other agencies through regional sharing systems and networks operated by these private firms. Senate Bill 274 would prohibit public agencies from using ALPR systems to collect geolocation data at specific locations for immigration enforcement purposes and would limit the retention of ALPR information to no more than 30 days.

The temptation to “collect it all” should never overshadow the critical responsibility to “protect it all.” Senate Bill 274 is a significant legislative measure aimed at establishing robust safeguards and crucial oversight regarding the use of ALPR throughout our state. This bill is designed to ensure that the privacy of Californians is respected and preserved, while also maintaining compliance with existing sanctuary laws that safeguard vulnerable communities. Under this bill, public safety agencies will be required to collect only the data necessary for legitimate criminal investigations, thereby preventing any potential misuse of ALPR technology. Specifically, the legislation prohibits the use of ALPR information for immigration enforcement purposes, ensuring that local law enforcement agencies do not overreach or compromise the trust of the communities they serve. By implementing these measures, Senate Bill 274 aims to strike a balance between enhancing public safety and protecting individual privacy rights in our increasingly digitized world.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

According to the Senate Appropriations Committee:

• Department of Justice (DOJ): Unknown, potentially significant workload costs pressures (General Fund) to the DOJ to audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented a usage and privacy policy.

State and Local Agencies: Unknown, potentially significant costs (General Fund, local funds) to state and local agencies, including any law enforcement agency that uses ALPRs. If the Commission on State Mandates determines these costs to constitute a reimbursable state mandate, the state may need to reimburse these local costs.

According to the Assembly Appropriations Committee:

1. Ongoing annual costs (General Fund) of an unknown but substantial amount, likely in the high hundreds of thousands of dollars annually, to DOJ to conduct annual random audits of each public agency that is an ALPR operator or end-user. The DOJ did not provide its estimate of costs, but affirmed it interprets the bill as requiring DOJ to conduct an annual in-person audit of each public agency that is an ALPR operator or end-user to determine whether the agency has complied with the requirements of state law and with the agency’s own privacy policy.
2. Annual costs (various funds) of an unknown amount, but likely in the hundreds of thousands of dollars at least, to each state agency that operates ALPRs, such as the California Highway Patrol.
3. Potential annual costs (General Fund) of an unknown amount, but likely in the hundreds of thousands of dollars at least, to reimburse local public agency costs to comply with this bill. The state would incur these costs only if a local agency or agencies filed a claim with the Commission on State Mandates and the commission determined the state liable for reimbursement.

SUPPORT: (Verified 10/7/25)

California Public Defenders Association

Surveillance Technology Oversight Project

OPPOSITION: (Verified 10/7/25)

Arcadia Police Officers' Association

Brea Police Association

Burbank Police Officers' Association

California Association of School Police Chiefs

California Coalition of School Safety Professionals

California Narcotic Officers' Association

California Police Chiefs Association

California Reserve Peace Officers Association

California State Sheriffs' Association

City of Los Alamitos

City of Thousand Oaks

Claremont Police Officers Association

Corona Police Officers Association

Culver City Police Officers' Association

Electronic Frontier Foundation

Fullerton Police Officers' Association

Los Angeles School Police Management Association

Los Angeles School Police Officers Association

Murrieta Police Officers' Association

Newport Beach Police Association

Palos Verdes Police Officers Association

Placer County Deputy Sheriffs' Association

Pomona Police Officers' Association

Riverside Police Officers Association

Riverside Sheriffs' Association

Sacramento County Sheriff Jim Cooper

Santa Ana Police Officers Association

ARGUMENTS IN SUPPORT: Surveillance Technology Oversight Project writes:

Fusion centers in California and across the nation routinely facilitate ICE’s access to ALPR data, violating state and local protections for undocumented immigrants and allowing ICE to easily and efficiently intercept the individuals it targets. Cutting off ALPR data access is essential to blocking the mass deportation of Californians.

Senate Bill 274 will hold local law enforcement accountable if it shares ALPR data in violation of California’s sanctuary laws, ending the current status quo, which allows that sharing without consequences. Beyond this, it is an important privacy measure for all Californians: SB 274 will eliminate the over-long storage of data that reveals all California drivers’ life patterns, including where they live, work, socialize, and worship.

ARGUMENTS IN OPPOSITION: A coalition of law enforcement agencies, including the California Coalition of School Safety Professionals, writes:

While we appreciate the author’s effort to permit law enforcement to access LPR data when the information is used as evidence or for all felonies being investigated, there is no way to know in advance when the LPR data will be used as evidence or for a felony that has not yet been committed.

Additionally, the restrictions imposed by SB 274 would prevent investigators from accessing the LPR data for misdemeanors, including violent misdemeanors.

As currently amended, SB 274 will significantly hamper the ability of law enforcement to effectively investigate crimes throughout the state by requiring the deletion of LPR data after 30 days, thereby preventing investigators from using the LPR data to investigate crimes which occurred more than 30 days ago.

GOVERNOR'S VETO MESSAGE:

To the Members of the California State Senate:

I am returning Senate Bill 274 without my signature.

This bill restricts the use and sharing of automated license plate reader (ALPR) data, including by placing a default 60-day limit on how long public entities may retain ALPR data.

I appreciate the author's intent to prevent information regarding a person's whereabouts from falling into the wrong hands. Nevertheless, this measure does not strike the delicate balance between protecting individual privacy and ensuring public safety. For example, it may not be apparent, particularly win respect to cold cases, that license plate data is needed to solve a crime until after the 60-day retention period has elapsed. Conversely, restrictions on interagency data sharing may impair solving crimes in real time, such as highway shootings, where the suspect may be rapidly crossing jurisdictional boundaries.

Further, by restricting law enforcement agencies' use of ALPR information only for locating persons or vehicles suspected of involvement in crimes, this bill would prevent the use of this information to locate missing persons.

This bill also creates cost pressures, which are not accounted for in this year's budget, by requiring the Department of Justice to conduct random audits of public entities in order to ensure compliance with this bill. In partnership with the Legislature this year, my Administration has enacted a balanced budget that recognizes the challenging fiscal landscape our state faces while maintaining our commitment to working families and our most vulnerable communities. With significant fiscal pressures and the federal government's hostile economic policies, it is vital that we remain disciplined when considering bills with significant fiscal implications that are not included in the budget, such as this measure.

ASSEMBLY FLOOR: 41-29, 9/13/25

AYES: Addis, Aguiar-Curry, Alvarez, Arambula, Ávila Farías, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Carrillo, Connolly, Elhawary, Fong, Gabriel, Garcia, Gipson, Mark González, Haney, Harabedian, Hart, Jackson, Kalra, Lee, Lowenthal, McKinnor, Ortega, Pellerin, Quirk-Silva, Celeste Rodriguez, Rogers, Schultz, Sharp-Collins, Solache, Valencia, Ward, Wicks, Wilson, Zbur, Rivas

NOES: Alanis, Bains, Castillo, Chen, Davies, DeMaio, Dixon, Ellis, Flora, Gallagher, Jeff Gonzalez, Hadwick, Hoover, Irwin, Johnson, Krell, Lackey, Macedo, Pacheco, Patterson, Petrie-Norris, Ramos, Ransom, Michelle Rodriguez, Blanca Rubio, Sanchez, Ta, Tangipa, Wallis

NO VOTE RECORDED: Ahrens, Calderon, Caloza, Muratsuchi, Nguyen, Papan, Patel, Schiavo, Soria, Stefani

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

10/8/25 10:05:27

**** END ****

1. Wendy Fry, California sues, says El Cajon police are illegally sharing license plate info with other agencies (October 6, 2025) Associated Press, https://apnews.com/article/bill-wells-el-cajon-general-news-california-lawsuits-a1f63d67bcfca48ef58e77e2474c2567. ↑

2. Automated License Plate Readers, To Better Protect Individuals’ Privacy, Law Enforcement Must Increase Its Safeguards for the Data It Collects (February 2020) California State Auditor, https://www.auditor.ca.gov/pdfs/reports/2019-118.pdf. ↑

 UNFINISHED BUSINESS  

Bill No: SB 274

Author: Cervantes (D), et al.

Amended: 9/5/25 in Assembly

Vote: 21

SENATE JUDICIARY COMMITTEE: 10-2, 4/22/25

AYES: Umberg, Arreguín, Ashby, Caballero, Durazo, Laird, Stern, Wahab, Weber Pierson, Wiener

NOES: Niello, Valladares

NO VOTE RECORDED: Allen

SENATE PUBLIC SAFETY COMMITTEE: 5-1, 4/29/25

AYES: Arreguín, Caballero, Gonzalez, Pérez, Wiener

NOES: Seyarto

SENATE APPROPRIATIONS COMMITTEE: 5-1, 5/23/25

AYES: Caballero, Cabaldon, Grayson, Richardson, Wahab

NOES: Seyarto

NO VOTE RECORDED: Dahle

SENATE FLOOR: 26-10, 6/3/25

AYES: Archuleta, Arreguín, Ashby, Becker, Blakespear, Cabaldon, Caballero, Cervantes, Cortese, Durazo, Gonzalez, Grayson, Laird, Limón, McGuire, McNerney, Menjivar, Padilla, Pérez, Richardson, Rubio, Smallwood-Cuevas, Umberg, Wahab, Weber Pierson, Wiener

NOES: Alvarado-Gil, Choi, Dahle, Grove, Jones, Niello, Ochoa Bogh, Seyarto, Strickland, Valladares

NO VOTE RECORDED: Allen, Hurtado, Reyes, Stern

SENATE FLOOR: 39-0, 6/3/25

AYES: Allen, Alvarado-Gil, Archuleta, Arreguín, Ashby, Becker, Blakespear, Cabaldon, Caballero, Cervantes, Choi, Cortese, Dahle, Durazo, Gonzalez, Grayson, Grove, Hurtado, Jones, Laird, Limón, McGuire, McNerney, Menjivar, Niello, Ochoa Bogh, Padilla, Pérez, Richardson, Rubio, Seyarto, Smallwood-Cuevas, Stern, Strickland, Umberg, Valladares, Wahab, Weber Pierson, Wiener

NO VOTE RECORDED: Reyes

ASSEMBLY FLOOR: 41-28, 9/13/25 – Roll call vote not available.

SUBJECT: Automated license plate recognition systems

SOURCE: Author

DIGEST:

This bill requires operators and end-users of automated license plate recognition (ALPR) systems to bolster their safeguards relating to employee access and usage of such systems. This bill requires the Department of Justice (DOJ) to audit public agency operators and end-users annually to ensure compliance with their usage and privacy policies, as provided. This bill places retention limits on ALPR data, with exceptions.

Assembly Amendments

of 9/5/25 add exceptions and additional protections.

ANALYSIS:

Existing law:

1. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (California. Constitution. Article. I, § 1.)
2. Defines “automated license plate recognition system” or “ALPR system” to mean a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data. “ALPR information” means information or data collected through the use of an ALPR system. “ALPR operator” means a person that operates an ALPR system, except as specified. “ALPR end-user” means a person that accesses or uses an ALPR system, except as specified. The definitions exclude transportation agencies when subject to Section 31490 of the Streets and Highways Code. (Civil (Civ.) Code § 1798.90.5.)
3. Requires an ALPR operator to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. ALPR operators must implement usage and privacy policies in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. It further requires the policies to include, at a minimum, certain specified elements. (Civ. Code § 1798.90.51.)
4. Requires an ALPR operator, if it accesses or provides access to ALPR information, to do both of the following:
   1. Maintain a record of that access, as specified.
   2. Require that ALPR information only be used for the authorized purposes described in the usage and privacy policy. (Civ. Code § 1798.90.52.)
5. Requires ALPR end-users to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. ALPR end-users must implement usage and privacy policies in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. It further requires the policies to include, at a minimum, certain elements. (Civ. Code § 1798.90.53.)
6. Provides that a public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law. For purposes of this section, the provision of data hosting or towing services shall not be considered the sale, sharing, or transferring of ALPR information. (Civ. Code § 1798.90.55.)
7. Authorizes the Department of the California Highway Patrol to retain license plate data captured by a license plate reader for no more than 60 days, except in circumstances when the data is being used as evidence or for all felonies being investigated, including, but not limited to, auto theft, homicides, kidnapping, burglaries, elder and juvenile abductions, Amber Alerts, and Blue Alerts. (Vehicle (Veh.) Code § 2413(b).)

This bill:

1. Provides that the current requirements for ALPR operators and end-users to maintain reasonable security procedures and practices must include:
   1. Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.
   2. Requiring data security training and data privacy training for all employees that access ALPR information.
2. Requires DOJ to conduct audits of public agency ALPR operators and end-users, as provided.
3. Requires that the usage and privacy policies must indicate the purpose for which specified employees and contractors are granted access to, and permission to use, ALPR information.
4. Prohibits a public agency from retaining ALPR information that does not match information on a hot list for more than 60 days after the date of collection.

Background

ALPR systems are searchable computerized databases resulting from the operation of one or more cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data. The cameras can be mobile, e.g. mounted on patrol cars, or fixed, e.g. mounted on light poles. ALPR systems allow for the widespread and systematic collection of license plate information. ALPR data can have legitimate uses, including for law enforcement purposes. Currently, at least 230 police and sheriff departments in California use an ALPR system, with at least three dozen more planning to use them. While such systems are useful, there are serious privacy concerns associated with the systematic collection, storage, disclosure, sharing, and use of ALPR data.

Current law requires operators of these systems and those using the data to implement usage and privacy policies. However, concerns have remained about the widespread collection of this data and the wildly inconsistent and opaque ways the data is used, stored, and destroyed. A report from the California State Auditor confirms that police departments in the state are not complying with existing law and recommends further regulation of these systems.

This bill implements some of the report’s recommendations by providing for audits and requiring more specific safeguards regarding employee access to ALPR systems and provides more authority for DOJ to oversee these systems. ALPR information cannot be retained by public agencies for longer than 60 days if it does not match information on a hot list.

This bill is author-sponsored. It is supported by the California Public Defenders Association. It is opposed by a coalition of law enforcement groups. For a more thorough assessment, please see the Senate Judiciary Committee analysis of this bill.

Comment

California State Auditor report uncovers disturbing lack of compliance, oversight. In response to the growing concerns with ALPR systems, the Joint Legislative Audit Committee tasked the California State Auditor with conducting an audit of law enforcement agencies’ use of ALPR systems and data.

The 2020 report focused on four law enforcement agencies that have ALPR systems in place.^[1] The report found that “the agencies have risked individuals’ privacy by not making informed decisions about sharing ALPR images with other entities, by not considering how they are using ALPR data when determining how long to keep it, by following poor practices for granting their staff access to the ALPR systems, and by failing to audit system use.” In addition, the audit found that three of the four agencies failed to establish ALPR policies that included all of the elements required by SB 34. All three failed to detail who had access to the systems and how it will monitor the use of the ALPR systems to ensure compliance with privacy laws. Other elements missing were related to restrictions on the sale of the data and the process for data destruction. The fourth entity, the Los Angeles Police Department, did not even have an ALPR policy.

The Auditor’s report calls into question how these systems are being run, how the data is being protected, and what is being done with the data. The report reveals that agencies commingled standard ALPR data with criminal justice information and other sensitive personal information about individuals, heightening the need for stronger security measures and more circumscribed access and use policies.

According to the author:

ALPRs are a form of location surveillance, the data they collect can reveal our travel patterns and daily routines, the places we visit, and the people with whom we associate and love. Along with the threat to civil liberties, these data systems pose significant security risks. There have been multiple known breaches of ALPR data and technology in recent years, indicating potential cybersecurity threats.

In a climate where the current federal administration is pursuing mass deportations of U.S. citizens and undocumented individuals alike, Automated License Plate Recognition (ALPR) is a powerful surveillance technology that can invade the privacy of all individuals and violate the rights of entire communities. When considered in bulk, ALPR data can form an intimate picture of a driver’s activities and even deter First Amendment-protected activities. This kind of targeted tracking threatens to chill fundamental freedoms of speech. ICE’s contract allowing access to ALPR databases has emerged at a critical moment when concerns are escalating regarding the implications of data collection and retention practices, as well as the ongoing operations of immigration enforcement. These developments threaten to undermine the foundational goals of sanctuary city laws meant to protect vulnerable immigrant communities within our state.

ALPR technology also poses a risk to individuals who frequent sensitive locations like health care facilities, immigration clinics, gun shops, labor union halls, protest sites, and places of worship. Using this technology to monitor and target vehicles in these areas can create a chilling effect, discouraging individuals from seeking necessary services or participating in civic engagement due to fear of being tracked or apprehended by immigration authorities. Ultimately, these practices not only compromise community trust but also undermine the very principles of safety and protection that sanctuary laws aim to uphold.

Most ALPR data is stored in databases for extended periods, often up to five years. While police departments typically maintain these databases, they are frequently managed by private companies. Law enforcement agencies that do not have their own ALPR systems can access data collected by other agencies through regional sharing systems and networks operated by these private firms. Senate Bill 274 would prohibit public agencies from using ALPR systems to collect geolocation data at specific locations for immigration enforcement purposes and would limit the retention of ALPR information to no more than 30 days.

The temptation to “collect it all” should never overshadow the critical responsibility to “protect it all.” Senate Bill 274 is a significant legislative measure aimed at establishing robust safeguards and crucial oversight regarding the use of ALPR throughout our state. This bill is designed to ensure that the privacy of Californians is respected and preserved, while also maintaining compliance with existing sanctuary laws that safeguard vulnerable communities. Under this bill, public safety agencies will be required to collect only the data necessary for legitimate criminal investigations, thereby preventing any potential misuse of ALPR technology. Specifically, the legislation prohibits the use of ALPR information for immigration enforcement purposes, ensuring that local law enforcement agencies do not overreach or compromise the trust of the communities they serve. By implementing these measures, Senate Bill 274 aims to strike a balance between enhancing public safety and protecting individual privacy rights in our increasingly digitized world.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

According to the Senate Appropriations Committee:

• Department of Justice (DOJ): Unknown, potentially significant workload costs pressures (General Fund) to the DOJ to audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented a usage and privacy policy.

State and Local Agencies: Unknown, potentially significant costs (General Fund, local funds) to state and local agencies, including any law enforcement agency that uses ALPRs. If the Commission on State Mandates determines these costs to constitute a reimbursable state mandate, the state may need to reimburse these local costs.

According to the Assembly Appropriations Committee:

1. Ongoing annual costs (General Fund) of an unknown but substantial amount, likely in the high hundreds of thousands of dollars annually, to DOJ to conduct annual random audits of each public agency that is an ALPR operator or end-user. The DOJ did not provide its estimate of costs, but affirmed it interprets the bill as requiring DOJ to conduct an annual in-person audit of each public agency that is an ALPR operator or end-user to determine whether the agency has complied with the requirements of state law and with the agency’s own privacy policy.
2. Annual costs (various funds) of an unknown amount, but likely in the hundreds of thousands of dollars at least, to each state agency that operates ALPRs, such as the California Highway Patrol.
3. Potential annual costs (General Fund) of an unknown amount, but likely in the hundreds of thousands of dollars at least, to reimburse local public agency costs to comply with this bill. The state would incur these cost only if a local agency or agencies filed a claim with the Commission on State Mandates and the commission determined the state liable for reimbursement.

SUPPORT: (Verified 9/11/25)

California Public Defenders Association

Surveillance Technology Oversight Project

OPPOSITION: (Verified 9/11/25)

Arcadia Police Officers' Association

Brea Police Association

Burbank Police Officers' Association

California Association of School Police Chiefs

California Coalition of School Safety Professionals

California Narcotic Officers' Association

California Police Chiefs Association

California Reserve Peace Officers Association

California State Sheriffs' Association

City of Los Alamitos

City of Thousand Oaks

Claremont Police Officers Association

Corona Police Officers Association

Culver City Police Officers' Association

Electronic Frontier Foundation

Fullerton Police Officers' Association

Los Angeles School Police Management Association

Los Angeles School Police Officers Association

Murrieta Police Officers' Association

Newport Beach Police Association

Palos Verdes Police Officers Association

Placer County Deputy Sheriffs' Association

Pomona Police Officers' Association

Riverside Police Officers Association

Riverside Sheriffs' Association

Sacramento County Sheriff Jim Cooper

Santa Ana Police Officers Association

ARGUMENTS IN SUPPORT: Surveillance Technology Oversight Project writes:

Fusion centers in California and across the nation routinely facilitate ICE’s access to ALPR data, violating state and local protections for undocumented immigrants and allowing ICE to easily and efficiently intercept the individuals it targets. Cutting off ALPR data access is essential to blocking the mass deportation of Californians.

Senate Bill 274 will hold local law enforcement accountable if it shares ALPR data in violation of California’s sanctuary laws, ending the current status quo, which allows that sharing without consequences. Beyond this, it is an important privacy measure for all Californians: SB 274 will eliminate the over-long storage of data that reveals all California drivers’ life patterns, including where they live, work, socialize, and worship.

ARGUMENTS IN OPPOSITION: A coalition of law enforcement agencies, including the California Coalition of School Safety Professionals, writes:

While we appreciate the author’s effort to permit law enforcement to access LPR data when the information is used as evidence or for all felonies being investigated, there is no way to know in advance when the LPR data will be used as evidence or for a felony that has not yet been committed.

Additionally, the restrictions imposed by SB 274 would prevent investigators from accessing the LPR data for misdemeanors, including violent misdemeanors.

As currently amended, SB 274 will significantly hamper the ability of law enforcement to effectively investigate crimes throughout the state by requiring the deletion of LPR data after 30 days, thereby preventing investigators from using the LPR data to investigate crimes which occurred more than 30 days ago.

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

9/13/25 0:32:39

**** END ****

1. Automated License Plate Readers, To Better Protect Individuals’ Privacy, Law Enforcement Must Increase Its Safeguards for the Data It Collects (February 2020) California State Auditor, https://www.auditor.ca.gov/pdfs/reports/2019-118.pdf. ↑

SENATE THIRD READING

STR Bill Id:SB 274

Author:(Cervantes)

As Amended Ver:September 5, 2025

Majority vote

SUMMARY

Prohibits a public agency from retaining automated license plate reader (ALPR) information that does not match information on a hot list for more than 60 days after the date of collection.

Major Provisions

1. Defines "hot list" as a list or lists of license plates of vehicles of interest against which the ALPR system is comparing vehicles on the roadways. Authorized hot lists are limited to the National Crime Information Center list, the Stole Vehicle System, the California Department of Justice Lists, official alerts or any new alerts authorized by the Legislature.
2. Provides that a "public agency" does not include a transportation agency subject to privacy protections related to electronic tolls, and a public transit operator or local department of transportation on public works department when subject to privacy protections related to automated enforcement.
3. Requires an ALPR operator to institute safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.
4. Requires ALPR operators to require data security training and data privacy training for all employees that access ALPR information.
5. Requires the Department of Justice to conduct annual random audits on a public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented a usage and privacy policy in compliance with the law.
6. Provides that a law enforcement agency may only use an ALPR for the purposes of locating vehicles or persons when either are reasonable suspected of being involved in the commission of a public offense.
7. Requires public agencies to delete all ALPR data held more than 60 days within 14 days of January 1, 2026 if the data does not match information on an authorized hot list.
8. Requires all new, updated expansions of, or addendums of contractual agreements with ALPR vendors, manufacturers or suppliers to mandate that no default access is provided to any national ALPR database that that an agency's collected scans are by default not accessible to any other agency, starting January 1, 2026.
9. Authorizes a law enforcement agency to manually implement agency to agency sharing with other California state law enforcement agencies only as authorized by the Department of Justice General Order 2023-05.

COMMENTS

According to the United States Department of Justice, the Police Scientific Development Branch in the United Kingdom (U.K.) invented ALPR technology in 1976. The technology rose to prominence after Provisional Irish Republican Army terrorist bombings in the City of London that resulted in the establishment of a surveillance and security network around the city referred to as the "ring of steel" in 1993.

ALPR systems are capable of capturing information on up to 1,800 plates per minute at speeds of 120-160 miles per hour. According to the Brennan Center for Justice, ALPR systems can be mounted on stationary poles, moving police cruisers, and handheld devices. The devices log pictures of the vehicles, and their GPS coordinates. This data can be compared against "hot lists" to find vehicles that have been stolen or help find an abducted child.

Law enforcement agencies use of ALPR was prevalent across the United States by the mid-2000s. The 2007 Law Enforcement Management and Administrative Statistics Survey indicated that as of 2007, 48% of law enforcement agencies with more than 1,000 sworn officers were regularly using ALPR readers, with 32% of agencies with greater than 500 officers, but less than 1,000.

California's use of ALPRs and legislative response: ACLU in a 2013 report indicated that law enforcement was collecting and storing ALPR images related to individuals not suspected of a crime, and that this data could be used inappropriately to monitor the movements of individuals such as ex-spouses, neighbors, and other associates. Such information could be used to locate places people regularly visit, to determine their acquaintances, and to blackmail them based on this information.

Out of increasing concern surrounding the privacy of individuals data collected through ALPR systems, SB 34 (Hill), Chapter 532, Statutes of 2015 was enacted. SB 34 imposed a range of privacy protections on ALPR data, including requiring ALPR operators to secure information collected by ALPR systems with reasonable operational, administrative, technical, and physical safeguards to ensure confidentiality and integrity. According to Senator Hill at the time, "California law has not kept up with the rapid adoption of the technology. Except for the California Highway Patrol and transportation agencies, current California law doesn't require any privacy safeguards or establish any protocols for the use of ALPR systems. Not only has the law failed to keep up with the quick adoption of ALPR, but the entities using ALPR have also been slow in crafting their own internal policies. For example, according to the International Association of Chiefs of Police, only 48% of police agencies across the country have developed policies that govern ALPR use and privacy."

In 2019 the State Auditor reviewed four local law enforcement agencies use of ALPR and found that these agencies were accumulating massive amounts of data unrelated to criminal investigations. Also, the Auditor found that none of the agencies they reviewed were complying with the requirements set forth in SB 34, and that the Los Angeles Police Department (LAPD) had no ALPR policy at all. The other three agencies did not completely or clearly specify who has system access, who has system oversight, or how to destroy ALPR data. For example, of the 320 million images LAPD had collected, only 400,000 generated an immediate match against a hot list. In addition, the State auditor conducted a statewide survey of law enforcement agencies and found that 70% operate or plan to operate an ALPR system, and that 84% of those operating a system shared their images. The report indicates that this "raises concerns that these agencies may share the deficiencies [they] identified at the four agencies [they] reviewed."

The State Auditor found that "ALPR systems should be accessible only to employees who need the data, and accounts should be promptly disabled otherwise. However, the agencies often neglected to limit ALPR system access and have allowed accounts that should be disabled to remain active longer than is prudent. To further ensure that individuals with access do not misuse the ALPR systems, the agencies should be auditing the license plate searches that users perform, along with conducting other monitoring activities. Instead, the agencies have conducted little to no auditing and monitoring and thus have no assurance that misuse has not occurred."

The State Auditor recommended that the Department of Justice (DOJ) draft and make available on its website a policy template that local law enforcement agencies can use as a model for their ALPR policies, and that DOJ develop and issue guidance to help local law enforcement agencies identify and evaluate the types of data they are currently storing in their ALPR systems. It also suggests the Legislature set a requirement for when law enforcement agencies should delete ALPR data. The State Auditor recommended that the Legislature should establish a maximum data retention period for ALPR images.

In October of 2023, the DOJ released two information bulletins providing guidance to California state and local law enforcement agencies regarding the governance of ALPRs. According to the guidance, the DOJ believes California law prohibits ALPR information from being shared with federal agencies or local agencies outside of the state of California. The bulletin included a template use policy that recommended law enforcement agencies maintain the data for 60 days to six months. Flock Securities, the ALPR company most prominently used in California, has a 30 day retention policy.

According to the Author

"ALPRs are a form of location surveillance, the data they collect can reveal our travel patterns and daily routines, the places we visit, and the people with whom we associate and love. Along with the threat to civil liberties, these data systems pose significant security risks. There have been multiple known breaches of ALPR data and technology in recent years, indicating potential cybersecurity threats. In a climate where the current federal administration is pursuing mass deportations of U.S. citizens and undocumented individuals alike, Automated License Plate Recognition (ALPR) is a powerful surveillance technology that can invade the privacy of all individuals and violate the rights of entire communities. Aggregated location data allows law enforcement and private companies to create detailed profiles of a person's daily life. When considered in bulk, ALPR data can form an intimate picture of a driver's activities and even deter First Amendment-protected activities. This kind of targeted tracking threatens to chill fundamental freedoms of speech."

Arguments in Support

The California Public Defenders Association, writing in support of this bill, argues "Limiting use of ALPR use which could be used for immigration enforcement at sensitive locations is a positive step towards protecting these important places. California is home to more immigrants than any other state in the country. Nearly half of working households in California include immigrants and over half of all California workers are either immigrants or the children of immigrants. Immigrants are an integral part of the fabric of Californian society, contributing to its economy, culture, and workforce, and bringing innovation, and enrichment to our workplaces, schools, faith communities, and neighborhoods. Now more than ever, it is imperative to protect our immigrant community members from the federal attack on noncitizen residents."

Arguments in Opposition

The California Police Chiefs Association (CPCA), writing in opposition to this bill, argue "CPCA understands the need to protect against unscrupulous searches and unwarranted invasion of individual privacy, which is why our ALPR operations are highly audited and regulated by existing law. These protections, however, still allow law enforcement to utilize the data collected by ALPRs in a manner that is critical to solving and preventing crime in our communities. The number one deterrent that prevents crime is creating a perception that perpetrators will be caught for unlawful acts, and ALPR systems only help increase that perception.

Law enforcement agencies across the state and nation have used ALPR data to solve crimes and apprehend criminal suspects, and continue to do so today. While some cases are solved quickly using this technology, it can also be exceptionally helpful in solving crimes that have occurred deeper in the past."

FISCAL COMMENTS

According to Assembly Appropriations Committee:

1. Ongoing annual costs (General Fund) of an unknown but substantial amount, likely in the high hundreds of thousands of dollars annually, to DOJ to conduct annual random audits of each public agency that is an ALPR operator or end-user. The DOJ did not provide its estimate of costs, but affirmed it interprets the bill as requiring DOJ to conduct an annual in-person audit of each public agency that is an ALPR operator or end-user to determine whether the agency has complied with the requirements of state law and with the agency's own privacy policy.
2. Annual costs (various funds) of an unknown amount, but likely in the hundreds of thousands of dollars at least, to each state agency that operates ALPRs, such as the California Highway Patrol.
3. Potential annual costs (General Fund) of an unknown amount, but likely in the hundreds of thousands of dollars at least, to reimburse local public agency costs to comply with this bill. The state would incur these cost only if a local agency or agencies filed a claim with the Commission on State Mandates and the commission determined the state liable for reimbursement.

VOTES

SENATE FLOOR: 27-10-3

YES: Allen, Archuleta, Arreguín, Ashby, Becker, Blakespear, Cabaldon, Caballero, Cervantes, Cortese, Durazo, Gonzalez, Grayson, Laird, Limón, McGuire, McNerney, Menjivar, Padilla, Pérez, Richardson, Rubio, Smallwood-Cuevas, Umberg, Wahab, Weber Pierson, Wiener

NO: Alvarado-Gil, Choi, Dahle, Grove, Jones, Niello, Ochoa Bogh, Seyarto, Strickland, Valladares

ABS, ABST OR NV: Hurtado, Reyes, Stern

ASM TRANSPORTATION: 12-4-0

YES: Wilson, Ahrens, Bennett, Caloza, Carrillo, Hart, Jackson, Lowenthal, Papan, Ransom, Rogers, Ward

NO: Davies, Hoover, Lackey, Macedo

ASM PRIVACY AND CONSUMER PROTECTION: 9-4-2

YES: Bauer-Kahan, Bryan, Lowenthal, McKinnor, Ortega, Pellerin, Ward, Wicks, Wilson

NO: Dixon, DeMaio, Irwin, Macedo

ABS, ABST OR NV: Patterson, Petrie-Norris

ASM APPROPRIATIONS: 10-3-2

YES: Wicks, Arambula, Calderon, Caloza, Elhawary, Fong, Mark González, Ahrens, Pellerin, Solache

NO: Sanchez, Dixon, Tangipa

ABS, ABST OR NV: Pacheco, Ta

SENATE FLOOR: 39-0-1

YES: Allen, Alvarado-Gil, Archuleta, Arreguín, Ashby, Becker, Blakespear, Cabaldon, Caballero, Cervantes, Choi, Cortese, Dahle, Durazo, Gonzalez, Grayson, Grove, Hurtado, Jones, Laird, Limón, McGuire, McNerney, Menjivar, Niello, Ochoa Bogh, Padilla, Pérez, Richardson, Rubio, Seyarto, Smallwood-Cuevas, Stern, Strickland, Umberg, Valladares, Wahab, Weber Pierson, Wiener

ABS, ABST OR NV: Reyes

SENATE FLOOR: 26-10-4

YES: Archuleta, Arreguín, Ashby, Becker, Blakespear, Cabaldon, Caballero, Cervantes, Cortese, Durazo, Gonzalez, Grayson, Laird, Limón, McGuire, McNerney, Menjivar, Padilla, Pérez, Richardson, Rubio, Smallwood-Cuevas, Umberg, Wahab, Weber Pierson, Wiener

NO: Alvarado-Gil, Choi, Dahle, Grove, Jones, Niello, Ochoa Bogh, Seyarto, Strickland, Valladares

ABS, ABST OR NV: Allen, Hurtado, Reyes, Stern

UPDATED

VERSION: September 5, 2025

CONSULTANT: David Sforza / TRANS. / (916) 319-2093 FN: 0001774

SENATE THIRD READING

STR Bill Id:SB 274

Author:(Cervantes)

As Amended Ver:July 17, 2025

Majority vote

SUMMARY

Prohibits a public agency from retaining automated license plate reader (ALPR) information that does not match information on a hot list for more than 60 days after the date of collection.

Major Provisions

1. Defines "hot list" as a list or lists of license plates of vehicles of interest against which the ALPR system is comparing vehicles on the roadways. Authorized hot lists are limited to the National Crime Information Center list, the Stole Vehicle System, the California Department of Justice Lists, official alerts or any new alerts authorized by the Legislature.
2. Provides that a "public agency" does not include a transportation agency subject to privacy protections related to electronic tolls.
3. Requires an ALPR operator to institute safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.
4. Requires ALPR operators to require data security training and data privacy training for all employees that access ALPR information.
5. Requires the Department of Justice to conduct annual random audits on a public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented a usage and privacy policy in compliance with the law.
6. Provides that a law enforcement agency may only use an ALPR for the purposes of locating vehicles or persons when either are reasonable suspected of being involved in the commission of a public offense.
7. Requires public agencies to delete all ALPR data held more than 60 days within 14 days of January 1, 2026 if the data does not match information on an authorized hot list.

COMMENTS

According to the United States Department of Justice, the Police Scientific Development Branch in the United Kingdom (U.K.) invented ALPR technology in 1976. The technology rose to prominence after Provisional Irish Republican Army terrorist bombings in the City of London that resulted in the establishment of a surveillance and security network around the city referred to as the "ring of steel" in 1993.

ALPR systems are capable of capturing information on up to 1,800 plates per minute at speeds of 120-160 miles per hour. According to the Brennan Center for Justice, ALPR systems can be mounted on stationary poles, moving police cruisers, and handheld devices. The devices log pictures of the vehicles, and their GPS coordinates. This data can be compared against "hot lists" to find vehicles that have been stolen or help find an abducted child.

Law enforcement agencies use of ALPR was prevalent across the United States by the mid-2000s. The 2007 Law Enforcement Management and Administrative Statistics Survey indicated that as of 2007, 48% of law enforcement agencies with more than 1,000 sworn officers were regularly using ALPR readers, with 32% of agencies with greater than 500 officers, but less than 1,000.

California's use of ALPRs and legislative response: ACLU in a 2013 report indicated that law enforcement was collecting and storing ALPR images related to individuals not suspected of a crime, and that this data could be used inappropriately to monitor the movements of individuals such as ex-spouses, neighbors, and other associates. Such information could be used to locate places people regularly visit, to determine their acquaintances, and to blackmail them based on this information.

Out of increasing concern surrounding the privacy of individuals data collected through ALPR systems, SB 34 (Hill), Chapter 532, Statutes of 2015 was enacted. SB 34 imposed a range of privacy protections on ALPR data, including requiring ALPR operators to secure information collected by ALPR systems with reasonable operational, administrative, technical, and physical safeguards to ensure confidentiality and integrity. According to Senator Hill at the time, "California law has not kept up with the rapid adoption of the technology. Except for the California Highway Patrol and transportation agencies, current California law doesn't require any privacy safeguards or establish any protocols for the use of ALPR systems. Not only has the law failed to keep up with the quick adoption of ALPR, but the entities using ALPR have also been slow in crafting their own internal policies. For example, according to the International Association of Chiefs of Police, only 48% of police agencies across the country have developed policies that govern ALPR use and privacy."

In 2019 the State Auditor reviewed four local law enforcement agencies use of ALPR and found that these agencies were accumulating massive amounts of data unrelated to criminal investigations. Also, the Auditor found that none of the agencies they reviewed were complying with the requirements set forth in SB 34, and that the Los Angeles Police Department (LAPD) had no ALPR policy at all. The other three agencies did not completely or clearly specify who has system access, who has system oversight, or how to destroy ALPR data. For example, of the 320 million images LAPD had collected, only 400,000 generated an immediate match against a hot list. In addition, the State auditor conducted a statewide survey of law enforcement agencies and found that 70% operate or plan to operate an ALPR system, and that 84% of those operating a system shared their images. The report indicates that this "raises concerns that these agencies may share the deficiencies [they] identified at the four agencies [they] reviewed."

The State Auditor found that "ALPR systems should be accessible only to employees who need the data, and accounts should be promptly disabled otherwise. However, the agencies often neglected to limit ALPR system access and have allowed accounts that should be disabled to remain active longer than is prudent. To further ensure that individuals with access do not misuse the ALPR systems, the agencies should be auditing the license plate searches that users perform, along with conducting other monitoring activities. Instead, the agencies have conducted little to no auditing and monitoring and thus have no assurance that misuse has not occurred."

The State Auditor recommended that the Department of Justice (DOJ) draft and make available on its website a policy template that local law enforcement agencies can use as a model for their ALPR policies, and that DOJ develop and issue guidance to help local law enforcement agencies identify and evaluate the types of data they are currently storing in their ALPR systems. It also suggests the Legislature set a requirement for when law enforcement agencies should delete ALPR data. The State Auditor recommended that the Legislature should establish a maximum data retention period for ALPR images.

In October of 2023, the DOJ released two information bulletins providing guidance to California state and local law enforcement agencies regarding the governance of ALPRs. According to the guidance, the DOJ believes California law prohibits ALPR information from being shared with federal agencies or local agencies outside of the state of California. The bulletin included a template use policy that recommended law enforcement agencies maintain the data for 60 days to six months. Flock Securities, the ALPR company most prominently used in California, has a 30 day retention policy.

According to the Author

"ALPRs are a form of location surveillance, the data they collect can reveal our travel patterns and daily routines, the places we visit, and the people with whom we associate and love. Along with the threat to civil liberties, these data systems pose significant security risks. There have been multiple known breaches of ALPR data and technology in recent years, indicating potential cybersecurity threats. In a climate where the current federal administration is pursuing mass deportations of U.S. citizens and undocumented individuals alike, Automated License Plate Recognition (ALPR) is a powerful surveillance technology that can invade the privacy of all individuals and violate the rights of entire communities. Aggregated location data allows law enforcement and private companies to create detailed profiles of a person's daily life. When considered in bulk, ALPR data can form an intimate picture of a driver's activities and even deter First Amendment-protected activities. This kind of targeted tracking threatens to chill fundamental freedoms of speech."

Arguments in Support

The California Public Defenders Association, writing in support of this bill, argues "Limiting use of ALPR use which could be used for immigration enforcement at sensitive locations is a positive step towards protecting these important places. California is home to more immigrants than any other state in the country. Nearly half of working households in California include immigrants and over half of all California workers are either immigrants or the children of immigrants. Immigrants are an integral part of the fabric of Californian society, contributing to its economy, culture, and workforce, and bringing innovation, and enrichment to our workplaces, schools, faith communities, and neighborhoods. Now more than ever, it is imperative to protect our immigrant community members from the federal attack on noncitizen residents."

Arguments in Opposition

The California Police Chiefs Association (CPCA), writing in opposition to this bill, argue "CPCA understands the need to protect against unscrupulous searches and unwarranted invasion of individual privacy, which is why our ALPR operations are highly audited and regulated by existing law. These protections, however, still allow law enforcement to utilize the data collected by ALPRs in a manner that is critical to solving and preventing crime in our communities. The number one deterrent that prevents crime is creating a perception that perpetrators will be caught for unlawful acts, and ALPR systems only help increase that perception.

Law enforcement agencies across the state and nation have used ALPR data to solve crimes and apprehend criminal suspects, and continue to do so today. While some cases are solved quickly using this technology, it can also be exceptionally helpful in solving crimes that have occurred deeper in the past."

FISCAL COMMENTS

According to Assembly Appropriations Committee:

1. Ongoing annual costs (General Fund) of an unknown but substantial amount, likely in the high hundreds of thousands of dollars annually, to DOJ to conduct annual random audits of each public agency that is an ALPR operator or end-user. The DOJ did not provide its estimate of costs, but affirmed it interprets the bill as requiring DOJ to conduct an annual in-person audit of each public agency that is an ALPR operator or end-user to determine whether the agency has complied with the requirements of state law and with the agency's own privacy policy.
2. Annual costs (various funds) of an unknown amount, but likely in the hundreds of thousands of dollars at least, to each state agency that operates ALPRs, such as the California Highway Patrol.
3. Potential annual costs (General Fund) of an unknown amount, but likely in the hundreds of thousands of dollars at least, to reimburse local public agency costs to comply with this bill. The state would incur these cost only if a local agency or agencies filed a claim with the Commission on State Mandates and the commission determined the state liable for reimbursement.

VOTES

SENATE FLOOR: 27-10-3

YES: Allen, Archuleta, Arreguín, Ashby, Becker, Blakespear, Cabaldon, Caballero, Cervantes, Cortese, Durazo, Gonzalez, Grayson, Laird, Limón, McGuire, McNerney, Menjivar, Padilla, Pérez, Richardson, Rubio, Smallwood-Cuevas, Umberg, Wahab, Weber Pierson, Wiener

NO: Alvarado-Gil, Choi, Dahle, Grove, Jones, Niello, Ochoa Bogh, Seyarto, Strickland, Valladares

ABS, ABST OR NV: Hurtado, Reyes, Stern

ASM TRANSPORTATION: 12-4-0

YES: Wilson, Ahrens, Bennett, Caloza, Carrillo, Hart, Jackson, Lowenthal, Papan, Ransom, Rogers, Ward

NO: Davies, Hoover, Lackey, Macedo

ASM PRIVACY AND CONSUMER PROTECTION: 9-4-2

YES: Bauer-Kahan, Bryan, Lowenthal, McKinnor, Ortega, Pellerin, Ward, Wicks, Wilson

NO: Dixon, DeMaio, Irwin, Macedo

ABS, ABST OR NV: Patterson, Petrie-Norris

ASM APPROPRIATIONS: 10-3-2

YES: Wicks, Arambula, Calderon, Caloza, Elhawary, Fong, Mark González, Ahrens, Pellerin, Solache

NO: Sanchez, Dixon, Tangipa

ABS, ABST OR NV: Pacheco, Ta

SENATE FLOOR: 39-0-1

YES: Allen, Alvarado-Gil, Archuleta, Arreguín, Ashby, Becker, Blakespear, Cabaldon, Caballero, Cervantes, Choi, Cortese, Dahle, Durazo, Gonzalez, Grayson, Grove, Hurtado, Jones, Laird, Limón, McGuire, McNerney, Menjivar, Niello, Ochoa Bogh, Padilla, Pérez, Richardson, Rubio, Seyarto, Smallwood-Cuevas, Stern, Strickland, Umberg, Valladares, Wahab, Weber Pierson, Wiener

ABS, ABST OR NV: Reyes

SENATE FLOOR: 26-10-4

YES: Archuleta, Arreguín, Ashby, Becker, Blakespear, Cabaldon, Caballero, Cervantes, Cortese, Durazo, Gonzalez, Grayson, Laird, Limón, McGuire, McNerney, Menjivar, Padilla, Pérez, Richardson, Rubio, Smallwood-Cuevas, Umberg, Wahab, Weber Pierson, Wiener

NO: Alvarado-Gil, Choi, Dahle, Grove, Jones, Niello, Ochoa Bogh, Seyarto, Strickland, Valladares

ABS, ABST OR NV: Allen, Hurtado, Reyes, Stern

UPDATED

VERSION: July 17, 2025

CONSULTANT: David Sforza / TRANS. / (916) 319-2093 FN: 0001321

Date of Hearing: August 20, 2025

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

SBPCA Bill Id:SB 274

Author:(Cervantes) – As Amended Ver:July 17, 2025

Urgency: No State Mandated Local Program: Yes Reimbursable: Yes

SUMMARY:

This bill, among other things, generally limits to 60 days the time a public agency may retain automated license plate reader (ALPR) information.

Specifically, this bill:

1. Prohibits a public agency from retaining ALPR information that does not match information on a “hot list” for more than 60 days after the date of collection, and defines a “hot list” as a list or lists of license plates of vehicles of interest against which the ALPR system is comparing the plates of vehicles on the roadways.
2. Requires both an ALPR operator and an ALPR end-user to include among the “reasonable security procedures” required by current law (a) safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees and (b) requiring data security and data privacy training for all employees who access ALPR information.
3. Directs the Department of Justice (DOJ) to conduct annual random audits on a public agency that is an ALPR operator or an ALPR end-user to determine whether the agency has implemented a usage and privacy policy in compliance with state law and with its own privacy policy.

FISCAL EFFECT:

1. Ongoing annual costs (General Fund) of an unknown but substantial amount, likely in the high hundreds of thousands of dollars annually, to DOJ to conduct annual random audits of each public agency that is an ALPR operator or end-user. The DOJ did not provide its estimate of costs, but affirmed it interprets the bill as requiring DOJ to conduct an annual in-person audit of each public agency that is an ALPR operator or end-user to determine whether the agency has complied with the requirements of state law and with the agency’s own privacy policy.
2. Annual costs (various funds) of an unknown amount, but likely in the hundreds of thousands of dollars at least, to each state agency that operates ALPRs, such as the California Highway Patrol.
3. Potential annual costs (General Fund) of an unknown amount, but likely in the hundreds of thousands of dollars at least, to reimburse local public agency costs to comply with this bill. The state would incur these cost only if a local agency or agencies filed a claim with the Commission on State Mandates and the commission determined the state liable for reimbursement.

COMMENTS:

1. Purpose. The author describes ALPRs as “a powerful surveillance technology that can invade the privacy of all individuals and violate the rights of entire communities” and notes “known breaches of ALPR data and technology in recent years, indicating potential cybersecurity threats.” The author intends this bill to provide “robust safeguards and crucial oversight regarding the use of ALPR throughout our state” so that “the privacy of Californians is respected and preserved, while also maintaining compliance with existing laws that safeguard vulnerable communities.”
2. Background. An ALPR is an automated system that captures images of a license plates through a fixed or mobile camera. Law enforcement agencies in California use ALRPs to capture license plate numbers and compare them against a database of vehicles of interest, such as stolen vehicles and those suspected of being used in the commission of a crime. Such a database of vehicles is known as a “hot list.”

As use of ALRPs in California grew, so did concern about the use and retention of license plate images and the misuse—both real and potential—of those images. In 2013, the American Civil Liberties Union (ACLU) issued a report, “You Are Being Tracked,” that warned ALPRs “open the door to abusive tracking, enabling anyone with access to pry into the lives of his boss, his exwife, or his romantic, political, or workplace rivals.” The ACLU report also made numerous recommendations regarding ALPR data use, security and retention, including the following recommendation: law enforcement agencies must not store data about innocent people for any lengthy period.

Soon thereafter, the Legislature approved SB 34 (Hill) (Chapter 532, Statutes of 2015), which created numerous requirements regarding the privacy and use of ALPR data, including that a public agency not sell or share ALPR information, except to another public agency and only under certain circumstances, and that an operator of an ALPR system use ALRP information only for authorized purposes.

In 2019, the State Auditor audited four large law enforcement agencies (see “California State Auditor Report 2019-118”) and found, among other things:

• The four agencies had accumulated a large number of ALPR data, nearly none of which are related to criminal investigations.
• The four agencies had not implemented all of the requirements of SB 34.
• Poorly developed and incomplete policies contributed to the agencies’ failure to implement ALPR programs that reflect the privacy principles in SB 34.
• Three of the reviewed agencies shared their ALPR images widely, yet the State Auditor found no evidence that the agencies had always determined whether an entity receiving shared images had a right and a need to access the images or even that the receiving entity was a public agency.

The State Auditor made several recommendations to the Legislature:

• Require DOJ to draft and make available on its website a policy template that local law enforcement agencies can use as a model for their ALPR policies.
• Require DOJ to develop and issue guidance to help local law enforcement agencies identify and evaluate the types of data they are currently storing in their ALPR systems.
• Establish a maximum data retention period for ALPR images.
• Specify how frequently ALPR system use must be audited and that the audits must include assessing user searches.

In October 2023, the DOJ issued guidance to state and local law enforcement agencies regarding the governance of ALPRs, asserting that California law prohibits ALPR information from being shared with federal agencies or local agencies outside of the state of California. The bulletin included a template use policy that recommended law enforcement agencies maintain ALPR data for 60 days to six months.

This bill is opposed by a long list of law enforcement agencies and associations, including the California Police Chiefs Association, which argues:

Law enforcement agencies across the state and nation have used ALPR data to solve crimes and apprehend criminal suspects and continue to do so today. While some cases are solved quickly using this technology, it can also be exceptionally helpful in solving crimes that have occurred deeper in the past. Setting a data retention limit such as 60 days in statute will significantly hinder the use of a valuable law enforcement tool.

Past versions of this bill were supported by California Public Defenders Association and the Electronic Frontiers Foundation, among others. This committee has not received expressions of support for the current version of this bill.

Analysis Prepared by: Jay Dickenson / APPR. / (916) 319-2081

Date of Hearing: July 16, 2025

Fiscal: Yes

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

SBPCA Bill Id:SB 274

Author:(Cervantes) – As Amended Ver:May 23, 2025

SENATE VOTE: 26-10

PROPOSED AMENDMENTS

SUBJECT: Automated license plate recognition systems

SYNOPSIS

Automated License Plate Reader (ALPR) systems are searchable computerized databases resulting from the operation of one or more cameras combined with computer algorithms to capture and convert images of registration plates and the characters they contain into computer-readable data. The cameras can be mobile, e.g., mounted on patrol cars, or fixed, e.g., mounted on light poles. ALPR systems allow for the widespread and systematic collection of license plate information. ALPR data can have legitimate uses, including for law enforcement purposes.

To curb potential abuses associated with these systems, this bill primarily does four things:

1. Requires that license plate data that does not match information contained on a “hot list” must be deleted within 60 days.

2. Requires an ALPR operator to institute safeguards for managing which employees can see the data from their systems.

3. Requires data security training and data privacy training for all employees that access ALPR information.

4. Requires the Department of Justice (DOJ) to conduct annual random audits of agencies using ALPR to determine whether they have implemented a usage and privacy policy in compliance with the law.

This bill is opposed by a number of law enforcement organizations and, after amendments taken in Senate Appropriations, no longer has any registered support.

The Committee amendments contained in Comment # 7 strengthen privacy protections in the bill by further restricting how the ALPR systems can be used and by whom. Among the amendments are the clarifying of the definition of a “hot list”; requiring a current case number to query the database; and clarifying that ALPR information may only be used for purposes of locating vehicles or persons when either are reasonably suspected of being involved in the commission of a public offense.

This bill was previously heard by the Transportation Committee, where it passed on a 12-4-0 vote.

THIS BILL:

1. Defines “hot list” as a list or lists of license plates of vehicles of interest against which the ALPR system is comparing vehicles on the roadways.
2. Requires an ALPR operator to institute safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.
3. Requires data security training and data privacy training for all employees that access ALPR information.
4. Requires the Department of Justice to conduct annual random audits on a public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented a usage and privacy policy in compliance with the law.
5. Prohibits an agency from retaining ALPR information that does not match a hot list for more than 60 days after the date of collection.

EXISTING LAW:

1. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const., art. I, § 1.)
2. Defines “automated license plate recognition system” or “ALPR system” to mean a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data. “ALPR information” means information or data collected through the use of an ALPR system. “ALPR operator” means a person that operates an ALPR system, except as specified. “ALPR end-user” means a person that accesses or uses an ALPR system, except as specified. The definitions for both “ALPR operator” and” ALPR end-user” exclude transportation agencies subject to certain provisions of the Streets and Highways Code that apply to electronic toll collection. (Civ. Code § 1798.90.5.)
3. Requires an ALPR operator to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. ALPR operators must implement usage and privacy policies in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. It further requires the policies to include, at a minimum, certain elements. (Civ. Code § 1798.90.51.)
4. Requires ALPR end-users to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. ALPR end-users must implement usage and privacy policies in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. It further requires the policies to include, at a minimum, certain elements. (Civ. Code § 1798.90.53.)
5. Provides that a public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law. For purposes of this section, the provision of data hosting or towing services is not considered the sale, sharing, or transferring of ALPR information. (Civ. Code § 1798.90.55.)
6. Authorizes the California Highway Patrol (CHP) to retain license plate data captured by a license plate reader for no more than 60 days, except in circumstances when the data is being used as evidence, or for all felonies being investigated, including, but not limited to, auto theft, homicides, kidnaping, burglaries, elder and juvenile abductions, Amber Alerts, and Blue Alerts. (Veh. Code § 2413(b).)
7. Prohibits the CHP from selling license plate reader data for any purpose and from making the data available to an agency that is not a law enforcement agency or an individual who is not a law enforcement officer. The data may be used by a law enforcement agency only for purposes of locating vehicles or persons when either are reasonably suspected of being involved in the commission of a public offense. (Veh. Code § 2413(c).)
8. Requires the CHP to monitor internal use of the license plate reader data to prevent unauthorized use. (Veh. Code § 2413(d).)
9. Requires the CHP to annually report license plate reader practices and usage, including the number of license plate reader data disclosures, a record of the agencies to which data was disclosed and for what purpose, and any changes in policy that affect privacy concerns, to the Legislature. (Veh. Code § 2413(e).)
10. Establishes the Data Breach Notification Law, which requires any agency, person, or business that owns, licenses, or maintains data including personal information to disclose a breach, as provided. (Civ. Code §§ 1798.29; 1798.82.) Includes ALPR data within the definition of “personal information,” if combined with an individual’s first name or first initial and last name, when either piece of data is not encrypted. (Civ. Code §§ 1798.29(g), 1798.82(h).)
11. Prohibits a transportation agency from selling or otherwise providing to any other person or entity personally identifiable information of any person who subscribes to an electronic toll or electronic transit fare collection system or who uses a toll bridge, toll lane, or toll highway that employs an electronic toll collection system, except as expressly provided. (Sts. & Hwy. Code § 31490.)
12. Establishes the California Values Act, which prohibits state law enforcement from using state resources to assist in the enforcement of federal immigration law, except as specified. (Gov. Code § 7282 et seq.)
13. Establishes California as a sanctuary state and prohibits any law enforcement agency from cooperating with federal immigration enforcement authorities. (Gov. Code § 7284, et seq.)
14. Establishes the Reproductive Privacy Act, which provides that the Legislature finds and declares that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, which entails the right to make and effectuate decisions about all matters relating to pregnancy, including prenatal care, childbirth, postpartum care, contraception, sterilization, abortion care, miscarriage management, and infertility care. Accordingly, it is the public policy of the State of California that:
    1. Every individual has the fundamental right to choose or refuse birth control.
    2. Every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion, with specified limited exceptions.
    3. The state shall not deny or interfere with a person’s fundamental right to choose to bear a child or to choose to obtain an abortion, except as specifically permitted. (Health & Saf. Code § 123462.)
15. Provides that the state may not deny or interfere with a person’s right to choose or obtain an abortion prior to viability of the fetus or when the abortion is necessary to protect the life or health of the person. (Health & Saf. Code § 123466 (a).)
16. States that a person shall not be compelled in a state, county, city, or other local criminal, administrative, legislative, or other proceeding to identify or provide information that would identify or that is related to an individual who has sought or obtained an abortion if the information is being requested based on either another state’s laws that interfere with a person’s rights under subdivision (a) or a foreign penal civil action. (Health & Saf. Code § 123466(b).)

COMMENTS:

1) Author’s statement. According to the author:

ALPRs are a form of location surveillance, the data they collect can reveal our travel patterns and daily routines, the places we visit, and the people with whom we associate and love. Along with the threat to civil liberties, these data systems pose significant security risks. There have been multiple known breaches of ALPR data and technology in recent years, indicating potential cybersecurity threats. In a climate where the current federal administration is pursuing mass deportations of U.S. citizens and undocumented individuals alike, Automated License Plate Recognition (ALPR) is a powerful surveillance technology that can invade the privacy of all individuals and violate the rights of entire communities. Aggregated location data allows law enforcement and private companies to create detailed profiles of a person's daily life. When considered in bulk, ALPR data can form an intimate picture of a driver’s activities and even deter First Amendment-protected activities. This kind of targeted tracking threatens to erode fundamental freedoms of speech.

The extensive use of ICE's access to ALPR databases has surfaced at a pivotal moment, highlighting urgent concerns about data collection and retention practices. It is imperative that we examine the implications of these practices alongside the ongoing operations of immigration enforcement in our state and nationwide.

ALPR technology also poses a risk to individuals who frequent sensitive locations like health care facilities, immigration clinics, gun shops, labor union halls, protest sites, and places of worship. Using this technology to monitor and target vehicles in these areas can create a chilling effect, discouraging individuals from seeking necessary services or participating in civic engagement due to fear of being tracked or apprehended by immigration authorities. Ultimately, these practices not only compromise community trust but also undermine the very principles of safety and protection that sanctuary laws aim to uphold.

Most ALPR data is stored in databases for extended periods, often up to five years. While police departments typically maintain these databases, they are frequently managed by private companies. Law enforcement agencies that do not have their own ALPR systems can access data collected by other agencies through regional sharing systems and networks operated by these private firms. Senate Bill 274 would limit the retention of ALPR information to no more than 60 days. The temptation to "collect it all" should never overshadow the critical responsibility to "protect it all." Senate Bill 274 is a significant legislative measure aimed at establishing robust safeguards and crucial oversight regarding the use of ALPR throughout our state.

This bill is designed to ensure that the privacy of Californians is respected and preserved, while also maintaining compliance with existing laws that safeguard vulnerable communities. Senate Bill 274 mandates that operators and end users of ALPR systems strengthen safeguards of these systems, including requiring the Department of Justice to conduct random annual audits of public agency operators. The bill also requires that ALPR data must be retained for no longer than 60 days if on a hotlist. Senate Bill 274 strikes a balance between protecting public safety and ensuring individual privacy rights in our increasingly digital world.

2) Background. Automated License Plate Reader (ALPR) systems are searchable computerized databases resulting from the operation of one or more cameras combined with computer algorithms to capture and convert images of registration plates and the characters they contain into computer-readable data. The cameras can be mobile, e.g., mounted on patrol cars, or fixed, e.g., mounted on light poles. ALPR systems allow for the widespread and systematic collection of license plate information. These cameras continuously record the plates, color, and brand of vehicles passing in front of them. Law enforcement can then perform searches to see where exactly a vehicle, and by extension person, was at a certain time or map out their movements across a wide date range.^[1] ALPR data can have legitimate uses, including for law enforcement purposes. The majority of police and sheriff departments in California use an ALPR system. While such systems may be useful, there are serious privacy concerns associated with the collection, storage, disclosure, sharing, and use of ALPR data.^[2]

In 2015, SB 34 (Hill, Chap. 532, Stats. 2015) sought to address some of the concerns about the privacy of the information collected by these systems by placing certain protections around the operation of ALPR and the use of the data.^[3] The resulting statutes provide that both ALPR operators and ALPR end-users are required to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. These operators and end-users are further required to implement usage and privacy policies in order to ensure that the collection, access, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties.

These policies are required to be made available to the public in writing and posted to the operator or end-user’s internet website, if it exists. These policies are required to include at least the following:

1. The authorized purposes for using the ALPR system, and collecting, accessing, and/or using ALPR information.

2. A description of the job title or other designation of the employees and independent contractors who are authorized to access and use the ALPR system and its information, or to collect the ALPR information. Necessary training requirements must also be identified.

3. A description of how the ALPR system will be monitored to ensure (a) the security of the ALPR information, and (b) compliance with all applicable privacy laws.

4. A process for periodic system audits for end-users.

5. The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.

6. The title of the official custodian, or owner, of the ALPR information responsible for implementing the relevant practices and policies.

7. A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.

8. The length of time ALPR information will be retained, and the process the ALPR operator or end-user will utilize to determine if and when to destroy retained ALPR information.

3) Law enforcement misuse of ALPR systems. A recent investigation into the Flock Safety ALPR system by 404 Media, an independent media company that specializes in technology, found more than 4,000 nation and statewide lookups by local and state police nationwide done either at the behest of the federal government or as an informal favor to federal law enforcement, or with a potential immigration focus.^[4] According to the report:

The fact that police almost never get a warrant to perform a Flock search means that there is not as much oversight into its use, which leads to local police either formally or informally helping the feds by doing lookups.

“Law enforcement really likes license plate readers because of the lack of restrictions on that data. They don’t feel like they need a warrant. Oftentimes there are no restrictions whatsoever on what they search,” Dave Maass, who studies border technology at the Electronic Frontier Foundation, told 404 Media. “It might be totally true that some of these searches are for people who have warrants or who are wanted for criminal activity. They might be looking for a terrorist, who knows. But that’s kind of the point—we don’t know.”^[5]

In an extension of their research, 404 Media found that law enforcement authorities in Texas performed a nationwide search of over 83,000 Flock ALPR cameras in a search for a woman who they claim had a self-administered abortion. The article notes:

The news shows in stark terms how police in one state are able to take the ALPR technology, made by a company called Flock and usually marketed to individual communities to stop carjackings or find missing people, and turn it into a tool for finding people who have had abortions. In this case, the sheriff told 404 Media the family was worried for the woman’s safety and so authorities used Flock in an attempt to locate her. But health surveillance experts said they still had issues with the nationwide search.

“You have this extraterritorial reach into other states, and Flock has decided to create a technology that breaks through the barriers, where police in one state can investigate what is a human right in another state because it is a crime in another,” Kate Bertash of the Digital Defense Fund, who researches both ALPR systems and abortion surveillance, told 404 Media.^[6]

The search by the officer logged the reason as “had an abortion, search for female.”^[7] Ashley Emery, senior policy analyst in reproductive health and rights at the National Partnership for Women & Families, told 404 Media:

The risks of this intrusive government monitoring cannot be overstated: law enforcement could deploy this surveillance technology to target and try to build cases against pregnant people who travel for abortion care and those who help them. This incident is undeniably a harbinger of more AI-enabled reproductive surveillance and investigations to come. Especially for women of color who are already over-surveilled and over-policed, the stakes couldn’t be higher.^[8]

As for California law enforcement activities, a suit was filed against the Marin County Sheriff in October 2021 alleging that despite laws against sharing ALPR data out of state and with the federal government, since 2014 the Sheriff’s Office had been forwarding scans from ALPR cameras to out-of-state and federal agencies, including U.S. Immigration and Customs Enforcement, which has used the information to track and deport immigrants. In the June 2022 settlement agreement, the Sheriff agreed to start complying with state laws and stop sharing the information. The other example is the Vallejo police department, which captured over 400,000 license plates a month and had been sharing their data with law enforcement in Arizona and Texas, according to an October 2022 article in The Guardian.^[9]

More recently, a CalMatters report found that Southern California law enforcement agencies violated state law more than 100 times in one month by sharing information from automated license plate readers. The Los Angeles Police Department and sheriff’s departments in San Diego and Orange counties searched license plate readings on behalf of Immigration and Customs Enforcement and Customs and Border Protection, according to a database of queries.^[10]

According to CalMatters:

This log is where police searching Riverside County data revealed their cooperation with ICE, often using the term “HSI,” referring to the agency’s Homeland Security Investigations unit. The term “CBP” was also repeatedly listed as a search purpose.

Among the 10 agencies that conducted searches on behalf of ICE, six are in Los Angeles County and nine are in Southern California. Two agencies, the sheriff’s departments for Orange and San Diego counties, carried out searches on the behalf of Customs and Border Protection or the Border Patrol.^[11]

4) Flock Safety and Vigilant Solutions. Automated license plate readers have become ubiquitous in public spaces. This means even if a consumer takes steps to reduce their personal device use, they are not able to avoid near constant surveillance while interacting in public.

Specifically, the proliferation of both privately owned and publicly owned license plate readers track where people drive and park. Fixed and mobile license plate recognition cameras take photos of license plates, capturing the date, time, and GPS coordinates of where the photo was taken. Each plate image captured, along with the data for that image (date, time, location), is stored in a database as records that can be searched.

The largest vendor for ALPR systems, Flock Safety, has long presented themselves as the good actors in the surveillance space, stating that they do not sell access to data or access it themselves. They have argued in the past that the data in their system belongs to the law enforcement agencies they have contracts with. However, as the 404 Media investigation found, their system is being used for intrusive surveillance of Americans. In addition, Flock recently announced the launch of their new product Nova, which is being promoted as being able to supplement license plate data with a wealth of personal information sourced from other companies and the wider web. The tool will potentially be able to link a vehicle passing by a camera to its owner and then more people connected to them, through marriage or other association. According to internal documents acquired by 404 Media:

“You’re going to be able to access data and jump from LPR to person and understand what that context is, link to other people that are related to that person [...] marriage or through gang affiliation, et cetera,” a Flock employee said during an internal company meeting, according to an audio recording. “There’s very powerful linking.” One Slack message said that Nova supports 20 different data sources that agencies can toggle on or off.

[. . .]

In the meeting audio obtained by 404 Media, the Flock employee described the sorts of information the company will supplement ALPR data with. The first is data breaches. One example the employee pointed to was a 2021 data breach impacting users of Park Mobile, an app that allows users to pay for parking without physically going to the parking meter or in some lots where meters no longer exist. That data included license plate numbers with their owners’ associated email addresses, phone numbers, and in some cases mailing addresses. With regards to Flock, “Nova ingests that and is able to use that to contextualize the data. So we're now able to make that cognitive leap from LPR to person,” the employee said.

Over the last several years more surveillance and technology companies have packaged stolen or hacked data and then sold access to that information to law enforcement. The practice raises questions around the ethics of re-using such data for surveillance purposes; the legality of doing so; and the chain of custody of that information if it was ever used as part of a criminal investigation.

The second was “commercially available data,” with the employee explicitly naming credit bureaus Equifax and TransUnion. . . . [W]hen people open a credit card their personal information is sent to the credit bureaus in their role as monitoring peoples’ credit. Some bureaus then repackage and sell this information to law enforcement or other data brokers. TransUnion has a data product called TLOxp. . . .

The third is public records such as marriage licenses, property records, and campaign finance records, the employee said. The slides say that Nova will also pull data from law enforcement Records Management Systems (RMS), which are typically databases for storing information on cases, and Computer Aided Dispatch (CAD) systems, which manage responses to 911 calls.^[12]

Another company, Vigilant Solutions, has amassed billions of license plate records throughout the county that allow law enforcement officials to monitor the movements of individuals. In their marketing materials, Vigilant claims:

Vigilant Solutions creates highly innovative and essential tools for law enforcement – tools that ultimately saves lives. As an example, Vigilant Solutions’ Automated License Plate Recognition (ALPR / LPR) product is the most comprehensive offering available, with over tens of thousands of users around the world and thousands of success stories.

Data is cumbersome; intelligence is actionable. Vigilant Solutions’ products are designed to collect, organize and share data to credentialed law enforcement personnel, providing intelligence that is readily accessible and easy to use. This intelligence provides more efficient and effective law enforcement while enhancing officer safety.

Vigilant Solutions creates intelligence by merging previously disparate data sets such as fixed and mobile license plate recognition, privately collected LPR data, facial recognition, and more.^[13] Vigilant’s LEARN Intelligence Network provides an easy to use and intuitive interface to all of this information for unmatched investigative capability in a secure, hosted environment to reduce demands on agency IT resources and to facilitate nationwide interoperability and data sharing.^[14]

All of this tracking information, potentially tracking people to sensitive locations, is available to any paying law enforcement agency eliminating the need for them to obtain a court order, warrant, or subpoena. Vigilant boasts, “Even without [license plate reader] cameras, you can benefit by using our Commercial Data. We are the only [license plate reader] provider that can offer over 5 billion nationwide detections and over 150 million more added monthly. We believe the power of LPR is in the data and analytics. In addition to access to our commercial data, agencies can choose to share with other law enforcement agencies to gain access to another 1.5B detections nationwide.”^[15]

5) California State Audit Report. In response to the growing concerns with ALPR systems, the Joint Legislative Audit Committee in 2019 tasked the California State Auditor with conducting an audit of law enforcement agencies’ use of ALPR systems and data.

The resulting report, released in February 2020, focused on four law enforcement agencies that have ALPR systems in place. The report found that “the agencies have risked individuals’ privacy by not making informed decisions about sharing ALPR images with other entities, by not considering how they are using ALPR data when determining how long to keep it, by following poor practices for granting their staff access to the ALPR systems, and by failing to audit system use.” In addition, the audit found that three of the four agencies failed to establish ALPR policies that included all of the elements required by SB 34. All three failed to detail who had access to the systems and how it will monitor the use of the ALPR systems to ensure compliance with privacy laws. Other elements missing were related to restrictions on the sale of the data and the process for data destruction. The fourth entity, the Los Angeles Police Department did not even have an ALPR policy.^[16]

The Auditor’s report calls into question how these systems are being run, how their data is being protected, and what is being done with the data. The report reveals that agencies commingled standard ALPR data with criminal justice information and other sensitive personal information about individuals, illustrating the need for stronger security measures and more circumscribed access and use policies. However, the lack of clear guidelines or auditing made it unclear exactly where information was coming from, who was accessing it, and what purposes the information was being put to. The report does make clear that these agencies have “shared their ALPR images widely, without considering whether the entities receiving them have a right to and need for the images.” Increasing the vulnerability of such vast troves of sensitive data, the agencies’ retention policies were uninformed and not tied to the usefulness of the data or the risks extended retention posed.^[17]

In fact, the Auditor had difficulty determining whether the agencies made informed decisions about sharing the ALPR data at all because of the deficient record keeping. It was discovered that two of the agencies reviewed approved data sharing with hundreds of entities and one shared data with over a thousand. The sharing occurred with most of the other 49 states and included public and private entities. However, the audit makes clear that ultimately it was impossible to verify the identity of each of these entities or their purpose for receiving this data.^[18]

The Auditor’s report and the examples in Comment # 4 demonstrate that some law enforcement agencies are either accidentally or deliberately violating the state’s privacy laws. This bill seeks to rein in that dangerous behavior.

6) Analysis of this bill. The question before this Committee is whether or not this bill furthers its policy priorities, particularly protecting Californians who are being picked up in the street by immigration enforcement, regardless of their citizenship status. In addition, to protect all Californians, and those coming from out of state, are protected from punitive and discriminatory draconian laws attacking the LGBTQ+ community and criminalizing people seeking abortion and gender affirming care.

The author argues, “In a climate where the current federal administration is pursuing mass deportations of U.S. citizens and undocumented individuals alike, Automated License Plate Recognition (ALPR) is a powerful surveillance technology that can invade the privacy of all individuals and violate the rights of entire communities.” In order to address this concern, the bill does several things:

1. Purges geolocation data not associated with a car that appears on a hot list after 60 days. Under current law, there are no restrictions against law enforcement agencies amassing large stores of license plate data. As an example, the ALRP audit report found that in the Los Angeles ALPR database, “only 400,000 of the 320 million images it has accumulated over several years and stores in its database generated an immediate match against its hot lists. In other words, 99.9 percent of the ALPR images Los Angeles stores are for vehicles that were not on a hot list at the time the image was made.” Given the massive volume of images being stored in these databases, it makes the previous discussion related to the Marin County Sheriff’s Department collecting data on perhaps millions of license plates as people drove on the highways through Marin County on their way to and from San Francisco and then repeatedly sharing that information with federal immigration authorities all the more alarming.

The more data collected and retained, the more vulnerable people become to having their daily movements tracked, regardless of whether or not they are suspected of having committed a crime.

Requiring that the data not related to ongoing investigations be purged every 60 days is significantly longer than in previous versions of the bill and longer than the retention time recommended by Flock Safety, which notes that 30 days is considered the best practice for protecting drivers’ privacy. In addition, 30 days was generally in line with the CA State Auditor recommendation to limit retention to the shortest practicable time. Last session, AB 1463 (Lowenthal, 2023) would have required law enforcement agencies to delete the data within 30 days. Prior to that, SB 210 (Weiner, 2022), required law enforcement agencies to delete the data within 24 hours. SB 1143 (Wiener, 2020) was a similar bill that met a similar fate. Finally, AB 1782 (Chau, 2019) would have allowed the data to be retained for 60 days, but also required anonymization of the data.

The April 20th version of this bill included a 30 day retention period. However, the Senate Appropriations Committee amended the bill to double the time period to 60 days. By extending the retention period, this bill arguably increases the risk of misuse of the data. Committee amendments described in Comment 7 would enhance the restrictions related to the use of that data to help compensate for the increased risk.

2. Requires an ALPR operator to institute safeguards for managing which employees can see the data from their systems.

3. Requires data security training and data privacy training for all employees that access ALPR information.

4. Requires that the DOJ conduct annual random audits agencies using ALPR to determine whether they have implemented a usage and privacy policy in compliance with the law. This provision in the bill addresses a concern raised by the State Auditor. As discussed previously, the Auditor had difficulty determining whether the agencies made informed decisions about sharing the ALPR data at all because of the deficient record keeping. It was discovered that two of the agencies reviewed approved sharing with hundreds of entities and one shared with over a thousand. The sharing occurred with most of the other 49 states and included public and private entities. However, ultimately it was impossible to verify the identity of each of these entities or their purpose for receiving this data. As a result of this finding, the Auditor recommended the Legislature specify how frequently ALPR system use must be audited.

Given the finding in the audit report that law enforcement agencies were not assessing how their ALPR systems were being used and often could not provide the auditors with any information regarding how often or for what reasons they conducted ALPR searches, random DOJ audits appears to be a reasonable first step toward ensuring that the technology is used appropriately.

Privacy advocacy organizations, particularly Oakland Privacy, have pointed out the weakness in auditing whether or not law enforcement agencies maintain the required safety and security procedures. With a support if amended position on an earlier version of the bill, Oakland Privacy cautions:

In SB 274, the bill language tells the Cal-DOJ to annually audit. . . agencies that use automated license plate readers. The language is described as auditing *whether* they have a compliant policy, which is certainly important, but does not ascertain whether the policy that exists is actually being followed by the agency, which is the gist of the concern.

In addition, . . the bill language skirts the actual compliance problem - which is not non-compliant policies, but non-compliant operations. We prefer placing the burden of mandated auditing on the agencies themselves to demonstrate that they are, in fact, operating in compliance with their written policies.

Much of the opposition argues that having to purge data not on a hot list after 60 days will hinder their ability to solve crimes. Many of them note, “What happens if we find a body on day 61?” Unfortunately, what they fail to demonstrate is how their access to years and years of ALPR data help them solve serious crimes. As a primary example, Los Angeles County Sheriff, Robert Luna, details a recent crime in San Bernardino County where a woman went missing in 2023 and nine months later her body was found. The woman had been shot. He argues that if this bill is passed the ALPR data would have already been deleted by the time the woman was reported missing. However, Sheriff Luna does not actually state ALPR data had a role in capturing a suspect in the crime. He merely states that the data “might have helped in the case.” He specifically states:

Regardless of the means by which the woman’s body was found or how the suspect was identified in this particular case, it should be easily understandable that in this case, or any case that may follow, ALPRS data may prove to be a critical piece of evidence in understanding what has happened.

In 2024, Flock Safety released a report that claimed that their ALPR system was responsible for solving 10% of the crimes in the United States. However, the report has been roundly criticized by researchers, including two who were credited as authors of the report. According to reporting based on email exchanges with one of the researchers:

The Flock paper’s data “was sourced from a survey of Flock Safety ALPR customers,” meaning police departments, and the researchers “combine[d] agency-attributed ALPR crime clearances with historical FBI-reported crime data to calculate the portion of crime solved within each of the law enforcement jurisdictions with data of sufficient quality for inclusion.”^[19]

The piece goes on to note:

Chris Gilliard, who studies surveillance and privacy at the Just Tech Social Science Research Council, told me “The study isn't published in a journal or vetted for accuracy in a traditional peer review process. Ultimately, it is a marketing document. The emails indicate the desire to prove the technology’s effectiveness, which seems counter to how a rigorous study should be conducted.”^[20]

In 2019, one police department in Georgia attempted to test the impact of Flock’s ALPR system. They placed 13 cameras along roads near a popular amusement park. The area was chosen because of the disproportionate amount of property crimes. During the first six months the “number of reported crimes like robbery and nonresidential burglary dropped over 50 percent apiece compared with the same period the year before.”^[21] Flock was quick to capitalize on the reduction in crime. The company “proudly touted the results of the Cobb County pilot in a press release it sent [out]. . . and advertises on its website that it solves ‘up to five crimes an hour.’”^[22]

However, researchers and police were not so convinced. According to an article in Wired magazine:

But experts say it’s not that simple, and that establishing a causal relationship between any given variable and fluctuating crime rates is no easy task. “I am not saying that the readers did not have an effect on crime—it is just that we cannot attribute any reduction in crime to the readers themselves,” says Alex Piquero, a professor of criminology at the University of Texas, Dallas.

Even police agree. “To make it very clear, we are not 100 percent positive that Flock cameras were the difference,” notes VanHoozer. “What we did see, though, is an incredible decrease in crime, starting when we put these cameras down there.”

[. . .]

Maria Cuellar, a professor of criminology at the University of Pennsylvania who researches the use of statistics in the law, says pilots like the one in Cobb County only provide before and after comparisons, which alone can’t prove a causal relationship. “The problem with these is that so many things could have changed between the ‘before’ period and the ‘after’ period,” she adds. That includes everything from the number of cars passing through the area to broader demographic changes. The study was also relatively short. “With such a small sample size in terms of time, any changes could likely be noise rather than an actual signal,” says Cuellar.

Wider trends too have to be taken into account. Police say crime is down overall in Cobb County, as well as in nearby Atlanta. “We do believe that there are other things we are doing that have attributed to the general decline in crime,” says VanHoozer. He notes there are also social factors that might be contributing to the drop, like low unemployment.^[23]

The lack of evidence, even from those who oppose the bill, arguably could suggest that after a decade of use, these systems may not be worth the significant erosion in privacy that comes with them. In addition, given the reports of misuse of the data, and the lackadaisical way that some local law enforcement agencies are monitoring the use of ALPR and failing to establish basic security protocols, if this surveillance system is going to continue to be used, it is prudent for the state to adopt policies to stop the data from being improperly shared. This bill presents a very modest step toward that goal.

However, as former supporters of the bill, Electronic Frontier Foundation, noted when removing their support for the bill, “[I]n light of the amendments taken in Senate Appropriations. Where a 30-day retention period is the outer limit of our comfort, the change to 60 days means we can no longer support the bill.” As a result of that amendment, this bill currently has no registered support, demonstrating that privacy experts are concerned that enshrining a 60-day retention period in state law could in fact do more harm than good.

7) Amendments. In order to further ensure ALPR technology is being used for the intended purpose, the author has agreed to the following amendments:

1798.90.5. The following definitions shall apply for purposes of this title:

(a) “Automated license plate recognition end-user” or “ALPR end-user” means a person that accesses or uses an ALPR system, but does not include any of the following:

(1) A transportation agency when subject to Section 31490 of the Streets and Highways Code.

(2) A person that is subject to Sections 6801 to 6809, inclusive, of Title 15 of the United States Code and state or federal statutes or regulations implementing those sections, if the person is subject to compliance oversight by a state or federal regulatory agency with respect to those sections.

(3) A person, other than a law enforcement agency, to whom information may be disclosed as a permissible use pursuant to Section 2721 of Title 18 of the United States Code.

(b) “Automated license plate recognition information,” or “ALPR information” means information or data collected through the use of an ALPR system.

(c) “Automated license plate recognition operator” or “ALPR operator” means a person that operates an ALPR system, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.

(d) “Automated license plate recognition system” or “ALPR system” means a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.

(e) “Hot list” means a list or lists of license plates of vehicles of interest against which the ALPR system is comparing vehicles on the roadways. Authorized hot lists are limited to the National Crime Information Center (NCIC) list, the Stolen Vehicle System (SVS), California Department of Justice lists, Official Alerts, including Amber, Silver, Feather, Blue, Yellow, Ebony and any new alerts authorized by the Legislature, and custom BOLO Lists that pertain solely to missing and at risk person, witness locates, burglaries, grand theft and violent crimes.

(f) “Person” means any natural person, public agency, partnership, firm, association, corporation, limited liability company, or other legal entity.

(g) “Public agency” means the state, any city, county, or city and county, or any agency or political subdivision of the state or a city, county, or city and county, including, but not limited to, a law enforcement agency, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.

1798.90.52. If an ALPR operator accesses or provides access to ALPR information, the ALPR operator shall do both of the following:

(a) Maintain a record of that access. At a minimum, the record shall include all of the following:

(1) The date and time the information is accessed.

(2) The license plate number or other data elements used to query the ALPR system.

(3) The username of the person who accesses the information, and, as applicable, the organization or entity with whom the person is affiliated.

(4) The purpose for accessing the information case file number that justifies the search query. No queries shall be allowed without a log entry with a valid and current case file number from the agency conducting the query. 

(b) Require that ALPR information only be used for the authorized purposes described in the usage and privacy policy required by subdivision (b) of Section 1798.90.51.

1798.90.54. (a) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.

(b) The court may award a combination of any one or more of the following:

(1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).

(2) Punitive damages upon proof of willful or reckless disregard of the law.

(3) Reasonable attorney’s fees and other litigation costs reasonably incurred.

(4) Other preliminary and equitable relief as the court determines to be appropriate.

(c) The Department of Justice shall conduct annual random audits on a public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented and are adhering to a usage and privacy policy in compliance with subdivision (b) of Section 1798.90.51 or subdivision (b) of Section 1798.90.53, as applicable.

1798.90.55. Notwithstanding any other law or regulation:

(a) A public agency that operates or intends to operate an ALPR system shall provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before implementing the program.

(b) A public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law. For purposes of this section, the provision of data hosting or towing services shall not be considered the sale, sharing, or transferring of ALPR information.

(c) ALPR information may be used by a law enforcement agency only for purposes of locating vehicles or persons when either are reasonably suspected of being involved in the commission of a public offense.

1798.90.56. A public agency shall not retain ALPR information that does not match information on an authorized hot list for more than 60 days after the date of collection.

1798.90.57. As of January 1, 2026, a public agency shall, within 14 days, delete all ALPR information that has been held for more than 60 days and does not match information on an authorized hot list.

The amendment to 1798.90.55(c) is in keeping with the ALPR restrictions imposed upon the Highway Patrol and can be found in Vehicle Code Section 2413(c), which states in part: “The data may be used by a law enforcement agency only for purposes of locating vehicles or persons when either are reasonably suspected of being involved in the commission of a public offense.”

ARGUMENTS IN OPPOSITION: In opposition to the bill, the California Police Chiefs Association argues:

CPCA understands the need to protect against unscrupulous searches and unwarranted invasion of individual privacy, especially during the current political climate, which is why our ALPR operations are highly audited and regulated by existing law. These protections, however, still allow law enforcement to utilize the data collected by ALPR’s in a manner that is critical to solving and preventing crime in our communities. A significant deterrent to prevent crime is creating a perception that perpetrators will be caught for unlawful acts, and ALPR systems greatly help increase that perception.

Law enforcement agencies across the state and nation have used ALPR data to solve crimes and apprehend criminal suspects and continue to do so today. While some cases are solved quickly using this technology, it can also be exceptionally helpful in solving crimes that have occurred deeper in the past. Setting a data retention limit such as 60 days in statute will significantly hinder the use of a valuable law enforcement tool.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file.

Oppose

Arcadia Police Officers' Association
Brea Police Association
Burbank Police Officers' Association
California Association of School Police Chiefs
California Coalition of School Safety Professionals
California Narcotic Officers' Association
California Police Chiefs Association
California Reserve Peace Officers Association
California State Sheriffs' Association
City of Thousand Oaks
Claremont Police Officers Association
Corona Police Officers Association
Culver City Police Officers' Association
Fullerton Police Officers' Association
Los Angeles County Sheriff's Department
Los Angeles School Police Management Association
Los Angeles School Police Officers Association
Murrieta Police Officers' Association
Newport Beach Police Association
Palos Verdes Police Officers Association
Peace Officers Research Association of California (PORAC)
Placer County Deputy Sheriffs' Assocation
Pomona Police Officers' Association
Riverside County Sheriff's Office
Riverside Police Officers Association
Riverside Sheriffs' Association
San Diego County Sheriff's Office

Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200

1. Jason Koebler and Joseph Cox, “ICE Taps into Nationwide AI-Enabled Camera Network, Data Shows,” 404 Media (May 27, 2025) https://www.404media.co/ice-taps-into-nationwide-ai-enabled-camera-network-data-shows/. ↑

2. California State Auditor, Automated License Plate Readers, To Better Protect Individuals’ Privacy, Law Enforcement Must Increase Its Safeguards for the Data It Collects (Feb. 2020), https://www.auditor.ca.gov/pdfs/reports/2019-118.pdf [State Auditor Report]. ↑

3. See Civ. Code §§ 1798.90.51, 1798.90.53. ↑

4. Koebler and Cox, supra. ↑

5. Ibid. ↑

6. Joseph Cox and Jason Koebler, “A Texas Cop Searched License Plate Cameras Nationwide for a Woman Who Got an Abortion,” 404 Media (May 29, 2025) https://www.404media.co/a-texas-cop-searched-license-plate-cameras-nationwide-for-a-woman-who-got-an-abortion/. ↑

7. Ibid. ↑

8. Ibid. ↑

9. Johana Bhuiyan, “How expanding web of license plate readers could be ‘weaponized’ against abortion,” The Guardian (Oct. 6, 2022) https://www.theguardian.com/world/2022/oct/06/how-expanding-web-of-license-plate-readers-could-be-weaponized-against-abortion?ref=vallejosun.com. ↑

10. Khari Johnson and Mohamed Al Elew, “California police are illegally sharing license plate data with ICE and Border Patrol,” CalMatters (Jun. 13, 2025) https://calmatters.org/economy/technology/2025/06/california-police-sharing-license-plate-reader-data/. ↑

11. Ibid. ↑

12. Joseph Cox, “Flock Is Building a Massive People Lookup Tool, Leak Shows,” 404 Media (May 14, 2025) https://www.404media.co/license-plate-reader-company-flock-is-building-a-massive-people-lookup-tool-leak-shows/. ↑

13. Emphasis added. ↑

14. https://www.ra-comm.com/vigilant-solutions/ ↑

15. https://induscom.com/motorola/vigilant/ ↑

16. State Auditor Report, supra. ↑

17. Ibid. ↑

18. Ibid. ↑

19. Jason Koebler. “Let’s Talk About the Flock Study That Says It Solves Crime,” 404 Media (Mar. 20, 2024) https://www.404media.co/researcher-who-oversaw-flock-surveillance-study-now-has-concerns-about-it/. ↑

20. Ibid. ↑

21. Louise Matsakis. “Flock Safety Says Its License Plate Readers Reduce Crime. It’s Not That Simple,” Wired (Oct. 24, 2019) https://www.wired.com/story/flock-safety-license-plate-readers-crime/. ↑

22. Ibid. ↑

23. Ibid. ↑

 THIRD READING  

Bill No: SB 274

Author: Cervantes (D)

Amended: 5/23/25

Vote: 21

SENATE JUDICIARY COMMITTEE: 10-2, 4/22/25

AYES: Umberg, Arreguín, Ashby, Caballero, Durazo, Laird, Stern, Wahab, Weber Pierson, Wiener

NOES: Niello, Valladares

NO VOTE RECORDED: Allen

SENATE PUBLIC SAFETY COMMITTEE: 5-1, 4/29/25

AYES: Arreguín, Caballero, Gonzalez, Pérez, Wiener

NOES: Seyarto

SENATE APPROPRIATIONS COMMITTEE: 5-1, 5/23/25

AYES: Caballero, Cabaldon, Grayson, Richardson, Wahab

NOES: Seyarto

NO VOTE RECORDED: Dahle

SUBJECT: Automated license plate recognition systems

SOURCE: Author

DIGEST:

This bill requires operators and end-users of automated license plate recognition (ALPR) systems to bolster their safeguards relating to employee access and usage of such systems. This bill requires the Department of Justice (DOJ) to audit public agency operators and end-users annually to ensure compliance with their usage and privacy policies. This bill prohibits public agencies from using ALPR systems to gather geolocation information at certain specified sites and places retention limits on ALPR data, with exceptions.

ANALYSIS:

Existing law:

1. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (California. Constitution. Article. I, § 1.)
2. Defines “automated license plate recognition system” or “ALPR system” to mean a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data. “ALPR information” means information or data collected through the use of an ALPR system. “ALPR operator” means a person that operates an ALPR system, except as specified. “ALPR end-user” means a person that accesses or uses an ALPR system, except as specified. The definitions exclude transportation agencies when subject to Section 31490 of the Streets and Highways Code. (Civil (Civ.) Code § 1798.90.5.)
3. Requires an ALPR operator to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. ALPR operators must implement usage and privacy policies in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. It further requires the policies to include, at a minimum, certain specified elements. (Civ. Code § 1798.90.51.)
4. Requires an ALPR operator, if it accesses or provides access to ALPR information, to do both of the following:
   1. Maintain a record of that access, as specified.
   2. Require that ALPR information only be used for the authorized purposes described in the usage and privacy policy. (Civ. Code § 1798.90.52.)
5. Requires ALPR end-users to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. ALPR end-users must implement usage and privacy policies in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. It further requires the policies to include, at a minimum, certain elements. (Civ. Code § 1798.90.53.)
6. Provides that a public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law. For purposes of this section, the provision of data hosting or towing services shall not be considered the sale, sharing, or transferring of ALPR information. (Civ. Code § 1798.90.55.)
7. Authorizes the Department of the California Highway Patrol to retain license plate data captured by a license plate reader for no more than 60 days, except in circumstances when the data is being used as evidence or for all felonies being investigated, including, but not limited to, auto theft, homicides, kidnapping, burglaries, elder and juvenile abductions, Amber Alerts, and Blue Alerts. (Vehicle (Veh.) Code § 2413(b).)

This bill:

1. Provides that the current requirements for ALPR operators and end-users to maintain reasonable security procedures and practices must include:
   1. Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees.
   2. Requiring data security training and data privacy training for all employees that access ALPR information.
2. Requires DOJ to conduct annual random audits of public agency ALPR operators and end-users to determine whether they have implemented a usage and privacy policy in compliance with the law. Usage and privacy policies shall be implemented under the supervision of DOJ, as applicable.
3. Requires that the usage and privacy policies must indicate the purpose for which specified employees and contractors are granted access to, and permission to use, ALPR information.
4. Prohibits a public agency from retaining ALPR information that does not match information on a hot list for more than 60 days after the date of collection.

Background

ALPR systems are searchable computerized databases resulting from the operation of one or more cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data. The cameras can be mobile, e.g. mounted on patrol cars, or fixed, e.g. mounted on light poles. ALPR systems allow for the widespread and systematic collection of license plate information. ALPR data can have legitimate uses, including for law enforcement purposes. Currently, at least 230 police and sheriff departments in California use an ALPR system, with at least three dozen more planning to use them. While such systems are useful, there are serious privacy concerns associated with the systematic collection, storage, disclosure, sharing, and use of ALPR data.

Current law requires operators of these systems and those using the data to implement usage and privacy policies. However, concerns have remained about the widespread collection of this data and the wildly inconsistent and opaque ways the data is used, stored, and destroyed. A report from the California State Auditor confirms that police departments in the state are not complying with existing law and recommends further regulation of these systems.

This bill implements some of the report’s recommendations by mandating random audits of public agency operators and end-users to determine whether they have properly implemented the required usage and privacy policies. This bill requires more specific safeguards regarding employee access to ALPR systems and provides more authority for DOJ to oversee these systems with a requirement to randomly annually audit public agency operators and end-users. ALPR information cannot be retained by public agencies for longer than 60 days if it does not match information on a hot list.

This bill is author-sponsored. It is supported by the California Public Defenders Association. It is opposed by a large coalition of law enforcement groups. For a more thorough assessment, please see the Senate Judiciary Committee analysis of this bill.

Comment

California State Auditor report uncovers disturbing lack of compliance, oversight. In response to the growing concerns with ALPR systems, the Joint Legislative Audit Committee tasked the California State Auditor with conducting an audit of law enforcement agencies’ use of ALPR systems and data.

The 2020 report focused on four law enforcement agencies that have ALPR systems in place.^[1] The report found that “the agencies have risked individuals’ privacy by not making informed decisions about sharing ALPR images with other entities, by not considering how they are using ALPR data when determining how long to keep it, by following poor practices for granting their staff access to the ALPR systems, and by failing to audit system use.” In addition, the audit found that three of the four agencies failed to establish ALPR policies that included all of the elements required by SB 34. All three failed to detail who had access to the systems and how it will monitor the use of the ALPR systems to ensure compliance with privacy laws. Other elements missing were related to restrictions on the sale of the data and the process for data destruction. The fourth entity, the Los Angeles Police Department, did not even have an ALPR policy.

The Auditor’s report calls into question how these systems are being run, how the data is being protected, and what is being done with the data. The report reveals that agencies commingled standard ALPR data with criminal justice information and other sensitive personal information about individuals, heightening the need for stronger security measures and more circumscribed access and use policies.

According to the author:

ALPRs are a form of location surveillance, the data they collect can reveal our travel patterns and daily routines, the places we visit, and the people with whom we associate and love. Along with the threat to civil liberties, these data systems pose significant security risks. There have been multiple known breaches of ALPR data and technology in recent years, indicating potential cybersecurity threats.

In a climate where the current federal administration is pursuing mass deportations of U.S. citizens and undocumented individuals alike, Automated License Plate Recognition (ALPR) is a powerful surveillance technology that can invade the privacy of all individuals and violate the rights of entire communities. When considered in bulk, ALPR data can form an intimate picture of a driver’s activities and even deter First Amendment-protected activities. This kind of targeted tracking threatens to chill fundamental freedoms of speech. ICE’s contract allowing access to ALPR databases has emerged at a critical moment when concerns are escalating regarding the implications of data collection and retention practices, as well as the ongoing operations of immigration enforcement. These developments threaten to undermine the foundational goals of sanctuary city laws meant to protect vulnerable immigrant communities within our state.

ALPR technology also poses a risk to individuals who frequent sensitive locations like health care facilities, immigration clinics, gun shops, labor union halls, protest sites, and places of worship. Using this technology to monitor and target vehicles in these areas can create a chilling effect, discouraging individuals from seeking necessary services or participating in civic engagement due to fear of being tracked or apprehended by immigration authorities. Ultimately, these practices not only compromise community trust but also undermine the very principles of safety and protection that sanctuary laws aim to uphold.

Most ALPR data is stored in databases for extended periods, often up to five years. While police departments typically maintain these databases, they are frequently managed by private companies. Law enforcement agencies that do not have their own ALPR systems can access data collected by other agencies through regional sharing systems and networks operated by these private firms. Senate Bill 274 would prohibit public agencies from using ALPR systems to collect geolocation data at specific locations for immigration enforcement purposes and would limit the retention of ALPR information to no more than 30 days.

The temptation to “collect it all” should never overshadow the critical responsibility to “protect it all.” Senate Bill 274 is a significant legislative measure aimed at establishing robust safeguards and crucial oversight regarding the use of ALPR throughout our state. This bill is designed to ensure that the privacy of Californians is respected and preserved, while also maintaining compliance with existing sanctuary laws that safeguard vulnerable communities. Under this bill, public safety agencies will be required to collect only the data necessary for legitimate criminal investigations, thereby preventing any potential misuse of ALPR technology. Specifically, the legislation prohibits the use of ALPR information for immigration enforcement purposes, ensuring that local law enforcement agencies do not overreach or compromise the trust of the communities they serve. By implementing these measures, Senate Bill 274 aims to strike a balance between enhancing public safety and protecting individual privacy rights in our increasingly digitized world.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

According to the Senate Appropriations Committee:

• Department of Justice (DOJ): Unknown, potentially significant workload costs pressures (General Fund) to the DOJ to audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented a usage and privacy policy.

State and Local Agencies: Unknown, potentially significant costs (General Fund, local funds) to state and local agencies, including any law enforcement agency that uses ALPRs. If the Commission on State Mandates determines these costs to constitute a reimbursable state mandate, the state may need to reimburse these local costs.

SUPPORT: (Verified 5/23/25)

California Public Defenders Association

Surveillance Technology Oversight Project

OPPOSITION: (Verified 5/23/25)

Arcadia Police Officers’ Association

Brea Police Association

Burbank Police Officers’ Association

California Association of School Police Chiefs

California Coalition of School Safety Professionals

California Narcotic Officers’ Association

California Police Chiefs Association

California Reserve Peace Officers Association

California State Sheriffs’ Association

City of Thousand Oaks

Claremont Police Officers Association

Corona Police Officers Association

Culver City Police Officers’ Association

Electronic Frontier Foundation

Fullerton Police Officers’ Association

Los Angeles School Police Management Association

Los Angeles School Police Officers Association

Murrieta Police Officers’ Association

Newport Beach Police Association

Palos Verdes Police Officers Association

Placer County Deputy Sheriffs’ Association

Pomona Police Officers’ Association

Riverside Police Officers Association

Riverside Sheriffs’ Association

Santa Ana Police Officers Association

ARGUMENTS IN SUPPORT: Surveillance Technology Oversight Project writes:

Fusion centers in California and across the nation routinely facilitate ICE’s access to ALPR data, violating state and local protections for undocumented immigrants and allowing ICE to easily and efficiently intercept the individuals it targets. Cutting off ALPR data access is essential to blocking the mass deportation of Californians.

Senate Bill 274 will hold local law enforcement accountable if it shares ALPR data in violation of California’s sanctuary laws, ending the current status quo, which allows that sharing without consequences. Beyond this, it is an important privacy measure for all Californians: SB 274 will eliminate the over-long storage of data that reveals all California drivers’ life patterns, including where they live, work, socialize, and worship.

ARGUMENTS IN OPPOSITION: A coalition of law enforcement agencies, including the California Coalition of School Safety Professionals, writes:

While we appreciate the author’s effort to permit law enforcement to access LPR data when the information is used as evidence or for all felonies being investigated, there is no way to know in advance when the LPR data will be used as evidence or for a felony that has not yet been committed.

Additionally, the restrictions imposed by SB 274 would prevent investigators from accessing the LPR data for misdemeanors, including violent misdemeanors.

As currently amended, SB 274 will significantly hamper the ability of law enforcement to effectively investigate crimes throughout the state by requiring the deletion of LPR data after 30 days, thereby preventing investigators from using the LPR data to investigate crimes which occurred more than 30 days ago.

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

5/27/25 11:17:08

**** END ****

1. Automated License Plate Readers, To Better Protect Individuals’ Privacy, Law Enforcement Must Increase Its Safeguards for the Data It Collects (February 2020) California State Auditor, https://www.auditor.ca.gov/pdfs/reports/2019-118.pdf. ↑

SENATE COMMITTEE ON

Senator Anna Caballero, Chair

2025 - 2026 Regular Session

SB 274 (Cervantes) - Automated license plate recognition systems

Bill Summary:

SB 274 requires operators and users of automated license plate recognition systems to implement safeguards, as specified.

*********** ANALYSIS ADDENDUM – SUSPENSE FILE ***********

The following information is revised to reflect amendments

adopted by the committee on May 23, 2025

Fiscal Impact:

• Department of Justice (DOJ): Unknown, potentially significant workload costs pressures (General Fund) to the DOJ to audit any public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented a usage and privacy policy.
  
• State and Local Agencies: Unknown, potentially significant costs (General Fund, local funds) to state and local agencies, including any law enforcement agency that uses ALPRs. If the Commission on State Mandates determines these costs to constitute a reimbursable state mandate, the state may need to reimburse these local costs.
  

Committee Amendments:

• Allow DOJ to randomly audit agency ALRPS, instead of annually.
• Extend retention period requirements from 30 days to 60 days.

-- END --

SENATE COMMITTEE ON APPROPRIATIONS

Senator Anna Caballero, Chair

2025 - 2026 Regular Session

SB 274 (Cervantes) - Automated license plate recognition systems