One year ago, the California State Auditor released a damning report on the use of automated license plate readers (ALPRs) by local law enforcement agencies that confirmed concerns EFF has raised for years. Police are using these camera systems to collect enormous amounts of sensitive data on Californians' travel patterns. Yet they often haven't followed the basic requirements of a 2015 state law, S.B. 34, passed to protect privacy and civil liberties from ALPRs. While the auditor only conducted a deep-dive into four jurisdictions—Los Angeles, Fresno, Sacramento County and Marin County—all were found to be noncompliant. Investigators concluded that the problem was likely widespread among the hundreds of local agencies using the technology.
This legislative session, State Sen. Scott Wiener has introduced the License Plate Privacy Act (S.B. 210), a bill that would address many of these deficiencies by strengthening the law with additional requirements and safeguards. EFF is proud to co-sponsor this legislation alongside our ally, the Media Alliance.
Police install ALPR cameras in fixed locations, such as streetlights and overpasses, to capture the license plates of passing cars. They also install them on patrol cars, allowing police to "grid" neighborhoods—driving up and down every block in order to gather information on parked vehicles. This data is uploaded along with GPS and time-date information to a searchable database.
The result? With just a few keystrokes, police can search the historical travel patterns of a vehicle or identify vehicles that visited certain locations. Police can also add vehicles to a "Hot list," which is essentially a watch list that alerts them whenever a targeted vehicle is caught on camera. If a patrol car has an ALPR, the officer will be notified whenever they pass a vehicle on the watch list. However, by default, ALPRs collect data on everyone, regardless of whether you have a connection to a crime.
That means a lot of surveillance for no justifiable reason. EFF's own research found that agencies collected immense amounts of data on drivers, but only a small fraction (less than 1%) of those license plates are actually part of an active investigation. In addition, police agencies often share access to this data with hundreds of law enforcement agencies nationwide, most of which have no need for unfettered access to Californians' data. The California State Auditor reached the same conclusions, noting that agencies could not justify why they were collecting so much data, and why they needed to hold onto it for so long (often years).
S.B. 34 was designed to regulate this technology by requiring agencies to have detailed privacy and usage policies. The auditor, however, found that the Los Angeles Police Department had failed to create such a policy, despite telling a legislative committee it was fully compliant. Others in the audit had policies, but those policies did not meet the legally mandated criteria. As EFF has noted, in many cases, agencies use a boilerplate template generated by the company Lexipol that is itself inadequate.
S.B. 210 builds upon the 2015 law by adding new requirements, such as:
- Requires agencies to delete data after 24 hours (at a maximum) unless a license plate is on a hot list (i.e. that it is connected to a public safety interest).
- Requires annual audits of the searches of the ALPR database and to ensure that data has been deleted.
- Requires the California Attorney General to draft a model policy that agencies should use.
- Prohibits public agencies from accessing databases with ALPR information that is more than 24 hours old and not on a hot list.
"It’s troubling, to say the least, that so many California law enforcement agencies are harvesting massive amounts of ALPR data, retaining that data for no reason, and recklessly distributing it to other agencies around the country, including ICE," Sen. Wiener said. "ALPR data is truly the Wild West in California, and this legislation will bring much-needed privacy protections.”
EFF's Atlas of Surveillance has identified more than 250 California agencies using ALPRs or accessing ALPR data, and that number seems to grow each month. For more information on automated license plate readers, check out EFF's Street-Level Surveillance hub and Data Driven project.
