For most of us, a drive to the grocery store or a commute to work is a mundane ritual. But in an increasing number of American neighborhoods, that drive is being digitally archived. What began as a straightforward tool for logging license plates has evolved into a sophisticated AI surveillance web capable of identifying faces, flagging “unusual” travel patterns and building detailed movement profiles—often without the driver ever knowing they are being watched.
Companies like Flock Safety now operate in communities across 49 states, providing data that is accessible to thousands of law enforcement agencies. Civil liberties groups have raised alarms that this data doesn’t always stay local, often finding its way into the hands of federal immigration enforcement and other national agencies. As federal privacy legislation remains stalled, the frontline of the battle for road privacy has shifted to state legislatures, where a patchwork of laws is attempting to curb the reach of the “AI eye.”
The stakes are higher than simple traffic enforcement. Modern systems can now use “Freeform” search capabilities, allowing police to enter descriptive queries—such as a specific bumper sticker or a roof rack—to pull up every vehicle that matches the description across a network of cameras. This transforms a tool meant for finding stolen cars into a machine for mass surveillance.
To understand which protections actually work, I spoke with Chad Marlow, senior policy counsel and lead for the American Civil Liberties Union’s (ACLU) surveillance work. Marlow emphasizes that the problem isn’t just one company, but an entire industry of AI-driven ALPRs (Automatic License Plate Readers). “Collective action, rather than individual action, is required,” Marlow told me. He warned that simply switching from one vendor, like Flock, to another, such as Axon or Motorola, may offer “minimal harm reduction” but is far from a systemic solution.
Beyond the License Plate: The Rise of AI Profiling
The current surveillance infrastructure focuses on two primary technologies: ALPRs and AI-equipped drones. While ALPRs were originally designed to read plates, new AI features allow them to capture “vehicle fingerprints”—unique characteristics of a car that can identify it even if the plate is missing or obscured. Simultaneously, drones are being deployed with cameras that can automatically recognize human features, such as beards or clothing colors, and follow subjects in real-time.
The primary risk, according to privacy advocates, is the creation of a “location dossier.” When data is stored long-term, law enforcement can reconstruct a person’s entire life: where they worship, who they visit, and which protests they attend. “The idea of keeping a location dossier on every single person just in case one of us turns out to be a criminal is just about the most un-American approach to privacy I can imagine,” Marlow said.
The State-by-State Battle for Digital Privacy
Because there is no federal standard, privacy on the road depends entirely on your zip code. Some states have adopted broad biometric protections, while others focus on the specific “life cycle” of the data collected.
Biometric and Personal Information Laws
Illinois has set a high bar with the Biometric Information Privacy Act (BIPA), which protects fingerprints and facial data and requires written consent for their use. This law is so stringent that it has blocked certain facial recognition features of Google Nest and Flock Safety within the state. Similarly, the city of Portland, Oregon, has passed local legislation to limit facial recognition.
However, a critical gap remains: many biometric laws do not explicitly cover license plate data. California is currently a notable exception, as it is the only state to formally categorize ALPR data as “personal information” under its privacy framework.
Data Minimization and Deletion
One of the most effective ways to prevent the creation of location dossiers is “data minimization”—forcing the police to delete footage unless it is tied to an active investigation. The timelines for this deletion vary wildly across the country, creating a stark difference in privacy levels.
| State | ALPR Data Retention Limit | Privacy Impact |
|---|---|---|
| New Hampshire | 3 Minutes | Highest protection; prevents pattern-of-life tracking. |
| Washington | 21 Days | Moderate; allows for short-term investigation. |
| Virginia | 21 Days | Moderate; prevents long-term archiving. |
| Various States | Several Years | Low; allows for detailed movement profiling. |
Marlow notes that while 21 days is the “outermost acceptable limit,” New Hampshire’s three-minute rule is the gold standard for preventing the abuse of surveillance data.
Closing the Drone and Data-Sharing Loopholes
Even with strong laws, “carveouts” often render protections toothless. For example, several states including Alaska, Idaho, Utah, and Texas require a warrant before drones can be used for surveillance. In practice, however, law enforcement often utilizes exemptions for “emergency” situations—such as gunshot detection or 911 calls—to bypass the warrant requirement.
Another major concern is the “backdoor” sharing of data with federal agencies. In states like Virginia and Illinois, laws have been passed to make it illegal to share ALPR data outside the state, specifically to prevent the Department of Homeland Security (DHS) and Immigration and Customs Enforcement (ICE) from accessing local camera feeds. Despite these laws, enforcement remains demanding because tracking the digital transmission of data between agencies is a complex technical challenge.
Some states are attempting to solve this through transparency. Minnesota, for instance, has implemented requirements to make ALPR searches public, allowing citizens to see if the police have been tracking their vehicle.
How to Track and Influence Your State’s Laws
For those concerned about the surveillance in their own communities, the ACLU and other advocacy groups suggest focusing on “collective action” rather than individual privacy settings. Because these laws are frequently challenged or ignored by vendors and police departments, they require constant civic oversight.
- Monitor Legislation: Track bills related to “Biometric Privacy” or “ALPR Regulation” in your state capital.
- Local Governance: Voice concerns at city council forums, as many surveillance contracts are signed at the municipal level before state laws can intervene.
- Support Advocacy: Initiatives like The Plate Project from the Institute of Justice provide resources for citizens to fight overreaching surveillance.
Disclaimer: This article is provided for informational purposes only and does not constitute legal advice. Privacy laws vary by jurisdiction and are subject to change. Please consult a legal professional for advice regarding specific legal issues in your state.
The next critical checkpoint for these protections will be the 2025 legislative sessions, where several states are expected to debate new exemptions for drone surveillance and the expansion of biometric definitions to include vehicle-specific AI data. As the technology evolves faster than the law, the window to establish permanent privacy boundaries is closing.
Do you think ALPRs are a necessary tool for public safety, or an overreach of state power? Share your thoughts in the comments or share this story to start a conversation in your community.
