State legality map: ALPR regulation across the United States.
A practical reference covering which states regulate ALPR use, what retention limits apply, where private use is prohibited, and the constitutional caselaw evolving around plate-data surveillance.
The state of state law.
State regulation of ALPR is the practical reference question every institutional buyer asks. The answer is more complicated than the question, and three structural facts shape it.
First, most states have no ALPR-specific statute. As of mid-2026, roughly 16 to 18 states have enacted explicit ALPR legislation. The rest govern ALPR through general surveillance law, public records law, motor vehicle regulation, and state constitutional privacy provisions, none of which were drafted with ALPR specifically in mind. The legislative momentum has been incremental: per Stateline reporting, just three states passed new ALPR statutes in 2025, and at least ten others introduced legislation that did not advance.
Second, where ALPR-specific statutes exist, they almost universally regulate law enforcement use of ALPR. They do not address commercial vendor data sales, private ALPR deployment by corporations or HOAs, or cross-border commercial data flows. A state may tightly regulate how its own police use Vigilant or Flock data while leaving DRN's commercial database entirely unaffected. The structural gap between LE regulation and commercial regulation is the central practical problem.
Third, the legislative landscape is moving. California's SB 274 was vetoed by Governor Newsom in October 2025 despite legislative passage. Virginia enacted HB 2724 in 2025 imposing significant new restrictions. Oregon's 2026 statute went into effect with 30-day retention limits. Washington has legislation introduced in January 2026 proposing 72-hour retention. The federal Fourth Amendment frame is also evolving, with Schmidt v. Norfolk now on appeal to the Fourth Circuit.
The federal frame.
There is no federal ALPR statute. The federal regulatory frame for plate data operates through three other vectors, each addressing a different slice of the data lifecycle.
The federal frame does not address the central commercial question of plate-plus-geolocation commerce. The Atlas documents 10 confirmed commercial data vendors and 9 selling plate-plus-geolocation data. None of these are regulated by a federal ALPR-specific framework. The structural gap is the regulatory condition the rest of this document maps.
Three tiers of state approach.
For practical reference purposes, state approaches sort into three categories. The tier distinction matters because compliance scales with tier: Tier 1 states may prohibit private use entirely; Tier 2 states require operational controls on LE use; Tier 3 states require attention to general privacy and surveillance frameworks but no ALPR-specific compliance.
States with statutes that either prohibit private ALPR entirely or impose strict retention limits and access controls on all use. The strictest jurisdictional regimes in the US.
States with statutes imposing operational requirements on LE use of ALPR: retention limits, usage policies, audit requirements, access controls. Commercial regulation generally absent.
The majority of US states. ALPR use is governed by general surveillance, privacy, and public-records law. Constitutional protections apply but operate through general Fourth Amendment doctrine without ALPR-specific provisions.
A note on categorization: assignments can shift as states amend statutes or add new ones. Massachusetts, for example, has no comprehensive ALPR statute but produced the most influential state appellate ruling on the constitutional frame (Commonwealth v. McCarthy, 2020). Tier categorization captures statutory posture; the caselaw frame discussed in Section VI cuts across tiers.
The state matrix.
A reference matrix of the regulated states. Tier 1 rows are highlighted. Tier 3 states are not enumerated individually because they lack ALPR-specific statutory provisions; consult general state surveillance and privacy law for those jurisdictions.
| State | Statute | LE Retention | Private Use | Notable Provisions |
|---|---|---|---|---|
| New Hampshire | RSA 261:75-b | 3 minutes | Prohibited | The strictest US regime. Data must be purged within 3 minutes of capture unless triggered by an arrest, citation, protective custody, or BOLO match. Case-by-case access. LE-only authorization with audit-trail requirements. |
| Maine | 29-A MRSA §2117-A | 21 days | Prohibited | Use restricted to specific public safety agencies. Private use prohibited with limited exceptions. 21-day retention unless tied to a specific investigation. |
| Arkansas | Ark. Code §12-12-1803 | Limited | Prohibited | Prohibits ALPR use by individuals, partnerships, corporations, associations, and state agencies. Restrictive LE allowance only. One of the broadest prohibitions in the country. |
| Vermont | 23 V.S.A. §1607 | 18 months | Restricted | Limits deployment to LE agencies for specified purposes. 18-month retention, longer than most regulated states. Annual reporting requirements. |
| Utah | UCA §41-6a-2003 | Per policy | Restricted | Comprehensive ALPR statute covering both public and limited private use. Detailed written policy requirement; usage logging; access restrictions. |
| California | Civ. Code §1798.90.5 et seq. (SB 34, 2015) | Per policy | Restricted | Usage and privacy policy required for operators and end-users. Civ. Code §1798.29 breach notification applies. SB 274 (2025) would have added 60-day retention and randomized audits; vetoed by Newsom October 2025. |
| Virginia | HB 2724 (2025); Va. Code §2.2-5517 | 21 days | Restricted | 2025 statute imposed 21-day retention, prohibited out-of-state and federal sharing, created vendor approval process, required annual reports. ACLU/EFF allege violations of cross-jurisdictional sharing prohibition. |
| Oregon | 2026 ALPR law (HB 2186 enacted) | 30 days | Restricted | 30-day retention unless tied to criminal inquiry or court proceedings. Authorities must log purpose of searches and the specific type of crime or violation being investigated. |
| Minnesota | Minn. Stat. §13.824 | 60 days | Restricted | Detailed access rules. Data classified as private or nonpublic by default. Biennial independent audit requirement. 2024 amendments tightened access logging. Data sharing with non-LE prohibited. |
| Maryland | Md. Pub. Safety §3-509 | 1 year | Restricted | LE-deployed data ownership rules established. HB1081/SB840 (2024) clarified that LE-collected ALPR data may not be sold for any purpose by a state or local LE agency. |
| North Carolina | NCGS §20-183.30 et seq. | Per policy | Restricted | 2023 statute. Creates Class 1 misdemeanor for unauthorized access, preservation, or disclosure. 2024 pilot program permits DOT to authorize ALPRs on state right-of-way (expires July 2025; extension pending). |
| Florida | F.S. §316.0777 | Per policy | Unregulated | Public records exemption for ALPR images and data. Personal identifying information from ALPR is confidential. Disclosure only to criminal justice agencies and to the individual to whom the plate is registered. |
| Tennessee | Tenn. Code §55-8-198 | Per policy | Unregulated | ALPR installation permitting on rights-of-way. TDOT permit required for installation on state right-of-way. No commercial restriction. |
| Montana | Mont. Code §46-5-118 | 90 days | Unregulated | 90-day retention limit on LE-collected ALPR data. Limited prescriptive provisions beyond retention. |
| Georgia | Ga. Code §35-1-22 | 30 months | Unregulated | 30-month retention limit (one of the longest among regulated states). LE usage focus. |
| Nebraska | Neb. Rev. Stat. §60-3206 | Per policy | Restricted | Government entities using ALPRs must adopt and post a privacy policy. Restricts uses by government entities; limited private restriction. |
| Illinois | 625 ILCS 5/11-208.10 | Per policy | Unregulated | Prohibits ALPR use to investigate immigration status or to interfere with reproductive health services. Recent expansion under 2024 amendments. |
| Oklahoma | 47 O.S. §7-606.1 | Per policy | Restricted | ALPR systems may not be used "for purposes other than enforcement of the Compulsory Insurance Law." Among the most narrow statutory authorizations of ALPR in the US. |
| Washington | Pending: SB 6042 (Jan 2026) | 72 hours (proposed) | Pending | 2026 bill proposes 72-hour retention with category-specific exceptions: parking 12 hr; commercial vehicle enforcement 4 hr; traffic studies 30 days; tolls retained for collection. AG registration required. |
States not enumerated here either have no ALPR-specific statute (the majority of jurisdictions) or have provisions too narrow to warrant a row (a few states with single-issue provisions like tolling-only authorization). The absence of statute does not imply absence of regulation: general state surveillance law, motor-vehicle privacy law, and state constitutional protections all continue to apply.
Notable states in detail.
Four states warrant closer treatment. New Hampshire and Maine because they anchor the strictest regulatory tier. California because of legislative scale and recent veto activity. Virginia because of the contested 2025 statute now reflected in the lead federal caselaw.
Effectively the strictest ALPR regulatory regime in the United States. The statute requires that records of plates read by an LPR "shall not be recorded or transmitted anywhere and shall be purged from the system within 3 minutes of their capture" unless one of four triggering events occurs: arrest, citation, protective custody, or identification of a vehicle subject to a missing-person or wanted broadcast.
The practical effect is that historical ALPR databases are not permitted in New Hampshire. Access to retained records is allowed only on a case-by-case basis for investigative, prosecution, or audit purposes. All inquiries must be recorded for audit-trail purposes. Private use is effectively prohibited.
Restricts ALPR use to specific public safety agencies with limited exceptions for tolling and parking authorities. Private use is prohibited. Data retention is limited to 21 days unless tied to a specific criminal investigation or court proceeding.
Like New Hampshire, Maine effectively excludes private ALPR deployment as a meaningful market. Some commercial vendors (including Verizon's Intelligent Video 2.0 service) explicitly identify Arkansas, Maine, and New Hampshire as jurisdictions where their ALPR service is unavailable for private use.
SB 34 requires ALPR operators and end-users to adopt and maintain a written usage and privacy policy. The California Highway Patrol's retention is limited to 60 days unless data is being used as evidence. Public disclosure of the policy is required.
SB 274 (2025) would have added a 60-day retention cap with deletion requirements, restrictions on out-of-state sharing, and randomized state audits. Despite legislative passage, Governor Newsom vetoed the measure in October 2025, citing concerns about impact on criminal investigations. The veto preserved the existing 2015 framework without strengthening it.
Virginia's 2025 statute imposed 21-day retention, prohibited out-of-state and federal sharing, established a vendor approval process, and required annual reports. Effective July 1, 2025. The Virginia State Crime Commission produced an extensive analytical record supporting the statute.
The statute is now central to Schmidt v. City of Norfolk, the lead federal case on the constitutional frame for ALPR. ACLU/EFF allege that Virginia LE agencies have already violated the cross-jurisdictional sharing prohibition. Governor's office proposed 2025 amendments to expand retention to 30 days and delay the reenactment clause; both were rejected by the General Assembly.
Constitutional caselaw.
The constitutional frame for ALPR is in active development. Four cases anchor the current state of the doctrine, two foundational and two current.
Held that warrantless government acquisition of cell-site location information violates the Fourth Amendment, departing from the prior third-party doctrine for the specific case of comprehensive location records. The decision established the mosaic theory: the aggregation of records that are individually unremarkable can produce a constitutionally protected picture of the whole of a person's movements.
Carpenter is the foundational case for any ALPR constitutional analysis. The question lower courts have been working through since is the line between Carpenter-style continuous CSLI and ALPR-style fixed-camera aggregate data.
The Massachusetts Supreme Judicial Court applied the mosaic theory to ALPR data. Held that "the defendant has a constitutionally protected expectation of privacy in the whole of his public movements" and that this interest "could be implicated by the widespread use of ALPRs."
In the case itself, the limited deployment (four cameras at two bridge locations over two and a half months) fell short of the constitutional threshold. But Justice Gaziano wrote that "with enough cameras in enough locations, the historic location data from an ALPR system in Massachusetts would invade a reasonable expectation of privacy." The decision left the precise threshold undefined while establishing that the threshold exists.
The Eastern District of Virginia granted summary judgment to the City of Norfolk in a Fourth Amendment challenge to its 176-camera Flock Safety ALPR network. Plaintiffs' vehicles had been captured 475 and 325 times respectively over a four-and-a-half-month period, averaging 2 to 3 captures per day during the 21-day retention window.
Judge Mark S. Davis concluded that the system did not amount to a Fourth Amendment search because it did not provide continuous tracking, contained gaps, and captured only information visible on public roads. The plaintiffs "are unable to demonstrate that defendants' ALPR system is capable of tracking the whole of a person's movements." On appeal to the Fourth Circuit; ACLU, ACLU of Virginia, and EFF filed amicus brief April 20, 2026, arguing the district court misread Carpenter and the Fourth Circuit's prior Leaders of a Beautiful Struggle decision.
The Fourth Circuit held en banc that Baltimore's aerial surveillance program (the AIR program) violated the Fourth Amendment because it enabled retrospective tracking of vehicle movements throughout the city. The decision applied Carpenter's mosaic theory to surveillance that did not provide continuous, real-time tracking but did enable post-hoc reconstruction of movements.
Leaders is the most directly relevant Fourth Circuit precedent for Schmidt. The amicus brief in Schmidt argues that the district court's reasoning is in tension with Leaders. The Fourth Circuit's resolution of Schmidt will be the most consequential federal appellate decision on ALPR since Carpenter.
The trajectory of the constitutional doctrine remains contested. The mosaic theory has won at the Supreme Court (Carpenter), at the Massachusetts Supreme Judicial Court (McCarthy), and at the Fourth Circuit en banc for aerial surveillance (Leaders). It has not yet been definitively applied to fixed-camera ALPR at the federal appellate level. Schmidt is the case to watch.
The commercial sale gap.
The structural feature of the regulatory landscape that matters most for institutional buyers: state ALPR statutes overwhelmingly regulate law enforcement use, not commercial sale.
Consider the contrast. New Hampshire imposes the strictest ALPR regime in the US, requiring 3-minute data purge for LE deployments. The statute does not address the question of whether a Texas-based commercial vendor (DRN, MVTRAC, Vigilant) may sell plate-plus-geolocation data captured in or about New Hampshire residents to a Texas-based recovery agent. The vendor never operates ALPR cameras within New Hampshire's regulatory reach; the data flows through commercial channels governed by the state of capture, the state of incorporation, and federal law, none of which contain New Hampshire-style restrictions.
Maryland is the partial exception. HB1081/SB840 (2024) clarified that LE-collected ALPR data may not be sold for any purpose by a state or local LE agency. This is a meaningful restriction within the LE channel, but it does not address commercial vendors' independent collection. Virginia's 2025 statute prohibits out-of-state and federal sharing of LE-collected data, which similarly addresses one specific channel without touching commercial collection.
The structural gap is large enough that the commercial data flows discussed in the Atlas, the Two Stacks, and the Monetization Pressure documents operate substantially outside the state ALPR regulatory framework. The DPPA frame covered in Document 05 addresses the conversion of plate to identity, but it does not address the upstream collection or downstream commercial trade in plate-plus-geolocation data itself.
The practical implication: state ALPR compliance for institutional buyers is best understood as one of several compliance frames operating in parallel, not as the dominant frame. The commercial sale of plate-plus-geolocation data is governed primarily by vendor terms, broker-layer credentialing, and federal frames adjacent to but not addressing ALPR specifically.
What this means.
For compliance counsel. State ALPR compliance is a portfolio question, not a single-statute analysis. The relevant operations are: (i) any deployment of ALPR by the institution or its vendors that captures data in a Tier 1 or Tier 2 state; (ii) any LE relationship that touches institution-collected ALPR data; (iii) any commercial vendor relationship where the vendor operates ALPR or sells ALPR-derived data. The state-by-state matrix in Section IV is the starting point, not the endpoint.
For institutional buyers and CISOs. The state framework matters more for deployment-side compliance than for exposure-side risk modeling. The commercial gap means that movement-data exposure of executives, employees, and customers is governed primarily by vendor practices rather than state law. Reducing exposure runs through broker-layer opt-outs, public records suppression, and personal-tier defenses (Document 08), not through expecting state law to constrain commercial vendors.
For policy researchers. The commercial sale gap is the single most important regulatory question in the ALPR ecosystem. Existing state statutes address LE use, where some Fourth Amendment doctrine already constrains behavior. Commercial sale is the territory where state regulation is least developed and where federal regulation does not exist. Policy proposals that address only LE use leave the more rapidly growing commercial channel unregulated.
For litigators. Schmidt v. Norfolk is the decision to watch. The Fourth Circuit's resolution will set the federal-appellate baseline for the next decade. If the Fourth Circuit affirms, the mosaic theory remains effectively constrained to cellular-tracking-like scenarios. If the Fourth Circuit reverses, fixed-camera ALPR networks of meaningful coverage density become presumptive Fourth Amendment searches. The implications for both LE practice and commercial data flows are substantial.
The implications carry to Document 07, which examines the NDAA and federal-procurement frame for the subset of the ecosystem that touches federal contracting, and to Document 08, which translates the regulatory landscape into defensive moves for institutions and individuals operating in it.