Three of California's largest law enforcement associations — the California Police Chiefs Association (CPCA), the Peace Officers Research Association of California (PORAC), and the California State Sheriffs' Association (CSSA) — have jointly proposed a policy framework to govern how Automated License Plate Reader systems are accessed and operated by law enforcement. The proposal lays out specific requirements covering officer training, individual certification, data-sharing limits, security controls, vendor accountability, and criminal liability for intentional misuse.
PORAC President Brian Marvel said the framework is designed to provide clear standards that protect the public while allowing officers to perform their duties effectively.
Certification, Training, and Individual Accountability
At the center of the proposal is a certification requirement. Under the framework, any officer seeking access to an ALPR system would first need to obtain a unique certification number. That number would only be issued after the officer completes POST-approved training.
Certifications would not be permanent. The framework calls for annual renewals, keeping training current as technology and legal requirements change. Critically, the proposal prohibits the use of shared group accounts. Each certification number must remain tied to an individual officer — a direct check against the kind of anonymous, unattributable access that internal audits at agencies across the country have flagged as a compliance risk.
The training curriculum itself would cover authorized and prohibited uses of ALPR data, privacy considerations, ethics, applicable law, and data-sharing restrictions. That scope is intentional. Officers who understand the legal and ethical limits of a system are less likely to misuse it, and more likely to recognize when a request from another agency or a vendor crosses a line.
Data Sharing Restrictions and Access Controls
The framework draws hard lines around data sharing. It prohibits default national lookups, silent statewide sharing, and automatic query access by federal or out-of-state agencies. Each of those three practices can expose license plate location data to agencies that have no connection to a specific investigation and no accountability to the jurisdiction where the data was collected.
Agencies would be required to maintain complete logs of all ALPR system access and queries. That requirement pairs with the individual certification mandate: if every access event is logged and every user has a unique identifier, investigators and auditors can reconstruct exactly who pulled what data and when.
Encryption and security controls would also be mandated under the proposal, protecting sensitive law enforcement data from unauthorized access or breach. The framework extends that accountability to outside parties, requiring that vendors entrusted with law enforcement data be held responsible for their own security practices.
Audits, Penalties, and Enforcement Mechanisms
The proposal does not rely on internal agency self-reporting alone. It calls for regular audits by the California Department of Justice to verify compliance with the framework's requirements. DOJ audits add an independent check that internal reviews cannot replicate.
For the most serious violations, the framework recommends criminal penalties for intentional misuse of ALPR systems. That is a significant escalation beyond administrative discipline. Attaching criminal liability to deliberate abuse signals that the associations view misuse not as a policy infraction but as conduct that warrants prosecution.
Together, the audit requirement and the criminal penalty recommendation create a two-track enforcement structure: routine oversight through DOJ review, and legal consequences for willful misconduct.
The Federal Gap This Proposal Addresses
The California proposal arrives in a legislative vacuum at the national level. There is currently no specific federal framework governing how law enforcement agencies may use ALPR systems. That absence leaves individual states and agencies to set their own rules — or none at all.
The scale of ALPR deployment makes that gap significant. Crowdsourced data collected as of August 2026 indicated more than 137,000 ALPR cameras had been mapped across the United States. No federal statute currently governs how data from those cameras is retained, shared, or accessed.
Congress has taken early steps. H.R. 9800 has been introduced to potentially prohibit federal agencies from contracting with certain surveillance vendors. A separate bill, H.R. 9716, would require the Attorney General to maintain a comprehensive list of surveillance technologies used by state and local agencies, and would bar federal law enforcement agencies from accessing state or local ALPR data without a warrant issued by a federal judge. Neither bill has been enacted.
Until federal legislation moves, states are setting the terms. The California framework, if adopted, would represent one of the more detailed state-level attempts to impose uniform standards on ALPR access — covering everything from how officers are trained to how vendors store data to what happens when someone deliberately abuses the system.
