EFF: License Plate Readers Raise Surveillance and Data Breach Concerns
Days after the Electronic Frontier Foundation (EFF) announced a lawsuit against the city of San Jose for using Flock Safety’s automated license plate readers (ALPRs) to conduct location searches without obtaining a warrant (see 2511190008), the organization released research on how the technology is used for surveillance.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
“This is what is able to happen when you give police departments so much data with unchecked power,” said Rin Alajaji, EFF legislative activist, in an interview with Privacy Daily. She and Dave Maass, director of investigations at EFF, conducted the research and have written several blog posts recently about ALPR data.
Using public records requests, the researchers obtained datasets representing more than 12 million searches logged by nearly 4,000 agencies between December 2024 and October 2025. Alajaji and Maass found that “more than 50 federal, state, and local agencies ran hundreds of searches through Flock's national network of surveillance data in connection with protest activity.”
“The way that these systems are sold” is as “a tool for law enforcement to solve crime,” Alajaji said. But what “we've seen” is “that law enforcement can very easily make those searches without any cause,” and because there’s no warrant requirement, “no one has to really prove the reason why they're making this search.” But that could be changing, she added.
EFF and other civil liberty groups believe a warrant should be required for law enforcement to search ALPR databases.
In litigation from Norfolk, Virginia, a judge said that a warrant is required to search these databases, Alajaji said. Additionally, some jurisdictions have protections or limitations regarding ALPR data, she added: Illinois, for example, has “certain laws that prohibit the search of ALPRs for things like protected health care activities."
California also has a 2015 law that prohibits state and local law enforcement agencies from sharing ALPR data with federal and out-of-state agencies, something the attorney general invoked when the state sued the city of El Cajon at the beginning of October for violations of the statute (see 2510030046).
But surveillance is not the only issue. When there's "a massive trove of data available … data breaches are always a concern,” said Alajaji. Another question is “who gets access to it?”