Automated License Plate Reader Data Retention: A State-by-State Policy Comparison

An automated license plate reader (ALPR) captures every plate that passes it, not just the ones tied to a warrant or a BOLO. A typical fixed ALPR installation on a busy arterial road logs tens of thousands of reads a day, and the overwhelming majority of those reads belong to vehicles with no connection to any investigation. What an agency does with that non-hit data — how long it’s kept, who can query it, and whether it’s shared outside the agency — is the part of ALPR policy that generates the most legal and public scrutiny, and it is governed by a patchwork of state law rather than any single federal standard.

For agencies deploying or expanding an ALPR program, understanding where their state falls on this spectrum isn’t optional. Retention rules determine what the department’s own policy is legally permitted to say, and getting it wrong exposes agencies to the kind of litigation that has already reshaped ALPR programs in several states. The underlying tension is a familiar one across investigative technology generally: the same volume-versus-oversight tradeoff shows up in how agencies handle digital evidence intake and triage, just applied to license-plate data instead of phones and laptops.

Why Retention Is the Central Policy Question

ALPR systems don’t identify people — as the International Association of Chiefs of Police notes in its model ALPR policy guidance, they identify vehicles, and the data becomes personally identifying only when cross-referenced against registration records or combined with enough location history to reconstruct a pattern of a specific driver’s movements. That reconstruction risk — a detailed movement history built entirely from non-hit reads accumulated over months or years — is what retention limits are designed to prevent.

The ACLU has tracked and published ALPR retention comparisons across states for years precisely because the variation is so wide, and because retention period is the single policy lever most directly tied to how much of a driver’s movement history can be reconstructed after the fact.

States With Short, Fixed Retention Windows

Maine has one of the most restrictive statutory limits in the country: 21 days for non-hit data under state law, after which it must be purged unless it is part of an active, documented investigation. Maine’s law also restricts who can access the data and requires an audit trail for every query.

New Hampshire goes further than nearly any other state. Its highway-surveillance statute, RSA 236:130, broadly prohibits surveillance that can identify a vehicle’s owner or occupants on public ways, permitting it only in narrow circumstances — such as the case-by-case investigation of a particular offense — rather than allowing the general-purpose continuous logging most ALPR deployments rely on. This is a meaningfully different model from most states: it constrains what data can be collected in the first place, not just how long it can be kept afterward.

Vermont sets an 18-month retention limit under 23 V.S.A. § 1607, with state police required to report annually on program use and query volume.

Arkansas permits 150 days of retention for non-hit data, a middle-ground figure that reflects a compromise between investigative utility and privacy concerns raised during that state’s legislative debate.

States That Delegate to Local Policy

California took a different regulatory approach with SB 34 (2015), which does not set a single statewide retention number but instead requires every agency operating an ALPR system to adopt a public, board-approved usage and privacy policy, implement specific data security safeguards, and prohibit sharing with federal immigration enforcement absent a warrant. Individual California agencies have set their own retention windows under this framework — commonly one year, though it varies by department — which means the practical retention limit in California depends on which city or county’s policy applies.

Many states have no ALPR-specific statute at all, leaving retention entirely to individual agency policy, often shaped by the agency’s records-retention schedule for other investigative data rather than any ALPR-specific standard. This is the most common posture nationally, and it produces the widest variation: neighboring jurisdictions in the same state can run retention windows that differ by months or years.

What Drives the Legislative Debate

The recurring argument for shorter retention windows centers on the “digital dragnet” concern — that indefinite retention of non-hit location data effectively builds a searchable movement-history database on every driver whose plate happens to pass an ALPR camera, without individualized suspicion. Courts have engaged with a version of this concern in other location-tracking contexts (most notably the Supreme Court’s reasoning in Carpenter v. United States regarding cell-site location data), and privacy advocates have argued the logic extends to aggregated ALPR data.

The recurring argument for longer retention centers on investigative utility in cases that aren’t solved quickly — a hit-and-run, a missing-persons case, or a pattern crime where the relevant plate isn’t identified as a suspect vehicle until weeks or months after the read occurred. Agencies operating in states with very short windows report losing investigative leads that a longer retention period would have preserved, which is the core tension every legislature drafting an ALPR statute has to resolve.

Practical Guidance for Agencies

Agencies operating in states without a specific statutory retention limit are not exempt from getting this right — the absence of state law simply shifts the responsibility to the agency’s own written policy. A defensible ALPR retention policy, regardless of the state’s statutory baseline, generally includes:

A specific, written retention period for non-hit data rather than indefinite retention by default. Even where state law permits longer retention, agencies that adopt a shorter internal standard reduce both privacy exposure and the volume of data subject to public-records requests or discovery in unrelated litigation.

A documented audit trail requiring that every query against the ALPR database be logged with the querying officer’s identity, the reason for the query, and the case number where applicable. This is the control most frequently cited in ALPR misuse investigations nationally — misuse tends to surface not because the data existed, but because nobody could reconstruct who queried it and why.

Clear rules on data sharing with outside agencies, particularly across jurisdictional and state lines, since ALPR data shared into regional or national databases (such as vendor-operated shared networks) can outlive the retention period the originating agency itself applies internally.

Shared and Vendor-Operated Networks Complicate the Picture Further

An agency’s own retention policy governs the data it stores on its own systems, but a substantial share of ALPR data today moves through shared, vendor-operated networks that sit outside any single agency’s direct control. Motorola Solutions’ Vigilant Solutions platform and Flock Safety’s growing municipal camera networks both operate models where participating agencies can query data contributed by other agencies across jurisdictional and, in some deployments, state lines. That cross-jurisdictional sharing means a plate read captured and retained briefly under one agency’s own strict internal policy may already have been copied into a shared network with a different retention standard before the originating agency’s own purge schedule ever takes effect.

This is precisely the scenario that has drawn the most sustained attention from privacy researchers and journalists tracking ALPR deployment nationally: an agency can comply fully with its own state’s retention statute and its own written policy while the practical retention of that same data, once shared, is effectively governed by whichever participating agency in the network keeps it longest. Agencies evaluating a shared ALPR network as part of a new deployment should treat the network operator’s own data-sharing and retention terms as a distinct policy question from their internal retention rule, not an implementation detail to be resolved later.

What Agencies Considering a New Deployment Should Ask First

Before adopting or expanding an ALPR program, agencies operating in a state without a specific statutory retention limit should resolve several questions in writing before the first camera goes live, rather than treating policy development as something that can follow deployment. What is the agency’s own non-hit retention period, and is it shorter than what state law would otherwise permit by default? Which outside agencies, if any, will have query access to the agency’s data, and under what documented justification? If the agency is joining a vendor-operated shared network, what does that network’s own retention and sharing policy say, and does it match or exceed the agency’s own internal standard? Agencies that answer these questions before procurement, rather than after a public-records request or a legal challenge forces the issue, are consistently the ones whose ALPR programs survive first contact with public scrutiny intact.

Frequently Asked Questions

Does federal law set an ALPR retention standard?

No. There is no federal statute governing ALPR data retention; the regulatory landscape is entirely state-by-state, supplemented by individual agency policy where state law is silent.

Which state has the shortest ALPR retention period?

Maine’s 21-day limit for non-hit data is among the shortest fixed statutory windows in the country, though New Hampshire’s law is arguably more restrictive overall because it limits the purposes for which ALPR data can be collected in the first place, not just how long it’s kept.

Can ALPR data be shared with other agencies or states?

It depends on state law and agency policy. Some states, including California under SB 34, place specific restrictions on sharing (for example, barring sharing with federal immigration enforcement absent a warrant). Where no such restriction exists, ALPR data can often be shared into regional or vendor-operated networks, which raises its own retention and oversight questions separate from the originating agency’s policy.

Why do privacy advocates focus on ALPR retention specifically, rather than ALPR use overall?

Because retention period determines how much historical movement data exists to be queried, subpoenaed, or breached after the fact. A short retention window limits the damage of any future misuse or breach; an indefinite one means years of a driver’s location history could be exposed by a single bad query, a data breach, or a broadly worded subpoena.