Every time you pass a police camera — at a highway on-ramp, outside a grocery store, near a house of worship — your plate may be scanned, timestamped, and stored. Automated license plate readers (ALPRs) are camera systems that capture your plate, convert it to searchable text, and log where you were and when. The roughly 18,000 public safety agencies across the U.S. deploy them at scale. Now, the Policing Project at NYU School of Law has released the first scorecard ranking all 50 states on how well their laws govern these systems. The headline finding: no state earns a perfect score.
Seven Tests. Zero Perfect Scores.
The scorecard evaluates each state across the full lifecycle of plate data — from the moment of capture to what happens when the rules get broken.
On privacy, that means a warrant requirement or a retention cap of 30 days or fewer for non-hit data. On false positives, it checks whether officers must independently verify a plate match before acting on an alert. Data sharing gets scrutinized for a formal, documented process — not ad hoc arrangements. The policing protests criterion looks for limits on surveilling First Amendment activity. Auditing, transparency, and enforcement round out the seven, with enforcement meaning actual legal remedies: exclusion of evidence, civil damages, financial penalties — not just internal memos.
“Half of U.S. states have no regulation of ALPRs whatsoever.” — Policing Project at NYU School of Law
State scores break down as follows:
| State(s) | Score |
|---|---|
| Connecticut, Oregon, Virginia, Washington | 6/7 |
| Minnesota | 5/7 |
| Texas, New York, Massachusetts (and 23 others) | 0/7 |
| Washington D.C. | 0/7 |
Florida and Tennessee have laws on the books but still fail the Policing Project’s “effective regulation” threshold. In Roseville, California, one analysis of Roseville PD records found that 71% of Flock Safety ALPR alerts on stolen and felony vehicles involved misread plates — a figure that illustrates precisely why the false-positive criterion exists.
Your Plate, Their Database
Retention limits are the linchpin: without them, ALPR databases quietly accumulate location histories that reveal far more than driving habits.
Those histories can map visits to:
- addiction clinics
- immigration attorneys
- political rallies
That’s mass location tracking dressed in traffic-safety clothing. Where no statute exists, internal agency policy — not your elected legislature — decides how long that data lives and who receives it. It’s the surveillance equivalent of terms and conditions nobody voted on. The parallel to data brokers and smartphone tracking isn’t incidental; it’s the same infrastructure logic applied to your commute.
Law enforcement’s counterargument deserves fair hearing: ALPRs recover stolen vehicles, help locate missing children, and track dangerous suspects. According to law enforcement advocates, speed genuinely matters in those cases. Privacy advocates counter, with equal force, that “helpful tool” and “permanent location database” aren’t mutually exclusive — states with partial laws already prove you can have both problems at once. Having a law, the scorecard makes clear, is not the same as having effective safeguards.
The scorecard is a roadmap. Legislators can draft from it. Advocates can cite it. You can look up your state at alprscorecard.com. New York’s Senate Bill S963 signals early movement in one of the 26 unregulated states. How ALPR regulation develops from here may well shape the framework for governing every AI-driven policing tool that follows.
