A defensible license plate reader policy states the authorized and prohibited uses, who may search and how searches are logged and audited, how long data is kept and then deleted, who it is shared with under written agreements, how hits are verified and how the public can review the program. Check your state law and have counsel review the policy before launch.
Why a written policy matters
An ALPR program that cannot explain itself will not last. Across the country, councils have paused or ended contracts after residents asked who can search the data, how long it is kept and who it is shared with. Several states have now written limits into law, and courts are hearing challenges to warrantless use. A clear, published policy is the best protection for the community and for the agency.
Good policy also makes the cameras more useful. When officers know what they may do with a hit, they act with confidence, and prosecutors can rely on the evidence.
What a defensible license plate reader policy contains
The Bureau of Justice Assistance publishes a license plate reader policy template for justice agencies, which is a useful starting point. At a minimum, a defensible policy covers:
| Section | What it should say |
|---|---|
| Purpose and authorized uses | The specific, lawful purposes for which ALPR may be used, such as stolen vehicles, wanted persons and missing persons. |
| Prohibited uses | What the system may not be used for, for example monitoring lawful protest or enforcing outside the agency’s authority. |
| Access and authentication | Who can search, how they sign in (including multi-factor authentication) and how access is removed. |
| Search justification and audit | Whether each search requires a stated reason, who reviews the logs and how often. |
| Retention and purge | How long reads and video are kept, what is kept longer as evidence, and how deletion is verified. |
| Sharing | Which agencies can see your data, under what written agreements, and what is never shared. |
| Hit verification | Visual confirmation of the plate and the record before any stop or arrest. |
| Data security | Encryption, access controls and incident response, including CJIS requirements where they apply. |
| Training | Required training before access, with periodic refreshers. |
| Transparency and review | What you publish (camera locations, counts, usage) and when the program is reviewed. |
| Complaints and corrections | How the public can raise a concern and how errors are fixed. |
Choosing a retention period
There is no single right retention period, but there is a right way to choose one: keep data only as long as it is needed for the purposes in your policy, and not longer. Many agencies set a short default, with a documented process for preserving reads that become part of an investigation. A state may require a specific limit; Connecticut’s is 21 days. One major vendor states a default of 7 days after reducing it from 30.
Whatever you choose, make sure the system enforces it automatically, that purges are logged and that evidence exported for a case is tracked separately.
The legal landscape
The legal landscape is moving quickly and differs by state. According to coverage in 2026, Connecticut limits ALPR data retention to 21 days unless needed for a legitimate law-enforcement purpose; New Mexico prohibits sharing ALPR data for immigration enforcement or for reproductive-health-care investigations; Illinois regulates use and sharing under its Vehicle Code; and other states, including Washington, have been considering shorter retention and tighter sharing rules. Federal litigation is also testing warrantless ALPR use.
Two practical conclusions follow. First, check your own state’s statutes and your city’s ordinances, and have counsel review your policy before launch. Second, choose a vendor whose system lets the agency set retention and sharing rules and whose logs prove the rules are followed.
This page is general information. Statutes, ordinances and court rulings change, and they differ by jurisdiction. Always confirm current requirements with your agency’s counsel.
Questions to ask your vendor
Take this checklist to every vendor demo, including ours:
- Can the agency set and change retention, and is deletion automatic and logged?
- Is data sharing off by default and controlled by the agency?
- Are all searches logged with a reason and a user, and can the agency export the logs?
- Is multi-factor authentication required?
- Who owns the data, and can you export it if you leave?
- Is there a public-facing transparency option?
- What independent security certifications or audits can the vendor show?
We will walk through how each item is handled in the Intelvi AI platform on a walkthrough.
Frequently asked questions
What is a license plate reader policy?
A written policy that says how an agency may use license plate readers: authorized and prohibited uses, who can search, how searches are logged and audited, how long data is kept, who it is shared with and how the public can review the program.
Are police license plate readers legal?
Use by law enforcement is common and generally legal, but states and cities set their own rules on retention, sharing and permitted uses, and some have tightened them recently. Check your state law and have counsel review your policy.
How long should ALPR data be retained?
Only as long as needed for the purposes in your policy. Some states set limits (Connecticut: 21 days). Many agencies choose a short default and a documented process to preserve reads tied to an investigation.
Should ALPR data be shared with other agencies?
Only under written agreements and within your state’s rules. Decide in advance who can see your data and make sharing an agency decision, not a default.
What should be in an ALPR audit?
A record of who searched, when, for what reason and with what result, reviewed on a schedule by someone outside the searching unit.
Is there a template I can start from?
Yes. The Bureau of Justice Assistance publishes a License Plate Reader Policy Development Template that many agencies adapt.
How do we build public trust?
Adopt the policy before launch, hold a public meeting, publish camera locations and usage numbers, and review the program on a set schedule.