Agencies must limit automated license plate reader use

Agencies may use automated license plate reader systems only for listed law enforcement, parking, transportation, and traffic purposes. The rules cover state and local agencies and their automated systems, with exceptions for certain school bus, traffic, and toll cameras. Agencies may not use these systems for immigration enforcement, protected health care services, or constitutionally protected activity. Agencies may not collect data at or around protected health care facilities, immigration-related facilities, schools, places of worship, courts, or food banks. An agency must register a system, certify compliance, and maintain use policies and officer training before using it. A license plate reader match alone does not provide enough reason for an officer to stop a vehicle. The rules take effect immediately. Agencies continuing to use a system must register it within 180 days of the section's effective date.

Agencies must limit how they keep, use, share, buy, sell, and disclose automated license plate reader data. The rules cover automated license plate reader data held by agencies and audit records showing how systems are accessed or used. Data generally may not be kept longer than 21 days or used for another purpose. Court orders, parking cases, traffic studies, commercial vehicle enforcement, and specific criminal investigations have separate deletion deadlines or evidence exceptions. Agencies may not sell, lease, rent, or buy this data, and private data may be obtained only with a valid probable-cause warrant. Vendors must block unauthorized sharing and may not change sharing settings without the agency's knowledge or consent. The retention limits apply when authorized data is collected. Audit trail data must be kept for two years, and agencies must review system use and compliance at least once each year.

Agencies must publish policies and reports, keep access records, and face penalties for intentional misuse; injured people may sue. These duties apply to agencies using automated license plate readers, while the consumer-protection provision applies to people contracting with authorized government agencies. Agencies must maintain detailed access records for two years, conduct yearly internal audits, publish required policies, and report system use to the legislature. Knowing information obtained through a violation generally cannot be used in court, except with permission in a damages case. Intentional unauthorized access, use, retention, sale, sharing, or disclosure is a gross misdemeanor. A person injured by a violation may seek court orders, damages, costs, and reasonable attorney fees. The attorney general must publish model policies by July 1, 2027. Agencies must adopt policies and begin annual reporting by December 1, 2027, with later policy changes reported within 60 days.