State Legislatures Move to Restrict AI-Driven License Plate Readers and Surveillance Drones

Automatic license plate readers and AI‑powered cameras have become commonplace in communities from Portland to Texas, feeding real‑time vehicle data to thousands of law‑enforcement agencies. Companies like Flock Safety, Axon and Motorola supply systems that can not only read plates but also identify faces, detect bumper stickers and flag unusual travel patterns. Civil‑rights groups warn that the technology builds detailed movement profiles without drivers' knowledge.

State legislatures are now stepping in. Illinois’ Biometric Information Privacy Act (BIPA) remains the most expansive privacy law, requiring written consent before any biometric data—including facial recognition—can be used. The statute has already blocked features such as Google Nest’s Familiar Faces and certain Flock recognition tools within the state. Oregon’s Portland has enacted similar limits on facial‑recognition capabilities.

California has taken a different tack, expanding its definition of "personal information" to include ALPR data. This move subjects license‑plate reads to the same strict handling and consent rules that govern biometric identifiers, offering broader protection for drivers' identities.

Other states are focusing on what cameras can see. Florida and New Hampshire have passed laws that restrict ALPRs to capturing only license plates, prohibiting the collection of interior details or vehicle descriptors. In New Hampshire, any data not actively used in an investigation must be erased within three minutes, a timeline far stricter than the 21‑day limits adopted by Washington and Virginia.

Several states are also tying ALPR use to specific police activities. The legislation limits deployment to serious crimes such as homicide or kidnapping and requires senior officials—often the police chief—to approve each search. These safeguards aim to prevent routine tracking of ordinary citizens and keep private companies from contracting directly with municipalities.

Data‑retention rules are another focal point. New Hampshire’s rapid‑deletion requirement, Washington’s 21‑day cap, and Virginia’s similar limits are designed to stop law‑enforcement agencies from amassing long‑term dossiers on motorists. Minnesota has gone further by mandating that ALPR searches be made public, giving citizens a window into how their data is being used.

Sharing data across state lines is now illegal in places like Illinois and Virginia, where statutes expressly forbid transmitting ALPR information to federal agencies such as ICE or the Department of Homeland Security without a warrant. While enforcement remains a challenge, the prohibitions represent a clear legislative intent to keep local data within state jurisdiction.

Approval processes for installing ALPR systems vary widely. Texas issues licenses that are relatively easy to obtain, whereas Vermont has crafted a multi‑step approval framework that, by 2025, resulted in no law‑enforcement agency in the state using ALPR cameras at all. The contrast highlights how state policy can either enable or stifle surveillance technology.

Drone surveillance is receiving its own set of rules. Alaska, Idaho, Utah and Texas now require law‑enforcement agencies to obtain a warrant before deploying drones equipped with AI cameras. The requirement is meant to curb automated tracking of individuals in public spaces, though exemptions and loopholes have already emerged in some jurisdictions.

Advocacy groups, including the American Civil Liberties Union, continue to push for stronger collective‑action measures, warning that piecemeal reforms may not fully address the privacy threats posed by AI‑driven surveillance. As states fine‑tune their statutes, the balance between public safety and individual privacy remains a contested frontier.