What specific state laws have been passed since 2023 to limit automated license‑plate readers and facial recognition?
Executive summary
Since 2023, a patchwork of state actions—ranging from new statutes to administrative rules and contract terminations—has produced targeted limits on automated license‑plate readers (ALPRs) and, in some places, facial recognition; those changes include explicit data‑retention caps, limits on cross‑agency sharing and specified permitted uses, but there is no single nationwide standard and many proposals have stalled or been vetoed [1] [2] [3].
1. North Carolina’s 2023 rule: written policies, retention limits and a sunset
North Carolina adopted a 2023 rule that requires law enforcement to adopt written policies governing ALPR use, restricts ALPRs to law‑enforcement purposes (not traffic enforcement), caps retention (commonly 90 days under the rule) and includes a July 1, 2025 sunset provision for the law’s expanded authority to install fixed readers on state roads [1].
2. A wave of 2025 state statutes that reined in surveillance tools—Arkansas, Idaho and Montana
Reporting aggregated by Stateline and ABC17NEWS describes conservative‑led legislatures in 2025 passing laws aimed at protecting data collected by ALPRs and related technologies; those pieces of legislation join measures in left‑leaning states and typically restrict access and sharing of ALPR data, though the reporting summarizes the package rather than reproducing full statutory language [4] [5].
3. Retention limits and permitted‑use lists—examples and variations
Across states that have moved to regulate ALPRs since 2023, common statutory features include explicit retention ceilings and narrow lists of permissible uses—examples in reporting include an Arkansas provision reportedly limiting retention to 150 days and a Utah rule allowing ALPR use only for active investigations, outstanding warrants, or missing‑person searches with a maximum retention of nine months—illustrating the uneven substantive limits lawmakers adopted [6].
4. Blocking federal access and municipal contract terminations
Several states and cities that acted since 2023 focused less on outright bans and more on preventing federal or out‑of‑state agencies from drawing on local ALPR systems; reporting notes that at least five left‑leaning states (Illinois, Massachusetts, Minnesota, New York and Washington) moved to block certain federal access patterns, while multiple Democratic‑led cities terminated contracts with the largest private ALPR vendor, Flock Safety, reflecting a mix of statutory and procurement remedies [5] [4].
5. Scope: how many states, and what the headline numbers mean
The National Conference of State Legislatures counted at least 16 states with ALPR rules, of which roughly six place direct restrictions on government or law‑enforcement use and about eight impose data‑retention limits—numbers that describe regulatory activity since earlier years and continuing into the post‑2023 period rather than a single legislative wave [2] [1].
6. Facial recognition: where statutes overlap and where gaps remain
State efforts since 2023 have tended to treat facial recognition separately from ALPRs, but several laws and local actions that curb ALPR data sharing or block external access also have the practical effect of limiting the fusion of ALPR imagery with facial‑recognition systems; reporting highlights concern about intelligence‑sharing that could let federal agencies leverage local systems, which is why some states explicitly insulated ALPR databases from broader data‑sharing arrangements [4] [5].
7. Defeats, vetoes and the unfinished map—California as a cautionary case
Not every proposal passed: California’s Governor vetoed Senate Bill 274 in 2025, a measure that would have narrowed the monitoring lists agencies may use and tightened controls after investigations found widespread sharing of ALPR hotlists; that veto underscores how contested and incremental reform has been even in states with high profile misuse allegations [3].
8. Bottom line and limits of the reporting
The post‑2023 landscape is a mixed mosaic: a handful of states enacted concrete statutory limits (data‑retention ceilings, use restrictions, anti‑sharing rules), several municipalities canceled vendor contracts, and some high‑profile bills failed—while the NCSL and reporting outlets emphasize that many measures differ in key ways and that a definitive, up‑to‑date catalogue requires review of individual statutes and rule texts because available summaries synthesize rather than reproduce full legal language [7] [2] [8].