State Regulation Comparison
A sortable comparison of how ten jurisdictions govern ALPR retention, sharing, warrant requirements, and auditing.
Federal law contains no comprehensive ALPR statute. The result is a location-privacy regime determined by where a camera sits, where a querying officer works, what the vendor enables by default, and whether anyone audits the logs. Networked systems exploit that fragmentation: an officer in a permissive state can query cameras in a restrictive one.
This page surveys the most consequential state-level frameworks. It is a statutory survey, not legal advice.
The campaign minimum is stronger than this patchwork: ban warrantless law-enforcement ALPR use and cross-jurisdictional sharing. Any narrow exception should require individualized judicial authorization, strict purpose limits, rapid deletion, auditability, and an enforceable remedy.
Retention and sharing comparison
| Jurisdiction | Statute | Retention | Sharing restriction | Warrant (historical) | Key feature |
|---|---|---|---|---|---|
| California | Cal. Civ. Code § 1798.90.5 et seq. | Varies by policy | No sharing with federal or out-of-state agencies | Not expressly required | Strongest comprehensive regime: security policy, access logs, purpose limits, sharing ban |
| Washington | SB 6002 (2026) | Defined by regulation | Banned for immigration, reproductive-health, protest surveillance | Warrant required for private-entity data | First comprehensive WA framework; prohibits sensitive-location collection; bans data buying |
| Maine | Me. Stat. tit. 29-A § 2112 | 21 days (non-hit) | Restricted | Not expressly required | Short statutory purge; among the strictest retention limits |
| New Hampshire | N.H. Rev. Stat. § 261:75-b | 3 minutes (non-hit) | Restricted | Not expressly required | Among the shortest non-hit purge rules in the country |
| North Carolina | N.C. Gen. Stat. §§ 20-183.30–20-183.33 | 90 days (default) | Policy-required | Not expressly required | Combines policy, training, audits, effectiveness reports, and a 90-day default |
| Tennessee | Tenn. Code § 10-7-508 | Varies | Limited | Not expressly required | Classifies ALPR data as confidential; requires written usage policy |
| Arkansas | Ark. Code § 12-12-1801 et seq. | 150 days | Limited | Not expressly required | Requires registration and annual reports; defined retention window |
| Utah | Utah Code § 77-23a-15 | 9 months | Limited | Not expressly required | Requires search-warrant for content of stored ALPR data in certain contexts |
| Vermont | Vt. Stat. Ann. tit. 24 § 1201 | Varies | Restricted | Not expressly required | Data owner must be notified; requires written policy and annual audit |
| Federal | No comprehensive statute | No federal limit | No federal restriction | No federal requirement | No omnibus federal ALPR law; governed by state patchwork and constitutional doctrine |
The network gap
Three developments in 2025-2026 show how the state patchwork breaks down under networked access:
- California v. El Cajon (2025). The California AG sued a city for sharing ALPR data with agencies in 24+ states. The city's defense was essentially that the Flock platform made sharing the default. California law prohibits sharing with federal or out-of-state agencies, but the vendor's nationwide lookup feature was enabled on the city's account.
- Mountain View suspension (2026). The police chief shut down all Flock cameras after discovering the first camera had been configured for nationwide sharing by Flock without the city's knowledge. Hundreds of out-of-state and federal agencies had accessed local data. The chief wrote: "I no longer have confidence in the Flock system."
- Washington SB 6002 (2026). Washington became the first state to pass a comprehensive ALPR framework specifically targeting the governance gaps: warrant requirements for private-entity data, bans on immigration/reproductive/protest use, and restrictions on data purchasing.
The lesson is structural: a state statute regulates what a state agency may do with data, but it cannot regulate what an out-of-state officer does with data shared through a national network. The patchwork creates an enforcement gap that only network-level governance can close.
Key statutory features
- Retention limits range from 3 minutes (New Hampshire non-hit) to 9 months (Utah), with several states having no statutory limit at all.
- Sharing restrictions are strongest in California (statutory ban on federal/out-of-state sharing) and Washington (SB 6002's multi-dimensional framework). Most states have no explicit sharing restriction.
- Warrant requirements for historical searches are absent from most state statutes. Only Washington's SB 6002 expressly requires a warrant for private-entity ALPR data.
- Audit mandates are rare. North Carolina combines audits with effectiveness reports. Most states leave auditing to voluntary agency policy.
Download the regulation comparison CSV - Read the legal analysis