A customer drives into a shopping center, parks, and leaves. Along the way, a camera captures the vehicle’s license plate. For the business, the system may serve a routine security or parking function. For plaintiffs’ lawyers, it may supply the foundation of the next privacy class action.

Litigation over automated license plate recognition (ALPR) is gaining momentum in California, where plaintiffs are challenging how businesses disclose and manage the plate data they collect. The developing cases matter to retailers, commercial property owners, parking operators, and hospitality businesses, including those headquartered elsewhere that operate California locations. The immediate task is to understand three things: what the technology does, who controls it, and what the law requires.

Why California Is Attracting Claims

California’s ALPR law, effective since January 1, 2016, reaches beyond police surveillance. Its definition of ALPR centers on a searchable database created when cameras and algorithms convert license plate images into computer-readable data. A conventional security camera does not necessarily satisfy that definition. But a system that recognizes plates and retrieves associated vehicle records may present a different analysis. See California Civil Code section 1798.90.5.

Covered operators must maintain reasonable security safeguards and implement a publicly available usage and privacy policy. If the operator has a website, the policy must be posted conspicuously there. The policy must address authorized uses, authorized personnel and training, security monitoring, sharing, responsibility for implementation, accuracy, and retention and destruction. End-users have related obligations, including periodic audit procedures. A generic website privacy notice warrants careful review against these requirements. See sections 1798.90.51 and 1798.90.53.

The law’s remedies help explain the litigation interest. Under Civil Code Section 1798.90.54, an individual harmed by a violation may sue a person who knowingly caused the harm. Available relief includes actual damages (with a $2,500 liquidated-damages floor), punitive damages for willful or reckless disregard of the law, attorneys’ fees, and equitable relief. Businesses should nonetheless scrutinize any proposed damages calculation, as the statute does not expressly provide that each plate scan generates a separate $2,500 award. See section 1798.90.54.

The Dispute Over What Counts as Harm

Two 2026 appellate decisions frame the central issue: what a plaintiff must show to plead harm. In Bartholomew v. Parking Concepts, Inc., 118 Cal. App. 5th 438 (2026), the plaintiff alleged that a garage collected his plate information without implementing and publishing the required policy. The Court of Appeal held that these allegations were enough to plead harm; collecting and storing the data without the policy infringed a statutory right to know how the information was being handled. A separate showing of data misuse or measurable financial loss was unnecessary on those allegations.

Bartholomew revived the statutory claim at the pleading stage; it did not establish liability or certify a class. The court also left open the issue of whether a policy missing particular required components would cause the same harm. That distinction matters when evaluating claims against businesses that already publish an ALPR policy.

In Mata v. Digital Recognition Network, Inc., 121 Cal. App. 5th 1075 (2026), the Court of Appeal affirmed summary judgment for an operator that had implemented and publicly provided a policy. The plaintiff’s subjective belief that collecting and storing his data invaded his privacy did not establish actual harm caused by a statutory violation. Although skeptical of Bartholomew’s right-to-know reasoning, the court distinguished that case rather than rejecting its holding.

Together, the decisions make the existence and implementation of a policy consequential. They also preserve a defense based on the absence of harm tied to the alleged violation. Actual harm need not be a readily calculable financial loss, but a plaintiff cannot simply assume that alleging noncompliance resolves the inquiry.

Federal litigation is developing as well. In McGinity v. Reimagined Parking LLC, No. 26-cv-02760-WHO (N.D. Cal. Aug. 5, 2026), the court denied dismissal of an ALPR claim involving a right-to-know theory. The decision illustrates why businesses should assess the particular allegations and procedural posture before treating a standing defense as dispositive. See the court docket and discussion of the decision.

Florida Requires a Different Analysis

Florida’s ALPR provisions address a different set of issues. Section 316.0777 governs law-enforcement installations within State Highway System rights-of-way and protects specified identifying information held by agencies from public disclosure. Section 316.0778 directs the establishment of a records-retention schedule. These provisions do not establish California’s private-business policy requirements or its $2,500 liquidated-damages remedy. See Florida Statutes sections 316.0777 and 316.0778.

Florida businesses should nevertheless examine the information associated with each plate record. A bare plate number and a record linked to a named customer, geolocation, payment information, or account credentials may raise different legal questions. The Florida Information Protection Act imposes security and breach-response duties for covered personal information but expressly provides no private cause of action. Whether the Act applies depends on the statutory definitions and the actual data involved. See section 501.171.

Representations about the system also deserve attention. If a business says plate data is used only for parking or security, counsel should verify whether vendor settings permit additional uses or sharing. Materially misleading statements may present issues under Florida’s prohibition on unfair or deceptive trade practices, although a private plaintiff must independently satisfy the applicable elements and remedy requirements. See section 501.204.

Other Jurisdictions Present Distinct Obligations

Tennessee offers a direct example of a state regulating private-sector plate readers. A commercial parking lot owner that uses an automatic plate reader to enforce parking requirements must first post clearly visible, readable signage stating, “LICENSE PLATE READER IN USE.” Signs must appear at each designated entrance, if one exists, and on each level of a multilevel lot. Tennessee separately limits how long government entities may retain captured plate data, generally to 90 days, with an exception for ongoing investigations. See Tennessee Code section 55-31-202 and section 55-10-302.

North Carolina requires law enforcement agencies to adopt policies covering matters such as access, training, security, and audits. It generally limits retention of data collected by or on behalf of law enforcement to 90 days, with specified preservation exceptions. Georgia regulates how law enforcement agencies collect and share plate data, generally requires destruction within 30 months subject to statutory exceptions, and criminalizes obtaining or using agency plate data for improper purposes. Businesses that participate in police camera networks should examine these provisions and their agreements with the agencies. See North Carolina General Statutes sections 20-183.30 through 20-183.32 and Georgia Code section 35-1-22.

Texas businesses should assess whether associated data processing falls within the Texas Data Privacy and Security Act, including its exemptions and rules for sensitive data. The Act assigns enforcement to the attorney general and provides no private right of action. See Tex. Bus. & Com. Code § 541.001 et seq. In Alabama, Mississippi, and the District of Columbia, a review should also address applicable security and breach-notification laws when ALPR records include covered personal information. A plate image does not automatically satisfy every jurisdiction’s definition. These are separate compliance questions, and California’s damages theory cannot simply be carried over to another state.

What Businesses Should Do Now

An effective review should connect the physical installation to the data practices behind it. Legal, security, property management, and procurement teams should work through the following steps:

1. Map the system and the parties. Identify camera locations, database functions, access rights, and the roles of the landlord, tenant, parking manager, and technology vendor. Determine whether each entity is an operator, an end-user, or neither under the applicable statute, including any exclusions.
2. Match disclosures to actual practices. For California locations, test the ALPR policy against each statutory requirement and confirm conspicuous publication. For other locations, check applicable signage and notice rules. Preserve dated versions and evidence of implementation.
3. Review vendor contracts and settings. Confirm permitted purposes, retention, deletion, downstream sharing, police access, security responsibilities, and incident reporting. Evaluate indemnity, insurance, and liability caps against the exposure being allocated. A vendor’s assurance of compliance should be supported by facts.
4. Reduce unnecessary access and retention. Limit users to those with a business need, remove obsolete credentials, examine sharing defaults, and verify that deletion settings work as represented, subject to legal preservation duties.
5. Prepare the factual defense. Preserve policies, training records, access logs, and relevant contracts when a claim is reasonably anticipated. Evaluate statutory coverage, the plaintiff’s actual interaction with the system, the claimed harm and causal connection, knowledge, and whether the proposed class shares the same material facts.

For retailers and property owners, ALPR litigation is a reminder that a security or parking camera is also a privacy issue. Businesses that can explain what their cameras collect, who can use the resulting records, and how those practices are disclosed will be better positioned to address both compliance questions and the next demand letter.