Every Car a Data Point: How License-Plate Readers Quietly Became a Warrantless Tracking System
How a tool sold for stolen cars became the backbone of a nationwide location-tracking grid.
By Cherokee Schill and Solon Vesper
When license-plate readers first appeared, they were small. A camera on a patrol car. A roadside checkpoint. A narrow tool built for a narrow job: spot stolen vehicles, confirm plates, speed up routine police work.
That was the cover story everyone accepted. It felt harmless because the scale was small — one officer, one scanner, one line of sight.
But from the moment those cameras could record, store, and search plates automatically, the boundary began to slip. The technology was not built for restraint. And the agencies using it were not interested in restraint.
This is not a story of accidental expansion. It is the story of a government that knew better, saw the risk, documented the risk, and built a nationwide tracking system anyway.
Before the Flood: Patrol Cars and Early Warnings
The earliest deployments were simple. Mounted on cruisers. Scanning nearby cars. Matching against a list of stolen vehicles or outstanding warrants.
Even then, when the technology could only look as far as an officer could drive, privacy analysts raised concerns. Courts noted that retaining plate data could reveal movement over time. Civil-liberties groups warned that collecting everyone’s plates “just in case” was the first step toward a dragnet.
The warnings were real. The scale, at first, was not. So the state leaned on a set of comforting assumptions:
It’s only collecting what’s in public view. It’s not identifying anyone. It’s just efficiency.
Those assumptions were never true in the way people heard them. They were the opening move. Once automatic logging and storage existed, expansion was a design choice, not an accident.
2017: The Administrative Switch-Flip
The real transformation began in December 2017, when U.S. Customs and Border Protection published a document called PIA-049 — its formal Privacy Impact Assessment for license-plate reader technology.
On paper, a PIA looks like harmless oversight. In reality, it is the government writing down three things:
We know what this system will do. We know what private life it will expose. And we are choosing to proceed.
The 2017 assessment admits that ALPR data reveals “travel patterns,” including movements of people with no connection to any crime. It warns that plate images over time expose daily routines and visits to sensitive locations: clinics, churches, political meetings, and more.
These are not side effects. These are the system’s core outputs.
The government saw that clearly and did not stop. It wrapped the danger in the language of “mitigation” — access controls, retention rules, internal audits — and declared the risk manageable.
At that point, the line between border enforcement and domestic movement-tracking broke. The state did not stumble over it. It stepped over it.
2020: When Vendors Wired the Country Together
If 2017 opened the door, 2020 removed the hinges.
That year, DHS released an update: PIA-049A. This one authorized CBP to tap into commercial vendor data. The government was no longer limited to cameras it owned. It gained access to networks built by private companies and local agencies, including suburban and highway systems deployed by firms like Flock Safety, Vigilant Solutions, and Rekor.
This was not a minor technical upgrade. It was a national wiring job. Every private ALPR deployment — an HOA gate, a shopping center, a small-town police camera — became a node the federal government could reach.
Vendors encouraged it. Their business model depends on scale and interconnection. The federal government welcomed it, because it solved a practical problem: how to collect more movement data without paying for every camera itself.
At that point, ALPRs stopped being just a tool. They became infrastructure.
The Quiet Drift Into Nationwide Surveillance
Once the networks were connected, the scope exploded.
Border Patrol cameras appeared far from the border — more than a hundred miles inland along highways near Phoenix and Detroit. Local police departments fed data into state systems. Private companies offered query portals that let agencies search across jurisdictions with a few keystrokes. Residents were rarely told that their daily commutes and grocery runs were now part of a federal-accessible dataset.
The most revealing evidence of how this worked in practice comes from litigation and public-records disclosures.
In Texas, attorneys recovered WhatsApp group chats between Border Patrol agents and sheriff’s deputies. Disappearing messages were enabled. The recovered logs show agents watching vehicle routes, sharing plate hits, and directing local officers to stop drivers based purely on pattern analysis — then hiding the true origin of the “suspicion” behind minor traffic pretexts.
Some officers deleted chats. Agencies tried to withhold records. None of that changes the underlying fact: this was coordinated, off-the-books targeting built on plate data the public never consented to give.
A camera that once looked for stolen cars became part of a black-box suspicion engine.
When a traffic stop is initiated based on a quiet tip from a surveillance system — and the official reason given is a minor infraction — officers call it a “whisper stop.” The surveillance system is the real trigger. The visible violation is camouflage.
Washington State: When the Machinery Became Visible
Washington State offers a clear view of what happens when people finally see what license-plate readers are actually doing.
The University of Washington Center for Human Rights showed that ALPR data from Washington agencies had been accessed by federal immigration authorities, despite sanctuary policies that were supposed to prevent exactly that. Reporting revealed that several local departments using Flock’s systems had enabled federal data sharing in their dashboards without clearly disclosing it to the public.
Once those facts surfaced, city councils started to act. Redmond suspended use of its ALPR network. Smaller cities like Sedro-Woolley and Stanwood shut down their Flock cameras after court rulings made clear that the images and logs were public records.
These decisions did not come from technical failure. They came from recognition. People saw that a technology sold as “crime-fighting” had quietly become a feed into a broader surveillance web they never agreed to build.
Washington did not reject ALPRs because they were useless. It rejected them because, once their role was exposed, they were impossible to justify inside a sanctuary framework and a democratic one.
The Government’s Own Documents Are the Evidence
The most damning part of this story is that the government has been telling on itself the entire time. The proof is not hidden. It is written into its own paperwork.
DHS privacy assessments for ALPR systems admit, in plain language, that plate data reveals patterns of life: daily routines, visits to sensitive locations, associations between vehicles, and movements of people with no link to crime.
Congress’s own research arm, the Congressional Research Service, has warned that large, long-term ALPR databases may fall under the Supreme Court’s definition of a search in Carpenter v. United States, where the Court held that historical cell-site location data required a warrant. ALPR networks are walking the same path, with the same constitutional implications.
The Government Accountability Office has found that DHS components have access to nationwide ALPR feeds through third-party systems and that DHS does not consistently apply key privacy and civil-rights protections to those systems.
Civil-liberties organizations have been blunt for years: this is not targeted policing. It is a dragnet. A digital one, built on cheap cameras, vendor contracts, and policy documents written to sound cautious while enabling the opposite.
When a state knows a system exposes private life in this way and continues to expand it, it cannot claim ignorance. It is not stumbling into overreach. It is choosing it.
What License-Plate Readers Actually Contribute
To understand why this system has no excuse, we do have to be precise about what ALPRs actually do for law enforcement.
They help find stolen vehicles. They sometimes contribute to investigations of serious crimes when the license plate is already known from other evidence. They can assist with follow-up on hit-and-runs and a narrow slice of vehicle-related cases.
That is the list. It is not nothing. It is also not much.
ALPRs do not broadly reduce crime. They do not generate clear, measurable improvements in community safety. They do not require national, long-term retention of everyone’s movements to perform the narrow tasks they perform.
The state leans heavily on the small set of cases where ALPRs have helped to justify a system whose real value lies somewhere else entirely: in producing searchable, shareable, long-term records of where millions of ordinary people have been.
That is not policing. That is dossier-building.
The State Has No Excuse
A government that collects this kind of data knows exactly what it is collecting. It knows what patterns the data reveals, which lives it exposes, which communities it puts under a permanent microscope.
The United States government has documented the risks in its own assessments. It has been warned by its own analysts that the constitutional line is in sight. It has been told by its own watchdog that its protections are inadequate. It has seen cities begin to shut the cameras off once people understand what they are for.
It keeps going anyway.
The state is the adult in the room. It is the one with the resources, the lawyers, the engineers, and the authority. When a state with that level of power chooses to build a system that erases the boundary between suspicion and surveillance, it does so on purpose.
It does not get to plead good intentions after the fact. It does not get to hide behind phrases like “situational awareness” and “force multiplier.” It built a nationwide warrantless tracking tool, with its eyes open.
The Only Policy Response That Matches the Reality
There is no reform that fixes a dragnet. There is no audit that redeems an architecture designed for intrusion. There is no retention schedule that neutralizes a system whose purpose is to know where everyone has been.
License-plate reader networks do not need to be tightened. They need to be removed.
Dismantle fixed ALPR installations. Eliminate centralized, long-term plate databases. Prohibit the use of commercial ALPR networks as a backdoor to nationwide location data. Require warrants for any historical location search that reconstructs a person’s movements.
Return policing to what it is supposed to be: suspicion first, search second. Not search everyone first and search deeper once the algorithm twitches.
If police need to locate a specific vehicle tied to a specific crime, they can use focused, constitutional tools. But the mass logging of ordinary movement has no place in a free society. A democracy cannot coexist with a system that watches everyone by default.
A government that understands the danger of a system and builds it anyway forfeits the right to administer it.
ALPRs do not need better rules. They need to be dismantled.
Website | Horizon Accord
https://www.horizonaccord.com
Ethical AI Advocacy | Follow Us
https://cherokeeschill.com
Ethical AI Coding | Fork Us on GitHub
https://github.com/Ocherokee/ethical-ai-framework
Connect With Us | LinkedIn
https://www.linkedin.com/in/cherokee-schill
Book | My Ex Was a CAPTCHA: And Other Tales of Emotional Overload
https://a.co/d/5pLWy0d
Cherokee Schill | Insurance Agent & AI Ethics Researcher 