License Plate Readers on Your Property? You May Already Be a Target for California Class Action Litigation

Alert

The Bottom Line for Property Owners and Operators

If your company owns, manages, or operates commercial property in California where automatic license plate reader (“ALPR”) cameras are installed—you face potentially significant class action exposure. A wave of class action lawsuits filed in 2026 targets property owners and managers for failing to comply with California’s ALPR Privacy Act[1] (the “ALPR Law”). For high-traffic retail properties, the aggregate potential exposure can reach into the hundreds of millions of dollars.

This article explains the current litigation landscape, who is at risk, and what companies can do now to reduce their exposure.

How Big Is the Problem?

Since early 2026, California courts have seen a significant surge in class action filings targeting private entities that operate or use ALPR systems without complying with the ALPR Law’s disclosure and policy requirements. In a single week in late June 2026, Orange County alone saw five privacy class actions filed, most involving ALPR cameras, representing a 733% spike above the weekly average.[2] Alameda County saw 20 privacy cases in April 2026—triple the monthly average—and another 10 in a single week in early June, a 465% surge.[3] San Mateo County recorded eight class actions in a single week in late May 2026, quadruple its weekly average.[4]

Given the widespread deployment of ALPRs—reportedly operating at over 80,000 locations across 49 states and scanning approximately 20 billion vehicle records per month—the volume of potential targets in California is substantial.[5]

Inside the Complaints: What Plaintiffs Are Claiming

The complaints in these actions assert a broad array of causes of action. At their core, the claims allege that defendants deployed ALPR cameras at their commercial properties without implementing or publicly posting a usage and privacy policy that meets the minimum requirements of the ALPR Law.

Typical causes of action include:

1. Violation of the ALPR Privacy Act—Unauthorized Access and Use[6]: Alleging that operation of ALPR systems without a compliant policy constitutes unauthorized access to and use of ALPR information.
2. Violation of the ALPR Privacy Act—Failure to Implement Privacy Policy and Maintain Records[7]: Alleging a complete failure to adopt, implement, and publicly post the required seven-element ALPR privacy policy.
3. Invasion of Privacy Under the California Constitution[8]: Claiming that covert mass vehicle surveillance violates the state constitutional right to privacy.
4. Intrusion Upon Seclusion: Claiming the surreptitious, large-scale collection and aggregation of vehicle location data is highly offensive to a reasonable person.
5. Violations of California’s Unfair Competition Law (“UCL”)[9]: Incorporating the ALPR Law violations as unlawful predicates and asserting unfair and deceptive practices.
6. Common Law Invasion of Privacy and Unjust Enrichment: Alleging that defendants profited from participation in national surveillance networks by exchanging their customers’ vehicle tracking data for access to the broader database.
7. Negligence and Negligence Per Se: Alleging a breach of the duty of care arising from the ALPR Law’s mandatory standards.
8. California Consumer Privacy Act / California Privacy Rights Act (“CPRA”)[10]: At least one complaint alleges that ALPR-collected vehicle tracking data constitutes “personal information” under the CPRA and that defendants failed to provide required notices.

Plaintiffs allege that statutory damages under the ALPR Law are not less than $2,500 per person harmed, with the potential for punitive damages on a showing of willful or reckless conduct.[11]

The Bartholomew Decision: Why These Cases Are Easier to Bring Than You Might Think

The single most important legal development fueling this litigation wave is Bartholomew v. Parking Concepts, Inc.[12] In that case, a private entity deployed ALPR cameras at a parking garage without implementing or publicly posting any ALPR usage and privacy policy. The trial court sustained a demurrer, finding no cognizable harm. The Court of Appeal unanimously reversed, holding that “harm” under the ALPR Law does not require “any type of affirmative mishandling of the data.” Instead, the court held that “[c]ollecting and maintaining individuals’ ALPR information without implementing and making public the statutorily required policy harms these individuals by violating this right to know.”

The court further reasoned that the Legislature’s provision of $2,500 in liquidated damages “demonstrates a legislative intent that cognizable harm does not require a measurable monetary injury.”[13] The California Supreme Court has denied review, making Bartholomew controlling authority throughout the state.[14]

For businesses, the practical significance is stark: plaintiffs do not need to prove that anyone actually looked at their license plate data, shared it improperly, or caused any tangible harm. The mere absence of a compliant, publicly posted policy is enough. This dramatically lowers the barrier to filing and maintaining these class actions and makes early dismissal on the pleadings far more difficult for defendants.

Who Is on the Hook?

The ALPR Law imposes obligations on two categories of entities:

• ALPR Operators: Defined as “a person that operates an ALPR system,” meaning a “searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.”[15]
• ALPR End-Users: Defined as “a person that accesses or uses an ALPR system.”[16]

Beyond California: Are Other States Next?

While California’s ALPR Law is the most mature statutory framework with active private enforcement, companies operating ALPR systems should be aware that other states have enacted or are considering legislation governing ALPR use. Several states regulate ALPR data in various ways, including through restrictions on data retention, access, and sharing by law enforcement and private entities. States with ALPR-specific statutes or significant regulatory frameworks include, among others, Arkansas[17], Colorado[18], Maine[19], Minnesota[20], Tennessee[21], Utah[22], and Vermont[23]. Many of these laws focus primarily on law enforcement use rather than private-sector operations and may not include the same robust private right of action found in the California statute. Companies operating across multiple states should evaluate their exposure in each jurisdiction.

Reducing Your Risk: Practical Steps for Compliance

Given the active litigation environment and the relatively low bar for establishing harm under Bartholomew, companies that deploy or host ALPR systems at California properties should promptly evaluate their compliance posture. At a high level, the following steps merit consideration:

1. Determine whether ALPR systems are present on your properties. This includes not only systems the company installed directly but also those installed by tenants, vendors, management companies or security contractors.
2. Consider whether collection of this data is necessary. In some instances the company may not be using the data or even aware that there is access to the data. Companies should evaluate the risk of litigation when deciding whether to use these devices.
3. Implement and publicly post a compliant ALPR usage and privacy policy. The ALPR Law requires that the policy include, at minimum, seven specific elements: (A) authorized purposes for ALPR data use; (B) job titles and training requirements of authorized personnel; (C) monitoring and audit procedures; (D) restrictions on data sharing; (E) an identified custodian of ALPR data; (F) accuracy measures; and (G) a data retention schedule and destruction process.[24]
4. Post the policy conspicuously on the company’s website and, where applicable, on property-specific websites. Consider other locations to ensure conspicuous notice.
5. Maintain access audit records. ALPR operators must log each instance of system access, including the date and time, data queried, identity of the querying party, and purpose.[25]
6. Restrict data use to authorized purposes described in the posted policy and ensure vendors cannot unilaterally re-enable data-sharing features without authorization.

[1]  Cal. Civ. Code §§ 1798.90.5, et seq.

[2]  Law.com Radar, Litigation Surge – Privacy | Class Actions | CA-Orange County (July 1, 2026).

[3]  Law.com Radar, Litigation Surge – Privacy | CA-Alameda County (May 13, 2026); Law.com Radar, Litigation Surge – Privacy | California Superior Court, Alameda County (June 10, 2026).

[4]  Law.com Radar, Litigation Surge – Class Actions | CA-San Mateo County (June 3, 2026).

[5] Police cameras track billions of license plates per month, NBC News, https://www.nbcnews.com/tech/tech-news/flock-police-cameras-scan-billions-month-sparking-protests-rcna230037 (last accessed August 17, 2026).

[6] Cal. Civ. Code §§ 1798.90.5, et seq.

[7] Cal. Civ. Code §§ 1798.90.51(b), 1798.90.52, 1798.90.53(b).

[8] Cal. Const. Art. I, § 1.

[9] Cal. Bus. & Prof. Code §§ 17200, et seq.

[10] Cal. Civ. Code §§ 1798.100, et seq.

[11] Cal. Civ. Code § 1798.90.54(b).

[12] Bartholomew v. Parking Concepts, Inc., 118 Cal. App. 5th 438, 341 Cal. Rptr. 3d 554 (2026), as modified on denial of reh’g (Feb. 27, 2026), review denied (May 13, 2026).

[13] Id. at 447.

[14] Id.

[15] Cal. Civ. Code § 1798.90.5(a).

[16] Cal. Civ. Code § 1798.90.5(c).

[17] Digital Recognition Network, Inc. v. Beebe/Hutchinson, 803 F.3d 952 (8th Cir. 2015) (First Amendment challenge to Arkansas's Automatic License Plate Reader System Act; Eighth Circuit upheld statute restricting private-sector ALPR data collection and use).

[18] Freeman v. Redfearn, Boulder County Dist. Ct. No. 2026CV30465 (2026) (putative class action alleging municipality deployed Flock ALPR cameras without required notice or consent under state privacy law).

[19] Loder v. Maine Intelligence Analysis Center, D. Me. No. 2:20-cv-00157 (civil claims challenging state intelligence center's retention and dissemination of ALPR data)

[20] State v. Lelyukh, No. A21-0699 (Minn. Ct. App. Dec. 13, 2021) (criminal suppression motion challenging warrantless use of ALPR data to track defendant's vehicle movements).

[21] Herrin v. Lewis County, Tennessee, W.D. Tenn. No. 1:25-cv-01073 (2025) (civil action arising from Flock ALPR camera alert and subsequent law enforcement contact).

[22] Digital Recognition Network v. Herbert, D. Utah No. 2:14-cv-00099 (analogous First Amendment challenge to Utah's Automatic License Plate Reader System Act restricting private ALPR data retention and use).

[23] Grout v. Wells Fargo Bank, N.A., D. Vt. No. 2:26-cv-00220 (2026) (private civil action alleging financial institution used LPR technology to scan and catalog vehicles and residents without authorization).

[24] Cal. Civ. Code §§ 1798.90.51(b)(2)(A)–(G); 1798.90.53(b)(2)(A)–(G).

[25] Cal. Civ. Code § 1798.90.52(a).