Automated license plate recognition systems.

New Section 1798.90.52 requires ALPR operators to maintain access records that include the case file number justifying each search query. No queries are permitted without a valid and current case file number from the agency conducting the query.

Section 1798.90.55 is now amended to require public agencies to provide an opportunity for public comment at a regularly scheduled meeting before implementing an ALPR program, and to prohibit selling, sharing, or transferring ALPR information except to another public agency (with an exception for data hosting or towing services).

The definition of 'public agency' in Section 1798.90.5(g) now explicitly excludes a transportation agency when subject to Section 31490 of the Streets and Highways Code, narrowing who is covered by the bill's requirements.

Section 1798.90.55 now restricts law enforcement use of ALPR information solely to locating vehicles or persons when either are reasonably suspected of being involved in the commission of a public offense.

The definition of 'hot list' in Section 1798.90.5(e) is expanded to specify that authorized hot lists are limited to NCIC, Stolen Vehicle System, California DOJ lists, official alerts (AMBER, Silver, Feather, Blue, Yellow, Ebony, and future legislative additions), and custom BOLO lists for missing persons, witness locations, burglaries, grand theft, and violent crimes.

The retention limit in Section 1798.90.56 is changed from 30 days to 60 days for ALPR information that does not match an authorized hot list.

New Section 1798.90.57 requires that as of January 1, 2026, public agencies must delete all ALPR information held more than 60 days that does not match an authorized hot list within 14 days.

The Department of Justice audit requirement in Section 1798.90.54(c) is changed from 'annually audit any' public agency to 'conduct annual random audits on' a public agency, and now requires determining whether agencies have implemented AND are adhering to their usage and privacy policy, not just whether they implemented it.

Removed line-number markers (e.g., 'line 1', 'line 2') throughout the bill text, which are used during legislative drafting but stripped for the enrolled version.

Added formal passage records: 'Passed the Senate September 13, 2025' and 'Passed the Assembly September 13, 2025,' along with a Governor's receipt line and approval signature block.

Removed the coauthor credit for Assembly Member Lowenthal from the bill header, which is standard when a bill reaches enrolled status.

Corrected section cross-references in Section 10 (statewide concern finding) from 'Sections 3, 4, and 6 5, 7, 8, and 9' to 'Sections 3, 4, 5, 7, 8, and 9,' removing an erroneous reference to a non-existent Section 6 that was a leftover from earlier drafting.

The definition of 'public agency' now excludes not just transportation agencies but also public transit operators and local departments of transportation or public works departments, meaning these entities are no longer subject to the bill's ALPR restrictions.

A new definition of 'airport or airport operator' is added, covering cities, counties, airport authorities, joint powers authorities, special districts, and their contracted parking operators that own or operate a public-use airport.

The exclusions from 'ALPR end-user' and 'ALPR operator' definitions are expanded to include public transit operators (when subject to Vehicle Code Section 40240), local DOT/public works departments (when subject to specific Vehicle Code provisions), and airports/airport operators when using ALPR solely for parking access control, fee calculation, lost-ticket resolution, fraud prevention, or transaction dispute resolution.

Beginning January 1, 2026, all new, updated, expanded, or amended contractual agreements with ALPR vendors, manufacturers, or suppliers must mandate that no default access is provided to any national ALPR database and that an agency's collected scans are by default not accessible to any other agency. Agency-to-agency sharing between California state law enforcement agencies is permitted only as authorized by DOJ General Order 2023-05.

A new exception allows inter-agency task forces established by the Attorney General and overseen by the Bureau of Investigation to use the task force name and bureau commander name in lieu of a case file number when logging ALPR search queries.

The Department of Justice's obligation to conduct annual random audits of public agencies' ALPR usage and privacy policies is now made contingent upon an appropriation of sufficient funds in the annual Budget Act, meaning audits may not occur if funding is not allocated.

A new prohibition was added requiring public agencies to destroy ALPR information after 30 days, except when the data is being used as evidence or for felony investigations including auto theft, homicides, kidnapping, burglaries, elder and juvenile abductions, Amber Alerts, Blue Alerts, and Feather Alerts.

The Department of Justice audit requirement was changed from a general obligation to audit public agencies to an explicit annual audit cycle for any public agency that is an ALPR operator or end-user.

A standalone legislative intent section (former Section 1) that stated the Legislature's intent to impose privacy protection requirements on cities, counties, and entities using ALPR data was removed from the bill.

The fiscal committee designation changed from 'no' to 'yes' and the state-mandated local program designation changed from 'no' to 'yes,' meaning the bill now formally acknowledges it imposes costs on local agencies that are subject to state reimbursement under the Government Code.

The bill was renamed the 'Automated License Plate Recognition (ALPR) Data Accountability Act' and now specifically amends Civil Code sections 1798.90.51, 1798.90.53, and 1798.90.54, and adds new section 1798.90.56.

New section 1798.90.56 prohibits public agencies from: (1) contracting to share ALPR info with foreign jurisdictions for immigration enforcement, (2) sharing ALPR info with data brokers for immigration enforcement, (3) using ALPR to collect geolocation data at schools, libraries, health facilities, courthouses, labor enforcement facilities, and shelters for immigration enforcement, and (4) law enforcement agencies collecting or retaining ALPR info unless related to a criminal investigation or individual suspected of a crime.

A statewide concern finding declares that the bill applies to all cities, including charter cities, overriding local autonomy under Article XI of the California Constitution.

ALPR operators and end-users must now implement specific security safeguards including supervisory approval for data access, robust authentication protocols, tracking of employee searches, and mandatory data security and privacy training for all employees who access ALPR information.

Usage and privacy policies must now include: authorized purposes for use, the purpose for which each authorized employee or contractor accesses data, monitoring descriptions, sale/sharing restrictions, custodian title, accuracy measures, and retention/destruction processes.

Law enforcement agencies that are ALPR operators or end-users must establish a maximum data retention period for ALPR information.

A new private right of action allows individuals harmed by violations to sue for actual damages (minimum $2,500 liquidated damages), punitive damages for willful or reckless conduct, attorney's fees, and equitable relief.

The Department of Justice is now required to audit any public agency that is an ALPR operator or end-user to verify compliance with usage and privacy policy requirements.

'Foreign jurisdiction' is defined as any other state, the District of Columbia, U.S. territories or possessions, and foreign states, provinces, or countries.

Fiscal committee review changed from 'no' to 'yes' and state-mandated local program changed from 'no' to 'yes', with a new reimbursement provision if the Commission on State Mandates finds state-mandated costs.

Removed the prohibition on public agencies entering into or continuing contracts to share ALPR information with foreign jurisdictions or data brokers for immigration enforcement purposes (former Section 1798.90.56(a)(1) and (2)).

Removed the requirement that law enforcement agencies may only collect or retain ALPR information if it is related to a criminal investigation or an individual suspected of a crime (former Section 1798.90.56(a)(4)).

Added a new provision requiring public agencies to delete ALPR information that does not match a hot list within 30 days of collection, with no stated exceptions for criminal investigations or evidence use.

Removed the requirement in both Section 1798.90.51(c) and 1798.90.53(c) that law enforcement agencies establish a maximum data retention period for ALPR information.

Added Section 1798.90.5 to the Civil Code defining key terms including ALPR end-user, ALPR information, ALPR operator, ALPR system, hot list, person, and public agency, with specific exclusions for transportation agencies and persons subject to federal regulatory oversight.

The prohibition on public agencies using ALPR systems to gather geolocation data at public schools, public libraries, health facilities, courthouses, labor standards enforcement facilities, and shelters for immigration enforcement purposes was entirely removed from the bill.

Assembly Member Lowenthal was added as a coauthor of the bill.

The maximum retention period for ALPR information that does not match a hot list was increased from 30 days to 60 days after the date of collection.

The Department of Justice audit requirement was changed from annually auditing every public agency that is an ALPR operator or end-user to conducting annual random audits, reducing the scope of oversight.