Concerning driver privacy protections.

The definition of 'Automated license plate reader system' was expanded to explicitly exclude specific types of authorized traffic safety and photo toll cameras.

The list of authorized uses for ALPR systems was reorganized and slightly modified, removing a specific clause about using the system as a component of photo toll systems.

The exception allowing ALPR data to be retained indefinitely for toll collection was removed, aligning all data retention with stricter time limits.

New restrictions were added prohibiting ALPR vendors from selling or leasing data to unauthorized agencies and requiring vendors to default system settings to prevent unauthorized sharing.

The recordkeeping requirements for ALPR operators were updated to include tracking policy changes related to data collection and sharing rather than just privacy concerns.

New subsections were added to clarify that the consumer protection act violations apply specifically to vendors entering contracts with government agencies.

Extended the general retention period for automated license plate reader data from 72 hours to 21 days.

Changed the retention requirement for access logs from an unspecified duration to a mandatory five-year period.

Added toll cameras to the definition of automated license plate reader systems.

Expanded authorized users to include parking enforcement agencies and institutions of higher education.

Adjusted the deadline for the attorney general to publish model policies from July 1, 2027, to December 1, 2027.

Changed the deadline for agencies to submit policy reports from December 31 of each year to a specific date of December 31, 2027.

Clarified that a positive ALPR match alone does not constitute reasonable suspicion for a vehicle stop.

Updated the admissibility rule to specify that evidence obtained from a 'knowing violation' of the act is inadmissible in court.