We’re privacy hawks. Here’s why we’re alarmed by license plate readers — and not necessarily by speed cameras

Massachusetts Governor Maura Healey recently proposed expanding the use of automated enforcement technologies (AET), which use cameras and sensors to identify traffic violations. State lawmakers are working on legislation that would authorize cities and towns to use AET to ticket people for speeding and running red lights and stop signs.

Given the ACLU’s years-long campaign to warn about the dangers of unregulated license plate readers (LPR), we’re often asked about the potential risks of AET.

Our take: When properly regulated, AET does not pose the same threats to privacy as license-plate-reader surveillance. We’re also encouraged by the smart guardrails state lawmakers are considering in legislation that would authorize Massachusetts cities and towns to expand AET.

Read on to learn more about how AET works, how it differs from the LPRs already in widespread use throughout Massachusetts, and how lawmakers ought to regulate both technologies to ensure they support community safety without violating privacy.

The chart below lays out key differences between the technologies.

In a nutshell: As designed and currently used, LPRs create an invasive digital dragnet, enabling law enforcement to capture, store, and upload information into a national database with sensitive location information about every driver, including those who are under no suspicion of wrongdoing. In Massachusetts, this technology is completely unregulated.

By contrast, AETs are designed solely to capture information on cars that commit specific moving violations. They are in limited use in Massachusetts for enforcement of bus lane and bus stop violations. Proposed legislation to expand AET for other moving violations contains strong privacy protections.

Police use of LPRs is already widespread across the state. Over 80 Massachusetts police departments have signed contracts to deploy Flock Safety's automatic license plate reader technology to surveil drivers. Flock, one of the leading LPR vendors, has built its LPR products around a nationwide data-sharing model: police departments that contract with Flock often share LPR data they collect with the entire Flock network nationwide, giving thousands of out-of-state law enforcement agencies access to records of drivers' movements all throughout Massachusetts.

The ACLU of Massachusetts has documented the scope of this nationwide network through public records requests. Records we reviewed confirmed that officers with thousands of police departments nationwide, including the Florida Highway Patrol and departments in Dallas, Jacksonville, Florida, and Columbus, Ohio, were able to track where and when individual motorists drove, stopped, and parked across the Commonwealth — all without demonstrating any probable cause or even reasonable suspicion that the people they tracked had committed a crime.

With Flock and other prominent LPR vendors like Vigilant Solutions, unregulated data sharing means this highly personal information is entered into nationwide databases, which can be accessed by other state and federal agencies, including ICE and any law enforcement agency deputized to assist with civil immigration enforcement. That puts immigrants, people seeking healthcare, political protesters, survivors of domestic violence, and others at risk.

Records obtained from the police department in Auburn, Massachusets show that DHS and ICE agents have direct access to search Vigilant's nationwide database. Recent reporting by 404 Media confirms that some state agencies with access to Flock’s national database continue to share LPR data with ICE. So, while Flock insists that ICE is not a customer, immigration agents are still accessing Flock’s data via friendly departments, putting Massachusetts drivers at risk when their data is pooled into regional or nationwide datasets.

And it’s not just immigrants or healthcare seekers who may be at risk. In Georgia, a police chief and a sheriff's office employee were each arrested in separate incidents for using Flock data to stalk individuals; in Milwaukee, a police officer recently resigned and faces criminal charges after running over 120 searches to track the movements of someone he was dating, logging each one simply as “investigation[.]”

You might trust your local police department, but you have zero control over police in other jurisdictions. So, when police pool their LPR data together across departments, it creates a surveillance dragnet that operates beyond any local oversight or democratic accountability.

This is what surveillance without attendant privacy law looks like. Unlike regional neighbors in Maine and New Hampshire, Massachusetts has not passed statewide regulations on police use of license plate readers. As a result, a network of location-tracking infrastructure has been built and is operating with no guardrails. That’s why we’re advocating for statewide LPR guardrails around data sharing and data retention, while still allowing police to use this technology for legitimate investigations.

Against this backdrop, it's notable that proposed Massachusetts legislation that would authorize local governments to implement automated traffic enforcement cameras — S.2344/H.3754 — takes a fundamentally different approach to data: one built around the principle that information collected for one purpose should only be used for that purpose. The legislation also includes robust privacy protections to prevent abuse and misuse of our personal information.

The bills incorporate several meaningful privacy protections.

First, there’s a collection limitation: automated traffic enforcement cameras may only take photographs when a camera-enforceable violation occurs.

Next, the legislation tightly restricts how collected data can be accessed and used. Photographs and other recorded evidence must be deleted within 48 hours after the final disposition of a violation. Data collected by these cameras cannot be used, disclosed, sold, or shared except as necessary to process violations. Frontal view photographs which could identify the driver are prohibited. Even if someone is inadvertently captured in a frontal photograph, that image cannot be used as the basis for a violation, nor can it be introduced as evidence in any judicial or administrative proceeding.

The legislation’s protections reflect a consistent, privacy-centered philosophy: the data collected exists solely to adjudicate a specific traffic infraction and is deleted after that purpose is served. This stands in stark contrast to unregulated LPR systems designed to accumulate, retain, and share as much sensitive location data as possible.

Aside from privacy, there are other important civil rights-related questions about automated traffic enforcement. For example, there is a risk that cameras could get placed disproportionately in communities of color or lower-income communities. Other concerns relate to municipalities using automated enforcement to pad their budgets, putting low-income people at risk of falling into debt to the government.

While ongoing oversight and transparency will be needed if state legislators vote in favor of legalizing automated traffic enforcement cameras, the current legislation under consideration acknowledges concerns around racial equity by requiring the Massachusetts Department of Transportation to consider the social and racial equity impacts of any city or town's implementation plan before approving it, and mandating annual reporting on these impacts.

The confusion between automated traffic enforcement and license plate readers is understandable, as both technologies involve cameras on roads reading license plates. But they serve different purposes, operate on different principles, and pose different privacy risks.

Speed and red-light cameras are targeted enforcement tools that only collect data on alleged violators. According to data from the U.S. Department of Transportation, these cameras can reduce crashes by up to 54% on urban roadways. And when accompanied by robust privacy protections like those in S.2344/H.3754, AET does not function as historical or real-time location-tracking technology.

LPRs, on the other hand, are part of a dragnet surveillance infrastructure that targets all motorists and are currently subject to zero regulation in Massachusetts.

We applaud lawmakers for taking a thoughtful, privacy-protective approach to automated traffic enforcement. They should do the same with license plate readers. After all, it makes little sense to adopt robust privacy rules pertaining to data collected on suspected violators, while doing nothing about police technology that facilitates dragnet surveillance of everyone on the road.

Those who object to automated enforcement often raise privacy issues as a reason to oppose the technology. To those critics we offer this: Join us in our fight to regulate license plate readers, because it’s police use of these tools that is really putting your privacy at risk.