License plate readers are a privacy concern lacking oversight

Whether government officials in Kentucky want to admit it or not, they are answering a fundamental question every time they fund and expand automatic license plate readers (ALPRs): Should the government be able to track your every move without a warrant?

You probably won’t like the answer lawmakers have given so far.

Cities across the country — including Louisville and Lexington — are blanketing streets with ALPRs, high-speed cameras that record every passing vehicle around the clock. Officials call them crime-fighting tools. That is sometimes true. But behind the promises of public safety lies a surveillance infrastructure with virtually no legal guardrails, one that has already been abused right here in Kentucky.

An invasion of privacy

The numbers alone should give pause. There are hundreds of ALPRs across the commonwealth, and Louisville alone operates close to 200. These cameras photograph every passing vehicle — not just those suspected of involvement in criminal activity — and use artificial intelligence to read the license plate and detect other distinctive features of vehicles like the color, make and even the presence of bumper stickers. That data is pooled into cloud-based databases accessible to law enforcement agencies across the nation. There are no federal laws requiring a warrant to query it. There are no meaningful limits on who can access it or why.

We now know this is not a hypothetical risk. In February and March 2025, a DEA agent used a Louisville Metro Police detective’s login credentials to run 150 immigration-related searches of the city’s Flock camera system — without the detective’s knowledge. The searches listed “Immigration” and “ERO,” a reference to Immigration and Customs Enforcement's (ICE) Enforcement and Removal Operations, as the stated reasons. Three LMPD officers were disciplined. But the problem is not one rogue agent. The problem is a system with no guardrails that made the abuse possible in the first place.

The same surveillance infrastructure used for those searches could just as easily track someone visiting a doctor, attending a protest or going to church. As the Electronic Frontier Foundation has documented, aggregated ALPR data can reconstruct an intimate portrait of a person’s life — and chill constitutionally protected activity in the process. Privacy is not a loophole for criminals. It is a precondition for a free society. The government needs far more than administrative convenience to justify eroding it.

The as-introduced version of House Bill 58 from Rep. John Hodgson would cap data retention at 90 days unless tied to an active investigation, prohibit the sale of ALPR data and require agencies to publish written use policies. These would be substantial improvements over current law.

Putting up legal guardrails

And yet there are still substantial deficiencies. Kentucky law currently does not require a warrant before law enforcement — or federal agencies piggybacking on local systems — can query the data. It does not restrict which outside agencies may access Kentucky’s ALPR databases or under what legal authority. The Louisville incident happened precisely because none of those rules existed. A published departmental policy is not a substitute for statewide law with real consequences. The current version of Rep. Hodgson’s bill also creates a variety of troubling carveouts for private companies that do not protect privacy.

A similar bill passed the House 90 –1 last year. The Senate did not move it. That inaction looks far worse today, in light of what we now know happened in Louisville. The Kentucky Senate has possession of the bill now. A warrant requirement for historical data queries and strict, enforceable limits on access to locally gathered data would substantially improve the bill’s treatment of individual rights.

Used with proper oversight, ALPRs can help solve crimes and find missing people. But Kentuckians should not have to choose between public safety and the right to move freely without being tracked, catalogued and made available for inspection by any agency that asks. The General Assembly has both the power and the obligation to make sure they don’t.

Caleb O. Brown is CEO of the Bluegrass Institute. Alasdair Whitney is legislative counsel at the Institute for Justice.

This piece originally appeared in the Louisville Courier Journal.