Guest Column: For Privacy Advocates, License Plate Readers Are A Bigger Threat Than Carefully-Regulated Speed Enforcement Cameras

Editor’s note: this piece was originally published on the ACLU of Massachusetts website and is being shared here with the author’s permission.

Massachusetts Governor Maura Healey recently proposed expanding the use of automated enforcement technologies (AET), which use cameras and sensors to identify traffic violations. State lawmakers are working on legislation that would authorize cities and towns to use cameras to ticket people for speeding and running red lights and stop signs.

Given the ACLU’s years-long campaign to warn about the dangers of unregulated license plate readers (LPRs), we’re often asked about the potential risks of traffic enforcement cameras.

Our take: When properly regulated, traffic enforcement cameras do not pose the same threats to privacy as license-plate-reader surveillance. We’re also encouraged by the smart guardrails state lawmakers are considering in legislation that would authorize Massachusetts cities and towns to expand automated traffic enforcement.

Comparing Automated Traffic Enforcement and License Plate Reader Surveillance

The table below lays out key differences between the technologies.

In a nutshell: As designed and currently used, license plate readers create an invasive digital dragnet, enabling law enforcement to capture, store, and upload information into a national database with sensitive location information about every driver, including those who are under no suspicion of wrongdoing. In Massachusetts, this technology is completely unregulated.

By contrast, traffic enforcement cameras are designed solely to capture information on cars that commit specific moving violations. They are in limited use in Massachusetts for enforcement of bus lane and bus stop violations. Proposed legislation to expand traffic enforcement cameras for other moving violations contains strong privacy protections.

LPRs in Massachusetts: Automatic Data Sharing and Potential for Abuse

Police use of license plate readers is already widespread across the state. Over 80 Massachusetts police departments have signed contracts to deploy Flock Safety’s automatic license plate reader technology to surveil drivers. 

Flock, one of the leading LPR vendors, has built its LPR products around a nationwide data-sharing model: police departments that contract with Flock often share LPR data they collect with the entire Flock network nationwide, giving thousands of out-of-state law enforcement agencies access to records of drivers’ movements all throughout Massachusetts.

The ACLU of Massachusetts has documented the scope of this nationwide network through public records requests. Records we reviewed confirmed that officers with thousands of police departments nationwide, including the Florida Highway Patrol and departments in Dallas, Jacksonville, Florida, and Columbus, Ohio, were able to track where and when individual motorists drove, stopped, and parked across the Commonwealth — all without demonstrating any probable cause or even reasonable suspicion that the people they tracked had committed a crime.

With Flock and other prominent LPR vendors like Vigilant Solutions, unregulated data sharing means this highly personal information is entered into nationwide databases, which can be accessed by other state and federal agencies, including ICE and any law enforcement agency deputized to assist with civil immigration enforcement. That puts immigrants, people seeking healthcare, political protesters, survivors of domestic violence, and others at risk.

Records obtained from the police department in Auburn, Massachusetts show that DHS and ICE agents have direct access to search Vigilant’s nationwide database. Recent reporting by 404 Media confirms that some state agencies with access to Flock’s national database continue to share LPR data with ICE. 

So, while Flock insists that ICE is not a customer, immigration agents are still accessing Flock’s data via friendly departments, putting Massachusetts residents at risk when their data is pooled into regional or nationwide datasets.

And it’s not just immigrants or healthcare seekers who may be at risk. In Georgia, a police chief and a sheriff’s office employee were each arrested in separate incidents for using Flock data to stalk individuals; in Milwaukee, a police officer recently resigned and faces criminal charges after running over 120 searches to track the movements of someone he was dating, logging each one simply as “investigation[.]”

You might trust your local police department, but you have zero control over police in other jurisdictions. So, when police pool their LPR data together across departments, it creates a surveillance dragnet that operates beyond any local oversight or democratic accountability.

This is what surveillance without attendant privacy law looks like. Unlike regional neighbors in Maine and New Hampshire, Massachusetts has not passed statewide regulations on police use of license plate readers. As a result, a network of location-tracking infrastructure has been built and is operating with no guardrails. That’s why we’re advocating for statewide LPR guardrails around data sharing and data retention, while still allowing police to use this technology for legitimate investigations.

A Privacy-Protective Approach to Automated Traffic Enforcement

Against this backdrop, it’s notable that proposed Massachusetts legislation that would authorize local governments to implement automated traffic enforcement cameras — S.2344/H.3754 — takes a fundamentally different approach to data: one built around the principle that information collected for one purpose should only be used for that purpose. The legislation also includes robust privacy protections to prevent abuse and misuse of our personal information.

First, there’s a collection limitation: automated traffic enforcement cameras may only take photographs when a camera-enforceable violation occurs.

Next, the legislation tightly restricts how collected data can be accessed and used. Photographs and other recorded evidence must be deleted within 48 hours after the final disposition of a violation. Data collected by these cameras cannot be used, disclosed, sold, or shared except as necessary to process violations. Frontal view photographs which could identify the driver are prohibited. Even if someone is inadvertently captured in a frontal photograph, that image cannot be used as the basis for a violation, nor can it be introduced as evidence in any judicial or administrative proceeding.

The legislation’s protections reflect a consistent, privacy-centered philosophy: the data collected exists solely to adjudicate a specific traffic infraction and is deleted after that purpose is served. 

This stands in stark contrast to unregulated LPR systems designed to accumulate, retain, and share as much sensitive location data as possible.

Aside from privacy, there are other important civil rights-related questions about automated traffic enforcement. For example, there is a risk that cameras could get placed disproportionately in communities of color or lower-income communities. Other concerns relate to municipalities using automated enforcement to pad their budgets, putting low-income people at risk of falling into debt to the government.

While ongoing oversight and transparency will be needed if state legislators vote in favor of legalizing automated traffic enforcement cameras, the current legislation under consideration acknowledges concerns around racial equity by requiring the Massachusetts Department of Transportation to consider the social and racial equity impacts of any city or town’s implementation plan before approving it, and mandating annual reporting on these impacts.

Two Different Technologies, Two Different Conversations

The confusion between automated traffic enforcement and license plate readers is understandable, as both technologies involve cameras on roads reading license plates. But they serve different purposes, operate on different principles, and pose different privacy risks.

Speed and red-light cameras are targeted enforcement tools that only collect data on alleged violators. According to data from the U.S. Department of Transportation, these cameras can reduce crashes by up to 54 percent on urban roadways. And when accompanied by robust privacy protections like those in S.2344/H.3754, traffic enforcement cameras do not function as historical or real-time location-tracking technology.

License plate readers, on the other hand, are part of a dragnet surveillance infrastructure that targets all motorists and is currently subject to zero regulation in Massachusetts.

We applaud lawmakers for taking a thoughtful, privacy-protective approach to automated traffic enforcement. They should do the same with license plate readers. After all, it makes little sense to adopt robust privacy rules pertaining to data collected on suspected violators, while doing nothing about police technology that facilitates dragnet surveillance of everyone on the road.

Those who object to automated enforcement often raise privacy issues as a reason to oppose the technology. To those critics we offer this: Join us in our fight to regulate license plate readers, because it’s police use of these tools that is really putting your privacy at risk.

Kade Crockford is director of technology and justice programs at the ACLU of Massachusetts.