SB1013 - Automated license plate recognition systems.

Amended IN Assembly August 27, 2026 Amended IN Assembly August 21, 2026 Amended IN Assembly August 17, 2026 Amended IN Assembly June 15, 2026 Amended IN Senate May 14, 2026 Amended IN Senate March 25, 2026 CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION Senate Bill No. 1013 Introduced by Senator Cervantes (Coauthor: Assembly Member Lowenthal) February 10, 2026 An act to amend Sections 1798.90.5, 1798.90.51, 1798.90.52, 1798.90.53, 1798.90.54, and 1798.90.55 of, and to add Section 1798.90.57 to, the Civil Code, relating to personal information. LEGISLATIVE COUNSEL'S DIGEST SB 1013, as amended, Cervantes. Automated license plate recognition systems. Existing law prohibits a public agency, which includes the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system. This bill would provide that “public agency” does not include a transportation agency, a public transit operator, department of transportation, public works department, or campus transportation agency, as specified, a public agency or contracted parking operator when engaging in specified activities in a parking facility, a state agency operating specified parking facilities, or the State Air Resources Board. The bill would require a public agency that accesses or provides access to ALPR information to maintain a record of that access, as provided. The bill would, beginning January 1, 2027, require new, updated, renewed, extended, expansions of, or addendums of contractual agreements with ALPR vendors, manufacturers, or suppliers to mandate that no default access is provided to any national ALPR database and that an agency’s collected scans are by default not accessible to any other agency, except as specified, and would impose new requirements on sharing between California state law enforcement agencies. This bill would authorize a law enforcement agency to use ALPR information only for purposes of locating vehicles or persons when either are reasonably suspected of being involved in the commission of a public offense or locating an individual who has been reported as missing to a law enforcement agency. The bill, as of January 1, 2027, 2028, would require a public agency to archive all ALPR information that has been held for more than 60 days within 14 days, unless that ALPR information is retained in the evidence file of an active investigation or criminal proceeding or matches information on an authorized hot list, as defined, and retain ALPR information that becomes part of an investigation or criminal proceeding in the evidence file as long as the evidence file is required to be held by state law or court order. The bill would prohibit a public agency from querying any archived information except pursuant to a warrant, as specified. By imposing new requirements on public agencies, which include local agencies, this bill would impose a state-mandated local program. Existing law defines an ALPR operator as a person that operates an ALPR system, which does not include a transportation agency. Existing law defines an ALPR end-user as a person that accesses or uses an ALPR system, which does not include, among other things, a transportation agency. This bill would additionally exclude from the definitions of “ALPR operator” and “ALPR end-user” a public transit operator, department of transportation, public works department, campus transportation agency, or an airport or airport operator, as provided. The bill would also exclude from the definition of “ALPR operator” the Department of General Services and its operators when engaging in specified activities in a parking facility and would exclude from the definition of “ALPR end-user” a state agency operating specified parking facilities and the State Air Resources Board. Existing law requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. This bill would require those security procedures and practices to include safeguards for managing which employees can see the data from their systems, as specified, and requiring data security training and data privacy training for all employees that access ALPR information. Existing law requires an ALPR operator and ALPR end-user to implement a usage and privacy policy that includes, among other things, a description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. This bill would require the usage and privacy policy to identify what purpose employees and independent contractors access and use ALPR information for. The bill would also require the Department of Justice to, beginning October 1, 2029, and contingent upon an appropriation of sufficient funds, conduct annual random audits on a public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented and are adhering to that usage and privacy policy. Existing law requires an ALPR operator that accesses or provides access to ALPR information to require that ALPR information only be used for the authorized purposes described in the usage and privacy policy and to maintain a record of that access that includes, among other things, the purpose for accessing the information. This bill would instead require that record of access maintained by the ALPR operator to include a brief, accurate, specific, and plain language statement describing the purpose for accessing ALPR information. The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YES Bill Text The people of the State of California do enact as follows: SECTION 1. This act shall be known as the Automated License Plate Recognition (ALPR) Data Accountability Act. SEC. 2. Section 1798.90.5 of the Civil Code is amended to read: 1798.90.5. The following definitions shall apply for purposes of this title: (a) “Airport or airport operator” means a city, county, city and county, airport authority, joint powers authority, special district, or other public entity that owns or operates a public-use airport, and its contracted parking operator acting on the airport’s behalf. (b) “Automated license plate recognition end-user” or “ALPR end-user” means a person that accesses or uses an ALPR system, but does not include any of the following: (1) A transportation agency when subject to Section 31490 of the Streets and Highways Code. (2) A public transit operator when subject to Section 40240 or 40245 of the Vehicle Code. (3) A department of transportation, public works department, or campus transportation agency when subject to Section 21455.5 of, Section 21455.9 of, Article 3 (commencing with Section 22425), Article 4 (commencing with Section 22435), or Article 5 (commencing with Section 22445) of Chapter 7 of Division 11 of, Section 40240 of, or Section 40245 of, the Vehicle Code. (4) An airport or airport operator when collecting, accessing, or using ALPR information solely for parking access control, fee calculation, lost-ticket resolution, fraud prevention, or transaction dispute resolution in an airport parking facility. (5) A person that is subject to Sections 6801 to 6809, inclusive, of Title 15 of the United States Code and state or federal statutes or regulations implementing those sections, if the person is subject to compliance oversight by a state or federal regulatory agency with respect to those sections. (6) A person, other than a law enforcement agency, to whom information may be disclosed as a permissible use pursuant to Section 2721 of Title 18 of the United States Code. (7) A state agency operating a motor vehicle parking facility pursuant to Section 14678 of the Government Code. (8) The State Air Resources Board. (c) “Automated license plate recognition information,” or “ALPR information” means information or data collected through the use of an ALPR system. (d) “Automated license plate recognition operator” or “ALPR operator” means a person that operates an ALPR system, but does not include any of the following: (1) A transportation agency when subject to Section 31490 of the Streets and Highways Code. (2) A public transit operator when subject to Section 40240 or 40245 of the Vehicle Code. (3) A department of transportation, public works department, or campus transportation agency when subject to Section 21455.5 of, Section 21455.9 of, Article 3 (commencing with Section 22425), Article 4 (commencing with Section 22435), or Article 5 (commencing with Section 22445) of Chapter 7 of Division 11 of, Section 40240 of, or Section 40245 of, the Vehicle Code. (4) An airport or airport operator when collecting, accessing, or using ALPR information solely for parking access control, fee calculation, lost-ticket resolution, fraud prevention, or transaction dispute resolution in an airport parking facility. (5) The Department of General Services and its operators when collecting, accessing, or using ALPR information solely for parking access control, fee calculation, lost-ticket resolution, fraud prevention, or transaction dispute resolution in a parking facility owned, controlled, or operated by the Department of General Services. (e) “Automated license plate recognition system” or “ALPR system” means a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data. (f) “Case file number” means a reference number pertaining to a specific law enforcement or public safety incident or investigation. (g) “Hot list” means a list or lists of license plates of vehicles of interest against which the ALPR system is comparing vehicles in public. Authorized hot lists for public agencies are limited to the National Crime Information Center (NCIC) list, the National Center for Missing and Exploited Children (NCMEC) list, the Stolen Vehicle System (SVS), California Department of Justice lists, official alerts, including AMBER, Silver, Feather, Blue, Ebony, and any new alerts authorized by the Legislature, and custom lists that pertain solely to missing and at-risk persons or where there is reasonable suspicion to believe the vehicle is or was involved in a serious or violent felony, any crime requiring registration of a sex offender, a violation of Section 20001 of the Vehicle Code, a violation of Section 23152 of the Vehicle Code, burglary of a vehicle under Section 459 of the Penal Code, grand theft of an automobile under Section 487 of the Penal Code, a violation of Section 10851 of the Vehicle Code, or any other vehicular crime that may be punishable as a felony. (h) “Person” means any natural person, public agency, partnership, firm, association, corporation, limited liability company, or other legal entity. (i) “Public agency” means the state, any city, county, or city and county, or any agency or political subdivision of the state or a city, county, or city and county, including, but not limited to, a law enforcement agency, but does not include: (1) A transportation agency when subject to Section 31490 of the Streets and Highways Code. (2) A public transit operator when subject to Section 40240 or 40245 of the Vehicle Code. (3) A department of transportation, public works department, or campus transportation agency when subject to Section 21455.5 of, Section 21455.9 of, Article 3 (commencing with Section 22425) or 22425), Article 4 (commencing with Section 22435) 22435), or Article 5 (commencing with Section 22445) of Chapter 7 of Division 11 of, Section 40240 of, or Section 40245 of, the Vehicle Code. (4) A public agency or contracted parking operator when collecting, accessing, or using ALPR information solely for parking access control, violations, permit enforcement, zone enforcement, fee calculation, lost-ticket resolution, fraud prevention, or transaction dispute resolution in a parking facility, including when regulating or enforcing Section 21113 of the Vehicle Code and Chapter 9 (commencing with Section 22500) to Chapter 11 (commencing with Section 22950), inclusive, of Division 11 of the Vehicle Code. (5) A state agency operating a motor vehicle parking facility pursuant to Section 14678 of the Government Code. (6) The State Air Resources Board. SEC. 3. Section 1798.90.51 of the Civil Code is amended to read: 1798.90.51. An ALPR operator shall do both of the following: (a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure, including both of the following: (1) Safeguards for managing which employees can see the data from their systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system, and tracking searches of ALPR information made by employees. (2) Requiring data security training and data privacy training for all employees that access ALPR information. (b) (1) Implement a usage and privacy policy, under the supervision of the Department of Justice according to subdivision (c) of Section 1798.90.54, if applicable, in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an internet website, the usage and privacy policy shall be posted conspicuously on that internet website. (2) The usage and privacy policy shall, at a minimum, include all of the following: (A) The authorized purposes for using the ALPR system and collecting ALPR [Text truncated for display. Full text available on Congress.gov.]