Skip to content
Naked Security Naked Security

California to make it harder for your license plate to be tracked

In other words keep data-collecting, privacy-invading license plate cameras away from our cars.

On 9 January, a California committee passed senate bill SB-712: a piece of legislation that would make, what might seem like, a tiny tweak to a law that says you can’t cover your car’s license plate.
In California, it’s currently legal to cover your entire vehicle when it’s parked up, including the license plate, to protect the car from the weather, as long as the cover is easy enough to pull up to get a look at the license plate.
However, it’s illegal to cover just the license plate when it’s parked, which you may very well want to do to protect your privacy from automated license plate readers (ALPRs).
The proposed tweak to the bill, introduced by Sen. Joel Anderson in 2017 and endorsed by the Electronic Frontier Foundation (EFF), would change the bill to read like so:

A covering shall not be used on license plates except as follows:
(1) The installation of a cover over a lawfully parked vehicle to protect it from the weather and the elements, or the installation of a cover over the license plate of a lawfully parked vehicle, does not constitute a violation of this subdivision. A peace officer or other regularly salaried employee of a public agency designated to enforce laws, including local ordinances, relating to the parking of vehicles may temporarily remove so much of the cover as is necessary to inspect any license plate, tab, or indicia of registration on a vehicle.

In other words, keep your spying, data-collecting, privacy-invading cameras away from our cars. There are businesses that send ALPRs, mounted on vehicles, driving up and down streets to document the travel patterns of drivers, to take photos of every license plate they see, to time-stamp and location-stamp those photos, to upload them to a central database, and to sell the data to lenders, insurance companies, and debt collectors.
The data-aggregators-on-wheels companies also sell information to law enforcement, including to the US Department of Homeland Security (DHS), the EFF says. The DHS, in fact, last month released its updated policy for using this commercial ALPR data for immigration enforcement.
DHS’s notice mentions “privacy and civil liberties protections that have been implemented by the agency and the vendor,” but we’ve seen time and again how casually vendors treat sensitive ALPR data and how nonresponsive they’ve been to police when they’ve tried to protect investigation details from unauthorized eyes.

In August, Wired detailed one such instance, wherein a sensitive case became an open book to police departments that had no business looking at it, all because they were able to enter a license plate number involved in the case.
These things suck up so much data, with so little protection for privacy, that legislators and police seem to have gone a little kid-in-a-candy-store. In 2015, for example, the Los Angeles City Council thought it was a good idea to have the city attorney’s office analyze a proposal to use license plate readers to determine who owns vehicles spotted parking in, or driving slowly through, neighborhoods known for prostitution. The idea was to then send “Dear John” letters, warning of sexually transmitted diseases (STDs), to the car owners’ home addresses, in the hopes that wives or girlfriends would intercept them.
The Atlantic has called the amassing of this huge database of driver information an “unprecedented threat to privacy.” From its coverage:

[Vigilant Solutions, an ALPR surveillance company] has taken roughly 2.2 billion license-plate photos to date. Each month, it captures and permanently stores about 80 million additional geotagged images. They may well have photographed your license plate. As a result, your whereabouts at given moments in the past are permanently stored. Vigilant Solutions profits by selling access to this data (and tries to safeguard it against hackers). Your diminished privacy is their product. And the police are their customers.

We have seen the security of ALPR live feeds compromised, streaming out the license plates of mostly innocent drivers caught in vast police dragnets. We have also seen police in Oakland, California, hand over an entire license plate reader data set to a journalist.
Should we care? After all, the ALPRs are just automating the collection of what can be seen by anybody driving down the street and jotting down license plate numbers, the argument goes. That’s how a Vigilant company official framed it when talking to the Washington Post:

[The technology] basically replaces an old analog function – your eyeballs… It’s the same thing as a guy holding his head out the window, looking down the block, and writing license-plate numbers down and comparing them against a list. The technology just makes things better and more productive.

The response to that from The Atlantic’s Conor Friedersdorf:

By this logic, Big Brother’s network of cameras and listening devices in 1984 was merely replacing the old analog technologies of eyes and ears in a more efficient manner, and was really no different from sending around a team of alert humans.

As we’ve noted in the past when reporting about Big Data, we have to stop thinking about data sets in terms of individual records and start thinking about them in terms of huge networks of possible relationships that exist between those records.
As Naked Security’s Paul Ducklin has pointed out, license plate readers are a good example of how seemingly innocuous pieces of discrete data – i.e., where your license plate was and when – manifest into something entirely different when amassed in huge data sets and cross-correlated, given that your plate number stays constant while your location changes.
There are properties and capabilities that emerge from large collections of data that don’t exist in the same data at smaller scales (it’s why we had to invent a term – Big Data – to describe it).
While one data point about a license plate could – and has – been used to do things such as track fugitives or solve a gang-related homicide, there’s no saying what the government can do with massive amounts of correlated data spanning years – the vast majority of which has been collected from innocent people who aren’t breaking any laws.
To put some numbers around the scope of how (in)effective ALPR data has been in fighting crime, the EFF has filed dozens of public records requests. It’s found that “less than 0.1% of license plate data collected by police are connected to a crime at the point of collection, but the remaining 99.9% of the data is stored and shared anyway.”
On 10 January, the bill that would make it legal to cover up cars’ license plates was ordered to a third reading, so as of 22 January, it’s not yet a done deal.


Wow – thanks for this expose. It never occurred to me that people could make a living driving round with NPR systems to collect data and sell it. Substitute Facial Recognition for NPR and I guess people can do the same thing with drones, or even static wireless cameras. Just think of the value of the data of who is entering which shops. It’s bad enough the continual feed of adverts based on what I have been looking at online (some are amusing – in my seventh decade I started getting baby formula ads – I figured this was because my wife had bought some in a local supermarket for when our grandchild was coming to stay). Maybe if I steal a glance at a scantily clad shop window manekin, my wife will get ads for the type of lingerie she should be buying. Not sure if that is good or bad, just creepy.


In reality, the percentage of people who would go through the trouble of putting some kind of license plate cover on their vehicle every time they parked would be exceedingly small even among the subset of the population that would be aware that you could do so. The vast majority wouldn’t even know. There would need to be some kind of automatic covering solution that also removes itself when the vehicle starts or is put into gear. In any case, congratulations to the three people that this change is going to affect.


Presumably, all the data aggregators need to do it to install a camera at the entrance to every parking lot, if they haven’t already, so they grab your tag when you’re driving – at that point, the law requires your tag to be visible anyway.
(Private car park operators in the UK use entry and exit cameras to extract penalty payments from alleged infringers – they don’t care whether or where you parked, just that you came and went so many minutes apart without buying a ticket. They know whether you bought a ticket because you have to type in your plate number at the ticket machine. They don’t need to go round reading plates – to avoid a fine you have to turn yourself in anyway :-)


It’s nice to have the option codified in law. Makers of aftermarket backup cameras that are integrated into license plate frames could sell a cover for the license plate that turns opaque when the car is off, for example. This could be a big opportunity with the right marketing to inform people. Think about all of those LifeLock ads!


Orwell is rolling around in his grave laughing his ass off at us all.
Not only do we have the two way telescreen in our homes and our pockets but we invited it in and paid for the privilege. Nor does big brother need to take us to room 101 to extract our private information, we post it for him in Facebook and Twitter and happily have our every move tracked.
Our language and thoughts are changed by TV and media.
Orwell underestimated just how bad it would be.


It is not even through our own admissions, but those of our government’s. The soveriegn organization tasked with our protection! Look no further than any of the meriad of online people search sites; e.g., Intelius, WhitePages, LexusNexis. Your insurance company and every retailer you deal with – even not-for-profit organizations – are contributing to this BIG DATA conundrum. All is lost. We have no rights to privacy in the REAL world!


You mention the security of ALPR live feeds compromised. What about Red Light cameras that can get both the plate and the driver, or Photo Radar, or Toll Road cameras?


I think some enterprising person should make a cover that has a modifiable lookalike plate image, with different numbers available. That might fix them, and would probably sell well, too.


Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!