California ALPR Law for Parking Operators and Property Owners

Who counts as an ALPR operator under California law#

Title 1.81.23 of the Civil Code, sections 1798.90.5 through 1798.90.55, was added by SB 34 in 2015 and took effect January 1, 2016. Section 1798.90.5 supplies the definitions, and that is where most owners get surprised.

An ALPR system is defined as a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer readable data. The regulated thing is the database, not the camera. A camera that only records video is not an ALPR system. A camera whose output becomes searchable plate text is.

ALPR information means information or data collected through the use of an ALPR system. An ALPR operator is a person that operates an ALPR system. An ALPR end user is a person that accesses or uses an ALPR system. Person is defined broadly to include a natural person, a public agency, a partnership, a firm, an association, a corporation, a limited liability company or other legal entity. Public agency means the state, a city, a county, or a city and county, or any agency or political subdivision, including a law enforcement agency.

The definitions carve out transportation agencies when subject to Streets and Highways Code section 31490, the toll and transit data statute. The end user definition also carves out certain persons subject to federal financial privacy regulation and certain non law enforcement disclosures permitted under the federal Driver’s Privacy Protection Act. None of those carve outs helps a parking operator, a shopping center or an apartment community.

That is how an owner becomes an operator without deciding to. A parking access and revenue control system that reads plates at entry so a driver does not need a ticket is an ALPR system. So is a camera platform that grew a plate recognition license after the fact, and so is a gate camera feeding a tow enforcement list. In each case somebody holds statutory duties that did not exist when the cameras only recorded video.

What the usage and privacy policy has to contain#

Section 1798.90.51 imposes two obligations on an operator. The first is to maintain reasonable security procedures and practices, including operational, administrative, technical and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification or disclosure. The second is to implement a usage and privacy policy, available to the public in writing and, if the operator has a website, posted conspicuously on that website. A policy in a binder at the parking office does not satisfy the website clause.

Section 1798.90.51, subdivision (b)(2), lists seven elements the policy must contain at a minimum:

• The authorized purposes for using the ALPR system and collecting ALPR information.
• A description of the job title or other designation of the employees and independent contractors authorized to use or access the system or to collect the information, and the training required of them.
• A description of how the system will be monitored to ensure the security of the information and compliance with applicable privacy laws.
• The purposes of, process for, and restrictions on the sale, sharing or transfer of ALPR information to other persons.
• The title of the official custodian, or owner, of the ALPR system responsible for implementing the section.
• A description of the reasonable measures used to ensure the accuracy of ALPR information and to correct data errors.
• The length of time ALPR information will be retained, and the process used to determine if and when to destroy retained information.

Section 1798.90.53 imposes a nearly identical set on an ALPR end user, with the elements written in terms of accessing and using information rather than collecting it, and with periodic audits named in the monitoring element. Where a property owner operates the system and a management company logs in to it, that is two roles and two policies, not one.

Access logging, retention and security duties#

Section 1798.90.52 is the operational one. If an ALPR operator accesses or provides access to ALPR information, the operator has to maintain a record of that access containing, at a minimum, the date and time the information is accessed, the license plate number or other data elements used to query the system, the username of the person who accesses the information and the organization or entity that person is affiliated with, and the purpose for accessing the information. The operator also has to require that ALPR information be used only for the authorized purposes described in the policy.

That is a software capability, and it belongs in the specification. Ask the platform vendor to demonstrate the access log before award, and ask whether it is exportable and how long it is kept.

Duty	Statute	What it looks like in the field
Reasonable security procedures and practices	1798.90.51(a)	Named accounts, no shared logins, encrypted storage, patching, physical security on the recorder
Written usage and privacy policy	1798.90.51(b)(1)	A document, public in writing, posted conspicuously on the operator website
Seven enumerated policy elements	1798.90.51(b)(2)	Purposes, authorized roles and training, monitoring, sharing rules, named custodian, accuracy measures, retention
Access log on every read of the data	1798.90.52(a)	Date and time, plate or query, username and affiliation, purpose
Use limited to stated purposes	1798.90.52(b)	Role based permissions in the platform, not an honor system
End user policy and safeguards	1798.90.53	A separate policy for anyone who accesses the system without operating it
Public comment before implementation	1798.90.55(a)	Public agencies only, at a regularly scheduled governing body meeting
No sale, sharing or transfer outside public agencies	1798.90.55(b)	Public agencies only, with a carve out for data hosting and towing services

Retention deserves its own line. The statute sets no maximum retention period for a private operator. It requires the policy to state the length of time and the destruction process. The failure mode is mundane: the policy says thirty days because someone copied a sample, and the recorder overwrites at one hundred eighty days because that is what fit on the array. Reconcile the two and put the configured value in the closeout package.

Who is the operator in common parking deployments#

The table below describes how these arrangements usually break down. It is a starting point for a conversation with counsel, not a legal conclusion, because the answer turns on the contract and on who actually operates the system.

Arrangement	Usually the operator	Usually an end user	Notes
Owner buys and self hosts the ALPR platform	The property owner	Anyone the owner gives a login	Owner writes the policy and posts it on its own website
Parking management company runs the PARCS under contract	The management company, and often the owner as well	Owner staff, enforcement staff	Decide in writing which entity is the operator and which is an end user
Camera vendor hosts plate data in its cloud	Contract dependent	The property, at minimum	Hosting does not by itself settle who operates
Tow or enforcement contractor receives plate hits	The property side operator	The tow contractor	Sharing rules and the log both apply to the transfer
Public agency garage, such as a campus or district	The public agency	Departments with access	Section 1798.90.55 adds public comment and sharing limits
Low voltage contractor installs and maintains hardware	Neither	Neither	A contractor that does not operate or access the data is outside both definitions

What changes when a public agency runs the system#

Section 1798.90.55 adds two rules on top of everything above, and it opens with the words notwithstanding any other law or regulation.

First, a public agency that operates or intends to operate an ALPR system has to provide an opportunity for public comment at a regularly scheduled public meeting of the governing body before implementing the program. That is a schedule item on a garage project, not a formality. It happens before implementation, and it happens in front of the board or council.

Second, a public agency shall not sell, share or transfer ALPR information except to another public agency, and only as otherwise permitted by law. The section states that providing data hosting or towing services is not itself a sale, sharing or transfer.

The California Department of Justice addressed out of state and federal sharing in Bulletin 2023-DLE-06, issued October 27, 2023. The bulletin states that SB 34 does not permit California law enforcement agencies to share ALPR information with private entities or with out of state or federal agencies, and directs agencies to review their data user agreements so that access is not granted to agencies other than California state and local agencies. Public agency, as 1798.90.5 defines it, means California state and local government. A vendor platform that defaults to sharing with a national network is a configuration problem an agency has to close before go live.

Breach notification and damages exposure#

ALPR data sits inside California’s breach notification statutes. Civil Code 1798.82, subdivision (h), lists information or data collected through the use or operation of an automated license plate recognition system, as defined in section 1798.90.5, among the data elements that make a record personal information when combined with an individual’s first name or first initial and last name. Civil Code 1798.29 carries the parallel rule for agencies. A parking account database that stores a plate next to a name is that combination in one row.

Section 1798.90.54 supplies the private remedy. An individual who has been harmed by a violation of the title may bring a civil action against a person who knowingly caused the harm. The court may award actual damages, but not less than liquidated damages in the amount of $2,500, punitive damages on proof of willful or reckless disregard of the law, reasonable attorney fees and litigation costs, and other preliminary and equitable relief.

On February 5, 2026 the California Court of Appeal, First Appellate District, Division Five, decided Bartholomew v. Parking Concepts, Inc., case number A171546. The court addressed a parking operator that captured plates at entry and exit without a usage and privacy policy, and held that failing to implement and publicly disclose the required policy is itself the harm the statute makes actionable, without proof of misuse or monetary loss. Filings against parking operators, retail centers and property owners followed. An owner with plate reading cameras and no posted policy should treat that as a live issue and take it to counsel rather than to a vendor.

Where the installing contractor sits#

Telelink Business Services is a licensed C-7 Low Voltage Systems Contractor, CSLB License #472017. Telelink installs and maintains ALPR hardware: the cameras and their mounts, infrared illuminators, lane and pathway conduit, outdoor rated cable, Power over Ethernet, switching and the recorder location. Telelink does not operate ALPR systems, does not host ALPR information, and does not provide access to ALPR information on behalf of a client. The duties in sections 1798.90.51 through 1798.90.53 run to the person that operates the system and to anyone who accesses it, which on a commercial property is the owner, the management company or both.

Installation decisions still affect compliance, and they belong in the submittal. Plate capture is a geometry and shutter problem rather than a megapixel problem: lane angle, mounting height, approach distance, vehicle speed and dedicated infrared illumination decide read rates, and an overview camera aimed at a lane will not do it. Recorder location matters because the physical security element of 1798.90.51(a) applies to the box. Our camera coverage calculator and the security camera systems and access control systems pages cover the layout, and the parking structures page covers how the deck scope is usually split.

Next step#

If a garage, lot or gated property in California is getting plate reading cameras, send the site plan, the lane geometry and the platform you selected and we will price the hardware, pathway and network with the recorder location and retention setting called out. Start at request a bid. The policy, the access log and the retention decision belong to the operator and its counsel, and they should be written before the system goes live.