Editor’s note: This article is part of ALPRs in Focus, a Police1 editorial series examining how agencies use automated license plate reader technology, the investigative value it can provide, and current concerns surrounding privacy, data access, retention and misuse.
Automated license plate reader technology can help agencies locate missing people, recover stolen vehicles and develop investigative leads. Its expanding use has also raised questions about privacy, data sharing, retention, oversight and public trust.
To understand how companies developing and supporting ALPR technology view those issues, Police1 asked ALPR vendors two questions: What minimum standards should govern responsible ALPR use nationwide? And what specific commitments does each company make to help agencies use the technology responsibly?
The responses below reflect the views of the participating companies. They have been lightly edited for clarity and length.
Flock
What minimum standards should govern responsible ALPR use nationwide?
Responsible use of ALPR should require a documented, lawful purpose for every search, access limited to authorized users, detailed audit logs, independent verification of alerts before enforcement action, reasonable data retention, strong cybersecurity protections and clear limits on data sharing. Agencies should also regularly review system use for potential misuse and provide meaningful public transparency about their policies, retention periods and sharing practices.
The goal should be straightforward: strong safeguards that protect privacy without undermining a proven public safety tool.
Flock builds accountability directly into our technology. Every search requires a documented reason and is logged, customers own and control their data and sharing, and multi-factor authentication is mandatory.
We are also moving our recommended default retention period to seven days, requiring Audit Assistance to help agencies identify unusual search activity, requiring case codes for law enforcement searches, and expanding state- and policy-based restrictions. We also provide free Transparency Portals so agencies can publicly explain how their systems are used.
What specific commitments does each company make to help agencies use ALPR technology responsibly?
Our commitment is to continue raising the standard for responsible ALPR use while helping law enforcement solve serious crimes and find missing people.
— Flock spokesperson
Leonardo
What minimum standards should govern responsible ALPR use nationwide?
Standards that govern ALPR use should help law enforcement and municipalities identify vehicles connected to legitimate public-safety initiatives; it should not become an unrestricted system for tracking the movements of ordinary citizens. Responsible ALPR requires balancing powerful identification and investigative capabilities with equally strong safeguards for privacy, security, transparency, and accountability. At a minimum, the standards should require:
- Lawful purpose: ALPR searches and alerts must be limited to legitimate law-enforcement and public-safety purposes which should include criminal investigations, parking management, access control, and tolling.
- Agency control of data: Agencies should own and control their data. Vendors should not independently sell, monetize, or aggregate it.
- Reasonable retention: Routine, non-investigative data should be retained only for a defined period unless connected to an authorized investigation.
- Controlled sharing: Agencies should choose with whom they share data. There should be no automatic aggregation into an unrestricted national database.
- Accountability and auditing: Every search should be attributable to an authenticated user and logged with the purpose, time, and activity. Agencies should regularly audit system use.
- Strong security: Systems should require role-based permissions.
- Verification: ALPR alerts should be treated as investigative leads and independently verified before enforcement action.
- Transparency: Agencies should maintain publicly available policies addressing permitted uses, retention, sharing, security, and oversight.
What specific commitments does each company make to help agencies use ALPR technology responsibly?
Leonardo believes responsible ALPR begins with giving agencies control over their technology and their data. We make several specific commitments to support that responsibility.
Customer data belongs to the customer. We do not monetize customer license plate data, treat it as a commodity, or aggregate it into a vendor-controlled national commercial database. Agencies retain ownership and control of their information.
Data sharing is controlled by the agency. Sharing is opt-in, permission-based, auditable and revocable. Agencies determine which individuals and organizations can access their information and can withdraw that access.
Accountability is built into the platform. System activity is logged so agencies can determine who accessed data, when it was accessed, and what queries were performed.
We build security and compliance into the technology. Our platform supports role-based access controls, multi-factor authentication, CJIS-aligned security requirements, and configurable retention policies that allow agencies to comply with applicable laws and policies.
We work with customers to continuously improve the system. By collaborating with agencies to understand their operational needs, we enhance the technology so it performs effectively for them while supporting the regulatory and policy requirements governing how they use the system.
Ultimately, our commitment is to provide agencies with powerful investigative technology while ensuring they maintain control over how their data is accessed, retained, and shared. Public safety and responsible data governance should reinforce one another, not compete with one another.
— Nate Maloney, Vice President of Marketing & Communications, Leonardo
NDI Recognition Systems
What minimum standards do you believe should govern the responsible use of ALPR technology nationwide?
Automated License Plate Recognition (ALPR) programs should operate under clear, practical governance standards that protect data, ensure accountability and support legitimate law enforcement use. At a minimum, agencies should establish:
- Data retention: A standard retention period of 30 days, unless a longer period is authorized by agency policy or required for an active investigation.
- User auditing: Comprehensive audit logs of user activity, searches and system access. Auditing should serve as the primary governance mechanism, allowing agencies to identify unusual, excessive, or potentially unauthorized activity.
- Role-based access: User permissions should be limited based on job responsibilities and legitimate operational needs.
- Required training: Authorized users should complete appropriate training before receiving system access.
- Data-sharing controls: When data sharing is enabled, access should generally be limited to approved law enforcement partners within the state or defined regional network rather than automatically shared nationwide.
- Third-party agency access: Agencies that do not own or operate the ALPR equipment should only receive access under a documented and maintained Memorandum of Understanding (MOU) or similar agreement.
- System security: Multi-factor authentication (MFA) should be required for system access, and vendors should comply with applicable CJIS security requirements.
- Agency policy: ALPR use, auditing, access, retention and sharing should align with each agency’s established policies and procedures.
Effective governance should prioritize accountability through auditing and documented policy while preserving ALPR as an effective investigative and public safety tool.
What specific commitments does your company make to help agencies use ALPR responsibly?
NDI Recognition Systems is committed to helping agencies use ALPR technology responsibly, securely, and in accordance with their own policies. At the core of our approach is a principle we have maintained throughout our history: Your LPR. Your Data. Your Choice.
Agencies maintain control over their ALPR data and determine how it is managed. This includes decisions regarding data sharing, retention periods, user access and roles, system integrations and APIs, and hardware deployment.
Our standard data retention period is 90 days and can be customized to align with individual agency policies and applicable requirements. Agencies may also preserve relevant data beyond the standard retention period when associated with an active investigation or case.
Accountability is built into our platform through comprehensive audit capabilities. System administrators can monitor user activity, including searches, reports, hotlist creation, and changes made within the software. These audit trails provide agencies with the visibility needed to identify potential misuse and enforce their established policies and procedures.
NDI Recognition Systems also works closely with customers to configure their ALPR environment around their operational, security and governance requirements.
Our commitment extends beyond providing technology. We provide responsive customer service, training, and support designed to help agencies maximize the public safety benefits of ALPR while maintaining appropriate oversight and accountability.
— Sheri Taynor, US Business Development Manager, NDI Recognition Systems
Rekor
What minimum standards do you believe should govern the responsible use of ALPR technology nationwide?
ALPR remains an important tool for recovering stolen vehicles, locating missing people, and supporting other legitimate public-safety needs. Still, from coast to coast, the country needs to reset how it deploys this technology. That is why Rekor has called for a national, vendor-neutral Responsible ALPR Standard built on three pillars:
- Privacy-protected plate data: Limit alerts to legally authorized lists, immediately protect non-hotlist data through encryption or tokenization, and permit re-identification only under a valid warrant or court order.
- Purpose- and severity-based retention: Tie retention to lawful purpose, investigatory relevance, and the seriousness of the underlying event.
- Verifiable video integrity: Authenticate images and video at capture and maintain tamper-evident, auditable records.
What specific commitments does your company make to help agencies use ALPR responsibly?
Two points I want to be direct about. First, this is not a Rekor feature, and we are not selling it as one. We are asking that it apply to every vendor in the market, including us, and that it be written into procurement requirements and state law.
Second, I am not aware of another ALPR vendor that has committed to a warrant requirement for non-hot-list vehicles. The fight over whether ALPR should exist at all has stopped being useful to anyone. The rules are the real argument.
— Charles Degliomini, Executive Vice President, Rekor
Safe Fleet
What minimum standards do you believe should govern the responsible use of ALPR technology nationwide?
ALPR technology can be a powerful force multiplier for public safety, but public trust depends on clear guardrails. At a minimum, every agency should have policies that define who can access ALPR data, when searches can be conducted, and how those searches are documented and audited.
We believe responsible ALPR use requires purpose-based access controls, mandatory audit trails, reasonable retention limits for non-criminal data and transparency around how the technology is used. As AI-assisted investigative capabilities continue to evolve, human oversight must remain central to operational decision-making.
The goal should be a consistent framework that enables agencies to use ALPR effectively while protecting privacy, ensuring accountability, and maintaining community confidence. Public safety and privacy are not competing priorities. The best ALPR programs are designed to support both.
What specific commitments does your company make to help agencies use ALPR responsibly?
Safe Fleet is committed to helping agencies use ALPR technology responsibly, securely and in compliance with evolving laws and policies. Safe Fleet’s vehicle-based ALPR solution combines real-time license plate recognition, vehicle identification and in-car video in one patrol vehicle platform, giving officers greater situational awareness in the field.
We build accountability into our platforms through audit logging, access controls, configurable retention settings and policy-driven workflows that support agency governance requirements. We continuously update our solutions to reflect changing regulations, emerging best practices and advancements in AI governance.
Beyond technology, we provide agencies with access to ALPR specialists who monitor legislative and policy developments and help customers align system configurations with their operational and compliance needs.
Our commitment is simple: provide agencies with the tools, safeguards, and expertise needed to advance public safety while supporting transparency and public trust.
— Jerry Chang, Director of Product Marketing at Safe Fleet
