California SB34: What Private Organizations Using ALPR Need to Know

Automated license plate reader (ALPR) technology can help businesses and private organizations improve visibility, protect property, and respond to incidents more efficiently. In California, operating this technology also comes with specific responsibilities around how license plate information is collected, used, protected, and disclosed.

California Senate Bill 34, commonly known as SB34, established requirements governing automated license plate recognition, or ALPR, systems. A California appellate court decision issued in February 2026 provides important guidance for private organizations that operate these systems.

For organizations using ALPR technology in California, this is a good time to understand the law and review current policies and practices.

What is California SB34?

SB34 established requirements for collecting and using ALPR information in California.

Under California Civil Code § 1798.90.5, an ALPR operator is a person who operates an ALPR system. Under Civil Code § 1798.90.51, ALPR operators must maintain reasonable security procedures and practices to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.

Operators must also implement a usage and privacy policy covering the collection, use, maintenance, sharing, and dissemination of ALPR information.

SB34 also applies to ALPR end-users, meaning people or entities that access or use ALPR information. Under Civil Code § 1798.90.53, ALPR end-users must also maintain reasonable security procedures and practices to protect that information and implement a usage and privacy policy. 

The law's definition of "person" includes individuals as well as partnerships, firms, associations, corporations, limited liability companies, public agencies, and other legal entities. That means the requirements are relevant beyond government and law enforcement agencies. Qualifying private organizations operating ALPR systems can fall within the law's scope.

The law also limits ALPR information to authorized purposes and requires operators and end-users to record certain access information, including the date and time of access and the purpose for accessing the data. For private organizations, that means SB34 responsibilities may apply whether the organization operates an ALPR system or accesses and uses ALPR information.

What does SB34 require in an ALPR usage and privacy policy?

California law specifies what an ALPR usage and privacy policy must include.

At a minimum, the policy must address:

• The authorized purposes for using the ALPR system and collecting ALPR information
• The employees and independent contractors authorized to use or access the system or collect ALPR information, including applicable training requirements
• How the ALPR system will be monitored for information security and compliance with applicable privacy laws
• The purposes, processes, and restrictions governing the sale, sharing, or transfer of ALPR information
• The official custodian or owner responsible for implementing the requirements
• Reasonable measures for maintaining ALPR information accuracy and correcting data errors
• How long ALPR information will be retained and the process used to determine when retained information should be destroyed
  ‍

The policy must be available to the public in writing. If the ALPR operator has a website, the law requires the policy to be posted conspicuously on that website.

For private organizations, this makes the policy part of the operational requirements surrounding ALPR use.

What did Bartholomew v. Parking Concepts, Inc. address?

On February 5, 2026, the California Court of Appeal, First Appellate District, issued its decision in Bartholomew v. Parking Concepts, Inc.

The case involved allegations that Parking Concepts automatically collected license plate information from vehicles entering and leaving a parking garage without implementing and making publicly available the usage and privacy policy required under California's ALPR law.

A trial court initially dismissed the plaintiff's ALPR claim in part because it concluded that the plaintiff had not sufficiently alleged harm.

The Court of Appeal reached a different conclusion.

The appellate court held that collecting and using license plate information without implementing the statutorily required policy governing that collection and use constitutes harm under the ALPR law.

The decision highlights the role that transparency plays in California's ALPR requirements. The required policy gives people information about how ALPR data is collected, used, maintained, shared, and protected.

The court later modified its opinion to clarify the scope of its decision. It did not decide whether collecting and maintaining ALPR information under a policy that omits one or more components required by Civil Code § 1798.90.51(b)(2) would constitute the same harm.  And a subsequent decision limited the scope of Bartholomew’s holding.

Nonetheless, for organizations reviewing their programs, the practical takeaway is clear: understand the requirements, maintain the required policy, make it publicly available, and review whether operational practices align with the policy.

What should private organizations using ALPR in California review?

Organizations operating ALPR systems in California can use the decision as an opportunity to review their current approach with appropriate legal counsel.

Three areas deserve particular attention.

1. Review your ALPR usage and privacy policy

Determine whether your organization operates an ALPR system covered by California law and whether you have implemented the required usage and privacy policy.

Review the policy against the requirements in Civil Code § 1798.90.51, including authorized uses, access and training, monitoring, sharing, accuracy, security, and data retention. Make sure your policy includes each required section. 

2. Confirm the policy is publicly available

SB 34 requires the usage and privacy policy to be available to the public in writing.

For ALPR operators and end-users with a website, the policy must also be posted conspicuously on the site.

Review where your policy is published and whether people can readily find it.

3. Review your actual ALPR practices

A written policy should reflect how an organization actually operates its ALPR system.

Review who has access, how users are trained, how information is secured, when information can be shared, how accuracy is addressed, and how long information is retained.

This review can help organizations understand whether documented policies and day-to-day practices are aligned.

Does California law require organizations to post LPR signage?

SB34 does not require organizations to post physical signage about use of LPR. However, some interpret California’s data privacy law to require or recommend the use of physical signage to give visitors and customers notice about the types of information being collected.  

Responsible ALPR use starts with clear policies

ALPR can give private security and operations teams useful information for protecting people and property. California law also establishes responsibilities for organizations operating these systems.

The Bartholomew decision provides timely guidance for private-sector ALPR operators to understand those responsibilities.

For organizations using ALPR technology in California, reviewing the applicable law, the organization's publicly available usage and privacy policy, and its current operational practices is a practical place to start.

Organizations should work with their legal counsel to determine how California's ALPR requirements apply to their specific technology and use case.

‍

Photo Credit:

1. Maarten van den Heuvel on Unsplash
2. Paul Hanaoka on Unsplash