- Some agencies shared ALPR data beyond legal limits.
- Thirty-three departments kept plate data past 21 days.
- Nearly one-third skipped the state compliance survey.
Automatic license plate reading (ALPR) cameras are everywhere. As a result of their increased presence, Virginia passed a law last year requiring sweeping reform to the way that police used these systems. Now, a new report suggests those guardrails are being widely ignored by police departments.
According to the Virginia State Crime Commission’s January 2026 report on law enforcement use of ALPR, a significant number of agencies appear to be out of compliance with the law that took effect July 1, 2025. Worse, nearly one-third of Virginia’s 361 law enforcement agencies didn’t respond to the state’s mandatory survey at all.
“Based on the responses to the Crime Commission’s 2025 Law Enforcement ALPR Use Survey, some Virginia law enforcement agencies are not using ALPR in accordance with the new statute,” the report reads. “In addition, almost one-third of law enforcement agencies did not respond to the survey; therefore, their ALPR use is unknown. Measures will be taken this year to address these issues.”
Legal Limits On ALPR Data Sharing
The new statute clearly limits ALPR data sharing to Virginia law enforcement agencies, prosecutors, defense attorneys, vendors, or by court order. It does not allow sharing with out-of-state or federal agencies.
Yet the Crime Commission found 13 percent of responding agencies reported giving continuous access to out-of-state law enforcement. On top of that, six percent reported giving continuous access to federal law enforcement.
More: What Looks Like An Abandoned Trailer Is Part Of A Growing Surveillance Network In California
The report explicitly states the statute does not permit such sharing. In total, 20 agencies acknowledged providing continuous access to out-of-state agencies and 9 to federal agencies. That’s not a gray area. It’s directly contrary to the law. These aren’t the only issues found in the investigation, either.
Other Policies Ignored Entirely
The law requires ALPR data to be purged after 21 days unless tied to an active investigation. Still, 33 agencies admitted to data retention policies longer than 21 days. Some stretched as long as 60 days for fixed cameras, 180 days for mobile cameras, and 30 days for portable units. That’s clearly far longer than the statute allows for.
The legislation also requires agencies to adopt a formal ALPR policy and conduct public awareness efforts before or shortly after implementation. Despite that, 26 agencies using ALPR openly admitted to having no policy at all. 14 others said their policies were “in progress,” and 55 reported having zero public awareness measures whatsoever. In other words, dozens of departments deployed a powerful surveillance tool without the guardrails the General Assembly mandated.
Openly Ignoring The Request
Maybe the most concerning portion of this situation is that 110 agencies, about 30 percent statewide, simply ignored the Crime Commission survey. Essentially, there’s no way to know if they’re complying with the law or not. The Chair of the Crime Commission now plans to send letters to both non-compliant and non-responding agencies demanding correction.
For a surveillance system capable of tracking millions of drivers, “we didn’t answer the survey” and “we didn’t purge the data” aren’t minor oversights. They’re serious compliance failures. And now, the spotlight is on the departments that ignored the rules.
Lead image PlateSmart