Oregonians will soon be able to sue private companies that sell or otherwise improperly use data captured by license plate-reading cameras under a new state law.
Senate Bill 1516, signed into law by Gov. Tina Kotek on March 31, went into effect immediately due to an emergency clause lawmakers tucked into the legislation. The 16-page law was part of a public safety omnibus package that received bipartisan support, but it stood out for its restrictions placed on the use of automated license plate reading software and the street cameras it employs. Law enforcement agencies have used that technology to dismantle criminal networks, but their use has drawn increased scrutiny amid increased federal immigration enforcement.
“We have the possibility of multiple law enforcement agencies in the state entering into contracts that may not have those private protections of data,” Sen. Floyd Prozanski, a Eugene Democrat who chairs the Senate Judiciary Committee, told the Capital Chronicle in January. “There may be the ability for other entities (to be) getting access to that material for purposes that are not lawful within the state, specifically sharing with the federal government or other states.”
Oregon’s sanctuary laws prevent state and local law enforcement from assisting federal immigration enforcement without a court order. But civil rights advocates have raised concerns that the data collected by cameras could be used to track immigrants and people seeking abortions, even in states including Oregon that have laws to protect access to reproductive care and bar local police from working to enforce immigration law.
The technology tracks more than license plates, including features such as car color, make or physical condition, and some researchers have found that its use can lead to misread plates or arrests of innocent individuals.
U.S. Border Patrol employed automated license plate-reading technology in the 1990s, and it spread to police departments across the country in the next decade. One vendor in particular, the Atlanta-based Flock Safety, has drawn condemnation from U.S. Sen. Ron Wyden, who previously said the company is “unable and uninterested” in preventing abuses of its products.
University researchers and journalists have documented how U.S. Border Patrol and Immigration and Customs Enforcement accessed camera data in states like Oregon and Washington. U.S. Border Patrol had access to at least 10 Washington police departments’ databases without explicit authorization, according to an October 2025 report from the University of Washington. And in June 2025, some local agencies outside of Oregon searched the networks of Oregon’s local law enforcement agencies hundreds of times on behalf of ICE, according to the Oregon Law Center.
In response to concerns from privacy advocates, the law limits the retention of such data to 30 days unless it is linked to a criminal inquiry or court proceedings, allowing for law enforcement to hold onto it as they pursue their investigations. Authorities would have to log the purpose of their searches and the specific type of crime or violation being targeted if their search through the data is for a criminal investigation. They are barred from using the technology in a manner that violates the state’s sanctuary laws.
Flock Safety cameras, meanwhile, have stoked increasing controversy in recent months, prompting some Oregon cities to turn off their usage. But they’ve been used for years nationwide in thousands of law enforcement agencies. This past year, the company announced new artificial intelligence tools allowing officers to search for vehicles with unique characteristics.
The company has also issued guidance around the new law and praised it for establishing Oregon’s “first comprehensive ALPR framework, setting rules for ALPR use while preserving its ability to help solve crime and locate missing persons.”
“Flock Safety remains committed to responsible ALPR regulation and continued collaboration with policymakers and law enforcement agencies across Oregon and the country,” the company’s website reads. “As SB 1516 takes effect, our priority is to help agencies adjust to the new law while continuing to protect their communities.”
Enforcement questioned
Any member of the public could sue for damages caused by vendors who act “intentionally or with gross negligence” by selling, disclosing or sharing the data. That could include a vendor accessing and providing data to federal immigration authorities without a local law enforcement body’s consent or judicial warrant.
But that leaves a great amount of onus on individual Oregonians to enforce the law, according to Ky Fireside, an Oregon House candidate and Springfield-based progressive organizer who was part of a license plate reader workgroup convened by Prozanski.
“If I wanted to take a private right of action against a vendor, I’m gonna need to find some very powerful lawyers that are willing to work on contingency or something,” Fireside told the Capital Chronicle.
Under the law, non-Oregon law enforcement can also access Oregon law enforcement agencies’ database for information “relevant to the law enforcement purpose” rather than “unrestricted or ongoing access to captured license plate data.” The agency sharing data must log which government agency or entity requested the search and the number of cameras or devices accessed.
And any vendor that contracts with law enforcement agencies must give the agency monthly and quarterly audits. Those audits, which must also be available to the public, would include information such as the number of unique vehicles the system has captured, what kind of data was searched for, the purpose of a search and any government agencies for whom a law enforcement agency conducted a search.
Fireside said this transparency is particularly important given the public’s involvement with holding the technology accountable. Prior to halting their use, local authorities in Eugene confirmed that a license plate reading camera in the area was turned on without the city’s consent.
“Every misuse of the system that we found was because of the public auditing these companies, watching them, doing public records requests or just looking at transparency portals,” Fireside said. “It was not like internal affairs investigating themselves and realizing someone did something wrong. It was the public.”
Although the bill exempts license plate reader data used by law enforcement agencies from public records requests, it notes that audits can be disclosed if they are edited to remove personally identifiable information. Videos or images, for instance, would need to be “edited in a manner as to render the faces of all persons within the recording or image unidentifiable.”
One thing privacy advocates wanted, but didn’t get? The law requires that the captured license plate data be encrypted through end-to-end encryption, the process by which secure data is encoded before it is transferred to its destination and decoded. But it doesn’t spell out how that process is defined, a major issue for Fireside.
“The bill requires it, but doesn’t define it. My biggest concern is that these vendors are going to try and skirt that aspect of the bill,” Fireside said. “That is the most dangerous part, because that requirement was the thing that kept the data out of the hands of these private corporations.”
Commented