Alabama License Plate Reader Laws

Status at a glance

A regulation, not a statute

We didn’t find an Alabama statute that specifically regulates license plate readers. The main source is a regulation: Chapter 265-X-6 of the Alabama Administrative Code, issued by the Alabama Justice Information Commission. It cites Code of Ala. 1975, § 41-9-620 as its statutory authority. Each rule in the chapter was published January 31, 2022, and took effect March 17, 2022.

The chapter’s stated purpose is “to provide uniform directions to all law enforcement agencies in Alabama regarding the use of License Plate Recognition (LPR) systems and LPR data, and the uniform retention of data collected” (r. 265-X-6-.01(1)). It applies to law enforcement agencies, defined as state, county and municipal public agencies whose officers can make arrests (r. 265-X-6-.02(4)). It doesn’t regulate privately owned cameras. See private and HOA cameras.

The definition of an LPR system is broad: “All information, including but not limited to photos, coordinates, date, and time, is considered part of the LPR” (r. 265-X-6-.02(5)).

Permitted collection and use

“A capturing agency may only collect LPR data for a criminal justice or public safety purpose” (r. 265-X-6-.03(1)). The agency must move the data from the collection device to a secure repository it controls within 24 hours (r. 265-X-6-.03(2)).

Use follows the same standard. The data may be used by law enforcement only for a criminal justice or public safety purpose, “including, but not limited to, finding missing persons, investigating human trafficking or other criminal activity, and determining the ownership, location or identity of a vehicle” (r. 265-X-6-.04(1)). The regulation doesn’t require reasonable suspicion before a search, and it has no rule on stops based on an alert.

Retention: up to five years

LPR data and access log data “shall be retained for no more than five years, at which time it will be destroyed or erased” (r. 265-X-6-.06(1)). The regulation says this period is based on national standards in 28 CFR Part 23. Specific records “may be retained beyond five years where there is an active investigation or pending case related to those records,” and the agency must notify the Alabama Law Enforcement Agency (ALEA) to keep them longer (r. 265-X-6-.06(1)(a)).

Five years is a ceiling, not a required period. An agency may keep data for less time, so the actual retention depends on the agency’s own policy. See ALPR data retention and sharing.

Sharing, logs and the state registry

• LPR data “shall not be shared with any entity for a non-criminal justice or non-public safety purpose,” and it “shall not be sold to any entity for any reason” (r. 265-X-6-.04(2)–(3)).
• An agency that captures or uses LPR data must keep an access log showing who accessed the data, the date and time, and the purpose (r. 265-X-6-.04(4)).
• A capturing agency may share data with another criminal justice agency for a criminal justice or public safety purpose. It must keep a dissemination log of the records shared, the date, the receiving agency and the purpose (r. 265-X-6-.04(5)).
• Agencies must send plate number, date and time, location and agency identifier to a State LPR Registry run by ALEA’s CJIS Division within 48 hours. The rule says “This mandate will only be required once ALEA established the State LPR Registry” (r. 265-X-6-.05(1)). We haven’t confirmed whether the registry is operating.

The regulation has no specific rule on sharing with out-of-state agencies. See ALPR audit logs and search records.

Agency policies, audits and misuse

• Written policy. Each capturing agency “shall adopt and publicize a written policy governing its use prior to capturing or using any LPR data.” The policy must cover comparison databases, retention, sharing with other agencies, and operator training (r. 265-X-6-.08(1)).
• Vendors. An agency may contract with a vendor to maintain captured data. The vendor must submit an ALEA CJIS security agreement (r. 265-X-6-.08(2)).
• State audits. ALEA’s CJIS Division audits every capturing agency at least once every three years. An agency found out of compliance has 90 days to comply, or its access to ALEA LPR systems is suspended (r. 265-X-6-.07).
• Misuse. Misuse is investigated the same way as alleged misuse of other ALEA information systems (r. 265-X-6-.09(1)).

The regulation doesn’t say whether evidence is excluded when an agency violates it, and it doesn’t create a private right to sue.

An example: Andalusia’s policy

The Andalusia Police Department’s Policy 425 is one agency’s policy. It cites the regulation throughout and adds its own rules:

• “Reasonable suspicion or probable cause is not required before using an ALPR.”
• “Members will not take any police action that restricts the freedom of any individual based solely on an ALPR alert unless it has been validated.” Alerts are to be verified through an NCIC inquiry or dispatch, and officers are reminded “they need to have reasonable suspicion and/or probable cause to make an enforcement stop of any vehicle.”
• Stored data “should be retained for no more than five years,” with longer retention for evidence or discovery requests and notice to ALEA.
• Data is described as “not open to public review.”
• Other agencies must request data in writing, and the Chief or a designee must approve each request.

Other Alabama agencies’ policies may differ, within the regulation.

What this can mean in an Alabama case

• Did the agency adopt and publicize a written policy before it captured or used LPR data, and what does it say about retention and sharing?
• What do the access log and dissemination log show about who searched the data, when, and for what stated purpose?
• How long does this agency actually keep data? If records are older than five years, was there an active investigation or pending case, and was ALEA notified?
• For a stop on an alert, was the alert validated first, and what independent basis did the officer have? See ALPR alert traffic stops.
• What did the agency’s most recent ALEA audit find?