Kentucky License Plate Reader Laws

Status at a glance

The 2026 law

House Bill 58 (2026), “AN ACT relating to privacy protection,” was signed by the Governor on April 10, 2026, as 2026 Ky. Acts ch. 71. Section 1 created KRS 189.632, which the official statute page lists as effective July 15, 2026. Section 2 added a penalty to KRS 189.990: a person who violates Section 1 faces a fine of $20 to $2,000, up to one year in the county jail, or both (KRS 189.990(33)). The statute contains no rule excluding evidence.

Who it covers and permitted uses

Subsection (2) applies to individuals, entities, partnerships, corporations, associations, the Commonwealth, its agencies and political subdivisions. It is unlawful for any of them “to use an ALPR except as provided in this section.” Under subsection (3), an ALPR may only be deployed or maintained:

• for regulating parking, controlling access to secured areas, or “Promoting public safety, deterring crime, and addressing auto theft” (3)(a);
• by a public agency or law enforcement agency or its agents solely for law enforcement, including criminal investigations and ensuring compliance with local, state or federal law, and for listed commercial vehicle purposes (3)(b); or
• by the Transportation Cabinet for tolls, road fund revenue and commercial vehicle purposes (3)(c).

Paragraph (3)(a) isn’t limited to government, so private deployments, such as an HOA or business camera, appear to fall within it. How the retention and sharing rules apply to private operators hasn’t been tested in any source we found. See private and HOA cameras.

Retention: 90 days, with exceptions

Under subsection (4)(a), captured license plate data “Shall not be preserved for more than ninety (90) days unless it:”

• “Is retained for a lawful purpose described in subsection (3)(b) and (c) of this section”;
• is retained by a law enforcement agency for “Use as evidence in a criminal or insurance claim investigation,” for training with dates, times and plate numbers redacted, or for auditing; or
• “Has become subject to a subpoena duces tecum or preservation of evidence notification.”

When the first exception applies, the data is retained and destroyed under the applicable agency’s record retention policy (4)(b). Because subsection (3)(b) describes law enforcement purposes broadly, how much the 90-day limit constrains police-held data may turn on how that first exception is read. No court decision we found has addressed it. “Captured license plate data” includes GPS coordinates, date and time, photographs of the plate and vehicle, the plate number, and the vehicle’s make, model and color (subsection (1)(c)).

Sharing

Data may be used only by the entity deploying the ALPR, for the purposes in subsection (3), and “Shall not be sold, shared, accessed, or transferred for any other purpose, except” as listed (4)(c)–(d). The exceptions include sharing with a law enforcement officer or agency, or a contractor of one, for public safety or criminal investigations; “In response to a subpoena duces tecum”; and to the National Insurance Crime Bureau, insurers and financial institutions for listed purposes. The statute has no limit specific to out-of-state agencies. See can police search Flock data from other states?

Written policy and 90-day audits

“Prior to the deployment of an ALPR, a law enforcement agency shall adopt and make publicly available a written policy governing the use of the ALPR” (subsection (5)). The policy must list the databases used for comparison and cover retention and destruction, training, supervisory oversight, and access and security. It must also include “An audit schedule and process to ensure that the system is used in accordance with this section and agency policy to occur every ninety (90) days” (5)(f).

Stops based on an alert

Under subsection (6), before performing a traffic stop on an alert, an officer or dispatcher “shall visually confirm” that the “Scanned plate provided in the captured license plate data matches the alert,” and that the stop meets the agency’s policy criteria and applicable law. For the federal standard, see ALPR alert traffic stops.

An example: Lexington’s general order

Lexington Police Department General Order 140.3 took effect December 12, 2012, and was last revised July 18, 2023. It predates KRS 189.632, so it may not reflect the statute’s requirements. It is one agency’s policy, and other Kentucky agencies may differ.

• It says: “This directive is for Departmental use only and does not apply in any criminal or civil proceeding.”
• Before a stop, operators visually verify the plate characters and state of issuance, and verify the hit’s status through dispatch or MDT when circumstances allow. “Receipt of a hit is not sufficient probable cause to initiate a stop without verification.”
• “ALPR data can be shared for legitimate law enforcement purposes.”
• It sets no retention period. It assigns an administrator to establish “protocols for access, collection, storage, and retention of ALPR databases and associated media.”

What this can mean in a Kentucky case

• Did the ALPR use occur on or after July 15, 2026?
• Was data older than 90 days used? If so, which subsection (4)(a) exception applied, and is it documented?
• Did the agency adopt and publish its written policy before deployment? Are the 90-day audits documented? See ALPR audit logs and search records.
• Before the stop, did an officer or dispatcher visually confirm that the plate matched the alert?
• Was the data shared, and under which exception in (4)(d)?
• Was the camera deployed by a private party, and for what purpose under (3)(a)?