Oregon License Plate Reader Laws

Status at a glance

When police may use ALPRs

Senate Bill 1516 became Oregon Laws 2026, chapter 77. It was approved by the governor and took effect March 31, 2026, under an emergency clause. Its ALPR sections (§§ 3 to 9) haven’t yet been given ORS numbers, so we cite the session law. The law starts from a prohibition: “a law enforcement agency may not use an automated license plate recognition system or captured license plate data” except as sections 3 to 9 allow (§ 4(1)). Permitted purposes (§ 4(2)) include identifying:

• a vehicle used to facilitate a crime or avoid apprehension, if the crime is an Oregon crime, a substantially equivalent out-of-state crime, or a federal crime where use isn’t contrary to listed Oregon laws restricting use of public resources for prohibited enforcement activities;
• a vehicle used to facilitate a non-traffic violation;
• a vehicle registered to a person with an outstanding criminal arrest warrant, with similar limits;
• “a vehicle that is associated with a missing or endangered person, including a person who is the subject of an Amber Alert or Silver Alert”; and
• uninsured or unregistered vehicles, plus parking regulation and secured-area access.

Retention: 30 days

Data “not related to a court proceeding or ongoing criminal investigation” may be retained “for no more than 30 days after the captured license plate data is collected” (§ 4(3)(a)). Data related to a court proceeding or ongoing criminal investigation may be kept “for the same period of time that evidence is retained in the normal course of the court’s business” (§ 4(3)(b)). Neither limit applies to the vendor audit information in section 6 (§ 4(3)(c)). See ALPR data retention and sharing.

Stops based on an alert

Before a traffic stop based on an alert, the officer or other authorized user “shall visually confirm that the vehicle’s license plate number, issuing state and other vehicle characteristics match the alert and that the traffic stop complies with agency policy and applicable law” (§ 4(6)). See ALPR alert traffic stops.

Hot lists and search logs

• Anyone adding an entry to a hot list must record the specific law enforcement purpose and the name of the person adding it (§ 4(4)(c)). See hotlists and alerts.
• Each search must be logged with the user identifier, the agency, the search inputs, the date and time, any case or reference number, the law enforcement purpose, and, for an investigation, “the specific type of crime or violation being investigated” (§ 4(5)). See ALPR audit logs and search records.

Sharing and private data

An agency may let other law enforcement agencies query its data (§ 5(1)). It may not give access to any government entity “not created pursuant to the Oregon Constitution, or the laws or regulations of this state,” except for a law enforcement purpose under the Act. Data provided that way must be limited to what is relevant and “may not include unrestricted or ongoing access” (§ 5(2)). Nothing in section 5 bars access required by a judicial subpoena or other compulsory court process (§ 5(3)). See can police search Flock data from other states?

The Act doesn’t regulate private systems directly. Police may request data from a private person or entity “provided that the law enforcement agency accesses or otherwise uses the data for a law enforcement purpose” (§ 4(7)).

Public records and discovery

Section 11 adds ALPR data collected by law enforcement systems to the conditional public records exemptions in ORS 192.345, as new subsection (44). Those exemptions apply “unless the public interest requires disclosure in the particular instance.” Redacted vendor audits must be disclosed. The new subsection also says: “Nothing in this subsection shall limit any right constitutionally guaranteed, or granted by statute, to disclosure or discovery in criminal cases” (ORS 192.345(44)(c)). See public records requests for ALPR.

Vendor audits, contracts and remedies

• Vendors must give agencies searchable monthly audits, and quarterly audits of searches run for other agencies. Agencies must publish results “within two days of receiving the audit” or have the vendor provide direct public access (§ 6).
• Agencies must publish ALPR policies before use. Vendor contracts must say the data belongs to the agency and that requests for it, “including through a judicial warrant, judicial subpoena or administrative subpoena,” go only to the agency (§ 7).
• Contracts signed before March 31, 2026 may run their term, but section 4 applies regardless (§ 8).
• A vendor may not access, disclose, sell, share or otherwise use the data, with narrow exceptions. If it does so intentionally or with gross negligence, the individual “may bring a civil action against the vendor for economic and noneconomic damages and equitable relief” (§ 9(2)). Anyone may sue to enjoin a violation (§ 9(3)).

The legislative digest says the bill authorizes civil penalties, but we found no civil-penalty provision in the enacted text. The only remedies we found are the vendor actions in section 9. The Act contains no suppression or inadmissibility rule.

Oregon’s broader constitutional protection

In State v. De Witt Simons, 375 Or 70 (2026), decided March 26, 2026, the Oregon Supreme Court held that the year-long warrantless monitoring of the defendant’s internet activity on a restaurant’s public Wi-Fi network, carried out by the business in coordination with police, was a search under Article I, section 9. It decided the case on the state constitution alone. The court explained: “What constitutes a search under Article I, section 9, differs from what constitutes a search under the Fourth Amendment to the United States Constitution.” Article I, section 9 protects “the privacy to which one has a right,” not just the privacy one reasonably expects.

The court also restated State v. Campbell (1988), which concluded that the government’s secret attachment of a radio transmitter to a car to monitor its movements significantly impaired the right to be free from government scrutiny. Simons isn’t an ALPR case. See mosaic theory.

What this can mean in an Oregon case

• Which § 4(2) purpose does the search log record, and what crime or violation type?
• For a stop on an alert, did the officer visually confirm the plate number, issuing state and vehicle characteristics first (§ 4(6))?
• Was data kept past 30 days, and was it tied to a court proceeding or ongoing investigation?
• Who added the hot list entry, and for what stated purpose?
• Was data shared with a federal or out-of-state agency, and was it limited to the law enforcement purpose?
• What do the agency’s published vendor audits show?
• Did the conduct occur on or after March 31, 2026?