Virginia License Plate Reader Laws

Status at a glance

Before and after 2025

According to the Virginia State Crime Commission, before the law took effect on July 1, 2025, “no statewide statutory or regulatory framework existed to govern law enforcement use of ALPR in Virginia.” The 2025 law, codified at § 2.2-5517, followed the Commission’s 2024 study. It applies to law enforcement ALPR use. It doesn’t cover systems used for traffic enforcement (including parking, speed and tolling), at DMV weighing stations, or for non-criminal-justice purposes (§ 2.2-5517(P)).

When police may use ALPRs

Under subsection D, a law enforcement agency may use a system only:

• as part of a criminal investigation “where there is a reasonable suspicion that a crime was committed”;
• as part of an active investigation of a missing or endangered person, or a person associated with human trafficking; or
• to receive notifications about a missing or endangered person, a person with an outstanding warrant, a person associated with human trafficking, a stolen vehicle, or a stolen plate.

All the information needed for an audit trail must be entered to query the data. Subsection L prohibits using a system to interfere with lawful activities or to track people based on lawfully protected speech.

Stops based on an alert

Subsection M says a notification “does not, by itself, constitute reasonable suspicion as grounds for law enforcement to stop a vehicle.” Before stopping a vehicle based on one, an officer must either develop independent reasonable suspicion or “confirm that the license plate or identifying characteristics of a vehicle match the information contained in the database used to generate the notification.” Agencies must also have procedures to confirm the accuracy of notifications before a stop, and the databases behind notifications must be updated at least every 24 hours (§ 2.2-5517(B)(4), (H)(3)–(4)). For the federal standard, see ALPR alert traffic stops.

Retention: 21 days

System data, meaning images, vehicle characteristics, and the date, time and location of reads, must be purged 21 days after capture so it is “destroyed and not recoverable.” Audit trail data is purged after two years. Data that is part of an ongoing investigation, prosecution or civil action is kept until the investigation ends without charges or the matter is finally resolved, including appeals and habeas proceedings (§ 2.2-5517(E)).

Sharing and public records

System data and audit trail data are not subject to disclosure under the Virginia Freedom of Information Act, can’t be sold, and can’t be shared with “any database of any other state, federal, private, or commercial entity” (§ 2.2-5517(F)). Sharing is allowed for listed purposes, including with:

• another law enforcement agency, for permitted purposes, if it complies with the section;
• the Commonwealth’s attorney;
• “a defendant or his counsel for purposes of complying with discovery or a court order in a criminal proceeding”;
• anyone, under a court order or court-issued subpoena duces tecum;
• the vendor, for maintenance; and
• the public, for emergency, missing-person and similar alerts.

Agencies must keep records sufficient for “discovery in criminal and civil proceedings, appeals, and post-conviction proceedings” (§ 2.2-5517(G)). Vendors must notify the agency when they receive a subpoena, search warrant or other third-party request for the data (subsections C and Q).

Audit trails, policies and reporting

• Audit trail. This records every query and access, including the date and time, the plate or other data used, the specific purpose and offense type, the associated case or call number, and the username (§ 2.2-5517(A)).
• Agency policy. Each agency must adopt a policy covering training, permitted purposes, confirming notifications before stops, internal audits “at least once every 30 days,” and retention, sharing and security (subsection H). It must publicly post the policy (subsection K). The Virginia State Police model policy says agency policies “may be more restrictive but shall not conflict with § 2.2-5517.”
• Annual reporting. Agencies report yearly to the State Police on cameras, databases, queries by purpose and offense type, and demographic data on people charged after queries (subsection I).

Penalties and inadmissibility

Willfully querying or using a system for an unauthorized purpose, or willfully sharing data in violation of subsection F, is a Class 1 misdemeanor (§ 2.2-5517(N)). Subsection O provides: “Any evidence obtained as the result of a violation of subsection D, F, L, or M is not admissible by the Commonwealth in any criminal or civil proceeding.” A defendant may still use such evidence.

This is a statutory rule, separate from the Fourth Amendment exclusionary rule and its exceptions (see exceptions to the exclusionary rule). We haven’t yet verified how Virginia courts have applied it.

What this can mean in a Virginia case

• Was the use authorized under subsection D? For a search, what reasonable suspicion was recorded, and what offense type?
• For a stop on an alert, did the officer confirm the match or develop independent reasonable suspicion first (subsection M)?
• Does the audit trail show the required fields?
• Was data kept past 21 days, and if so, on what basis?
• Was data shared outside what subsection F allows?
• Did the conduct occur after July 1, 2025, when the law took effect?

The statute expressly lets agencies share data with the defense for discovery. See requesting ALPR records in discovery.