Washington License Plate Reader Laws

Status at a glance

When agencies may use ALPRs

The law starts from a prohibition. Except as the section allows, “it is unlawful for any agency to access, operate, or use an automated license plate reader system or its associated automated license plate reader data” (sec. 3(1)). Law enforcement agencies may use a system to compare captured data with:

• listed databases: the Department of Licensing, the state criminal justice information system, the FBI kidnappings and missing persons list, the NCMEC list, and the Washington missing persons list; or
• plates or vehicle characteristics an officer determines are “relevant and material” to an investigation of a vehicle that is stolen, associated with a missing or endangered person, registered to someone with an outstanding felony or gross misdemeanor warrant, or related to a felony or gross misdemeanor (sec. 3(2)(a)).

Parking enforcement and transportation agencies have separate, narrower permissions. Agencies may not use ALPRs for immigration enforcement, for protected health care services, or to monitor constitutionally protected activity (sec. 3(3)). Agencies had to register their systems with the Attorney General within 180 days (sec. 3(5)).

Stops based on an alert

“A positive match by an automated license plate reader system alone does not constitute reasonable suspicion” for a stop. The officer must develop independent reasonable suspicion, or immediately confirm visually that the plate matches the image and confirm by other means that the plate is in one of the authorized databases (sec. 3(6)). See ALPR alert traffic stops.

Retention: 21 days

ALPR data “shall not be retained longer than 21 days,” with exceptions (sec. 4), including data:

• retained under a valid, court-issued, probable-cause felony or gross misdemeanor warrant or subpoena, or as permitted by court order, until the case ends; the section adds that ALPR data “may be shared in discovery in accordance with applicable court rules”;
• needed as evidence of the specific unlawful conduct listed in the authorized-use section; and
• for parking, traffic study and commercial vehicle purposes, with their own limits.

Sharing, private data and public records

• Agencies may not disclose, share or permit access to ALPR data “except as required in a judicial proceeding.” Direct system access is limited to other state or local agencies authorized under the law (sec. 5(1)).
• “An agency may obtain privately held automated license plate reader data only pursuant to a valid, court-issued, probable cause warrant” (sec. 5(4)). That covers data from private systems, such as HOA or business cameras. See private and HOA cameras.
• Agencies may not buy or sell ALPR data or audit trail data (sec. 5(3)).
• Vendors must default sharing settings to prevent unauthorized sharing, and may not change sharing permissions without the agency’s knowledge or consent (sec. 5(6)–(8)).
• ALPR data isn’t subject to disclosure under the Public Records Act, except for bona fide research without individually identifiable information (sec. 5(5)).

Places where collection is banned

Agencies may not collect ALPR data at or around facilities providing protected health care or conducting immigration matters, elementary and secondary schools, places of worship, courts, or food banks. That includes the buildings and immediately adjacent parking lots used primarily for those purposes (sec. 3(4)).

Inadmissibility, penalties and civil remedies

“Any information obtained from a knowing violation of section 3 of this act is inadmissible in any civil or criminal case in all courts of general or limited jurisdiction in this state,” except with the permission of the person whose rights were violated, in a damages action (sec. 6). Willful unauthorized use, retention or sharing is a gross misdemeanor (sec. 10). A person injured by a violation may sue for equitable, declaratory, injunctive and monetary relief, with attorneys’ fees for a prevailing plaintiff (sec. 11).

The inadmissibility rule applies to knowing violations of section 3. We haven’t yet verified how Washington courts are applying it.

Audit trails, policies and reporting

• Audit trail data must be kept for two years. It records the user, the date and time, the query data, the specific purpose and offense type, the case number, and the cameras accessed, plus every export or share. Agencies must download vendor audit data (sec. 8(1)).
• Agencies must audit themselves at least once a year (sec. 8(3)).
• The Attorney General must publish model policies by July 1, 2027. Agencies must adopt policies and begin annual public reports by December 1, 2027. The reports cover stops and arrests, sharing with other governmental entities, warrant-based access, audit results, and camera locations (sec. 7).

Before the law: Seattle’s practice

Seattle’s Office of Inspector General reviewed the Seattle Police Department’s patrol ALPR use for 2021–2022 under the city’s surveillance ordinance. It reported in September 2023 that SPD’s back-end system “automatically purges patrol ALPR data including scans and hits after 90 days,” in line with the city’s approved surveillance impact report. That review predates the 2026 law, which now sets a 21-day general limit.

What this can mean in a Washington case

• Was the use authorized under sec. 3(2)? Was the plate entered as relevant and material to a listed category of investigation?
• For a stop, did the officer develop independent reasonable suspicion, or confirm the plate and the database entry first (sec. 3(6))?
• Was data kept past 21 days, and under which exception?
• Did police obtain privately held ALPR data, and if so, under a probable-cause warrant?
• Was data collected at a location where collection is banned?
• Did the conduct occur on or after March 30, 2026?