The Electronic Frontier Foundation has taken its strongest position yet on automated license plate readers, the camera systems mounted on police cars, traffic lights, and toll booths that scan and log every passing vehicle. In a new policy statement, EFF argues that ALPR surveillance privacy risks cannot be solved through better rules or tighter data retention limits. The organization's position is blunt: eliminate the networks, because no configuration of an ALPR system removes the underlying danger of mass surveillance.

This is a notable shift in tone. Privacy advocates have spent years pushing for reforms like shorter retention windows, warrant requirements, and audit trails. EFF's new stance suggests those efforts, while useful as harm reduction, don't address the core problem: the technology itself is built to watch everyone, all the time, regardless of suspicion.

What ALPR Networks Track and Retain

Automated license plate readers use cameras and optical recognition software to capture a vehicle's plate number, along with the time, date, and GPS location of the scan. Many systems also photograph the vehicle itself and sometimes its occupants. A single reader can process thousands of plates a day, and networks of readers, whether run by police departments, private companies, or a mix of both, create a rolling record of where a car has been and when.

Unlike a single traffic camera capturing an isolated moment, ALPR networks are designed for aggregation. Data from one reader gets pooled with data from others, sometimes across cities or states, building a searchable history of movement. Retention periods vary widely by jurisdiction, and in many cases that data is shared between agencies or sold to private surveillance vendors, often with little public oversight into how long it's kept or who can access it.

Why EFF Says No Configuration Is Safe Enough

EFF's argument is that the harm isn't a byproduct of poor implementation, it's baked into the design. Because ALPR systems collect data indiscriminately, capturing every vehicle that passes rather than targeting specific suspects, the resulting databases become ready-made tools for tracking anyone once the data exists. Tightening retention rules or requiring warrants for searches might slow misuse, but the mass collection itself remains, and mass collection is what makes weaponization possible.

This is a meaningful distinction from the reform-focused proposals more commonly seen in legislative debates. EFF isn't asking for better guardrails around ALPR networks; it's asking for the networks to not exist in their current indiscriminate form. The group frames this as the only way to actually eliminate the risk rather than just manage it.

Who Is Most at Risk: Immigrants, Dissidents, and Targeted Communities

According to EFF, the populations most exposed to ALPR misuse are immigrants, political dissidents, and other targeted communities. A database that tracks every vehicle's movements can be repurposed to identify patterns, such as who attends a particular place of worship, who shows up at a protest, or who regularly visits an immigration attorney's office. Because the data is collected without individualized suspicion, it can later be searched retroactively for any purpose an agency or bad actor decides is worthwhile, long after the original justification for collection has faded.

This is the same dynamic privacy advocates warn about in digital contexts: data collected for one stated purpose often ends up used for another, especially once it's centralized and accessible to multiple parties. The risk isn't hypothetical misuse by a rogue individual; it's the structural reality that once a searchable movement history exists, it can be queried for reasons far removed from public safety.

How Physical Surveillance Connects to Digital Privacy Advocacy

Readers of vpn.social are familiar with the logic behind encrypted browsing and VPN use: minimizing the trail of data that can later be used against you. ALPR networks apply the same threat model to physical movement instead of internet traffic. Just as a browsing history can reveal sensitive details about a person's life, a vehicle location history can reveal where someone lives, works, worships, or seeks legal help, all without a single warrant being issued at the time of collection.

This connection matters because privacy wins in one domain don't automatically protect people in another. Earlier this year, Wisconsin lawmakers dropped a proposed VPN ban after public pushback, a reminder that privacy protections, even hard-won ones, remain fragile and require ongoing vigilance. The same principle applies offline. Defeating a VPN ban protects encrypted communication, but it does nothing to stop a license plate reader from building a movement profile on the very people who rely on that encryption to protect themselves elsewhere.

What This Means For You

Most drivers have no way to opt out of ALPR scanning; the cameras capture every plate that passes, without consent or notice. That makes this a policy and advocacy issue more than a personal technology choice. Still, there are ways to engage:

  • Learn how ALPR is used locally. Many police departments publish policies on retention periods and data sharing agreements, which are often available through public records requests.
  • Support policy advocacy. Organizations like EFF track legislative efforts around ALPR regulation and elimination, and public comment periods often shape outcomes.
  • Recognize the pattern. The same reasoning that drives VPN adoption, limiting the data trail available for future misuse, applies to physical surveillance systems. Staying informed about both digital and physical privacy fights helps close gaps that bad actors could otherwise exploit.

Final Thoughts

EFF's position on ALPR surveillance privacy risks reframes the debate away from technical fixes and toward a more fundamental question: should indiscriminate, searchable location tracking exist at all. Whether or not lawmakers adopt EFF's full elimination stance, the argument underscores a broader truth for anyone who cares about privacy: protections won in one arena, whether it's encrypted browsing or a defeated VPN ban, don't automatically extend to other forms of surveillance. Staying engaged across both digital and physical privacy fights is the only way to keep those gains meaningful.