The surveillance infrastructure tracking American drivers has grown far more sophisticated than most people realize. What began as simple plate-logging technology has evolved into AI systems capable of identifying faces, flagging unusual travel patterns and building detailed movement profiles -- all without the knowledge of the people being watched. Companies such as Flock Safety now operate in communities across 49 states, and their data is accessible to thousands of law enforcement agencies, including federal immigration enforcement, according to civil liberties groups. State legislatures are among the few institutions actively writing rules around how these systems can be used, and what those rules say (or don't say) have real consequences for your privacy on the road.

That raises a large question: What are the best privacy protection laws? I wanted to provide more details for anyone wondering what to support or what their state is currently doing. One challenge is that every state is different, and there's no clear guide on what privacy laws work and which have flaws.

I spoke to Chad Marlow, senior policy counsel and lead for the American Civil Liberties Union's surveillance work, to find the best examples. These laws are making the biggest difference in our privacy. 

"Collective action, rather than individual action, is required," Marlow told me. "I would caution that while Flock is the most problematic ALPR company in America, there are many other ALPR companies, like Axon and Motorola, that present serious privacy risks, so switching from Flock to Axon/Motorola ALPRs at best may constitute minimal harm reduction, but it is far from a solution."

Which of today's laws are a better solution? This is a "throw everything against the wall and see what sticks" situation. Let's talk about what's sticking. 

The best laws on the books for limiting new surveillance technology

Current privacy laws focus on two recent capabilities of local law enforcement: ALPRs, or automatic license plate readers, that can identify and track cars, and drone surveillance equipped with AI cameras. Security companies, such as Flock, are also starting to offer more traditional cameras that can provide live views and track people from the ground.

With AI features like Flock's "Freeform" technology that let police enter any type of search they like to see what cameras bring up, these are powerful tools, and new legislation is required to address them. Let's go over several categories of laws that make a difference. 

Laws restricting the use of AI detection features

Some of the broadest laws tackle what AI cameras are allowed to do at all. These laws don't specifically target ALPR cams or drones, but they do limit the searches that police and commercial entities can make. 

Illinois has long been the best example of these privacy laws with its BIPA, or Biometric Information Privacy Act that protects personal ID like fingerprints and facial data, and requires written consent if a company wants to use them. 

That law is so far-reaching that certain camera features like Google Nest's Familiar Faces technology is completely blocked in Illinois, along with some of Flock's recognition features. Cities can pass similar legislation, too: Travel to Portland, Oregon and you'll find that certain facial recognition features won't work there, either. 

The one issue with laws like these is that they don't include license plate and vehicle data, at least not yet. That information, which is closely tied to your name and address, needs to be protected by additional legislation or added onto existing biometric laws. So far, the former is more common: California is the only state I've noticed that now includes ALPR data as "personal information" for its privacy laws. 

Laws that ban what details police cameras can see

States are also passing new types of laws that allow the use of ALPR cameras, but ban those cameras from being able to record and pass along personal information, or at least make that information confidential in some way -- including Florida and New Hampshire. 

These laws can ban cameras from seeing details like the people inside a car, for example, limiting them only to a license plate. Companies like Flock advertise the ability of their cameras to notice other descriptive details above a vehicle such as bumper stickers or roof racks, so laws like these can hamper the use of such AI detection. 

In a related note, states may add stricter authorization steps for police cameras. For example, rules that require the police chief to sign off on any search using ALPRs make it less likely that the data is misused when collected.

Laws that limit the use of ALPRs to certain police activities

A number of states have created laws that allow the use of license plate and AI cameras, but only for specific purposes, such as ongoing investigations involving a murder or kidnapping. Some states have very strict limits on how these cameras can be used, while others have much broader descriptions. 

Laws like these keep ALPR cameras out of the hands of businesses, HOAs and similar organizations, who would otherwise be able to contract with companies like Flock Safety. They may also block cameras from being used in certain areas, such as on public highways. 

Laws requiring that any data collected by cameras be deleted within a certain timeframe

One of the most effective surveillance laws for protecting privacy is the requirement to delete any footage caught by these cameras unless its actively being used in a confirmed investigation. That means police can't make unauthorized searches or share that data with outside organizations after a certain time.

Laws like these also prevent police departments from creating long-term files about people they want to keep an eye on and note their routines and behaviors. As Marlow said, "The idea of keeping a location dossier on every single person just in case one of us turns out to be a criminal is just about the most un-American approach to privacy I can imagine."

New Hampshire has the most stringent laws here, requiring the collected data to be deleted within 3 minutes if not used, a far shorter timeline than most, but one the ACLU agrees with.

"For states that want a little more time to see if captured ALPR data is relevant to an ongoing investigation, keeping the data for a few days is sufficient," Marlow told me. "Some states, like Washington and Virginia, recently adopted 21-day limits, which is the very outermost acceptable limit." Marlow warned that the longer police keep this data, the easier it is to build patterns of life "that can eviscerate individual privacy." 

I've also seen states with laws that require ALPR data deleted after several years, but at that point it's largely useless, as the data could easily be compiled and moved to other platforms by then. 

Laws banning police from sharing data outside of the state

States like Virginia and Illinois have passed laws making it illegal to share any ALPR or related data outside the state, including with federal agencies. These laws are typically targeted at the Department of Homeland Security and ICE, which (along with the FBI and other agencies) have been known to request data from local police Flock cameras or be granted backdoor access to Flock search systems. 

Laws that keep data from going out of state prevent that -- as long as there are ways to track data transmission and enforce the law -- which is difficult. "Ideally, no data should be shared outside the collecting agency without a warrant," Marlow said, "But some states have chosen to prohibit data sharing outside of the state, which is better than nothing, and does limit some risks."

States like Minnesota have also added requirements to make ALPR searches public so that citizens can check what searches the police have made, an important step for accountability that's still rare for this technology.

Laws requiring state approval and office certifications for any ALPR camera

There's another option to manage these high-powered cameras -- subject them to an approval process by the state before contracts and installation. The tricky part is that approval process can look completely different depending on the state. 

In Texas, for example, a license is required but these seem relatively easy to obtain -- although not everyone has followed that law. 

Vermont, however, enacted a series of laws to create a lengthy approval process to ensure ALPR cameras could only be used in certain circumstances and that the data was tightly controlled. This approval process was so thorough that local organizations decided to pass altogether: By 2025, no law enforcement agency in the state was using ALPR cams.

Laws requiring warrants before launching surveillance drones

In the past year, I've seen a new concern on the rise in neighborhoods in addition to ALPR cameras. There are now surveillance drones equipped with cams that can recognize vehicles or human features (beards, hats, shirt colors and so on) and follow people automatically. Those have required a further set of laws to address. 

States including Alaska, Idaho, Utah and Texas have laws specifically requiring a warrant before drones are used for surveillance. Technically, this should prevent the use of Flock's automatic drone launches for things like gunshot detection or 911 calls, but local law enforcement appears to have found ways around these laws due to exemptions and other loopholes.

It's worth noting my state nearly nuked its drone warrant requirements with new legislation in 2025, which ultimately failed to pass, a reminder that the rules are always up for change.

Keep an eye on the legislation in your state

New laws are subject to frequent challenges, including companies such as Flock or local police departments outright ignoring them. That requires extensive legal action to address and a buildup of case law that can take years, not mention methods of investigation and enforcement by the state that may not currently exist. 

Proposed legislation can also be subject to many changes, even if it's likely to be passed, so the details can shift. That means if you want to see specific bans or privacy requirements in your state, you should track ongoing legislation as it passes through approval stages, and continue to contact your senators and representatives.

If you're not sure what's in a law, it's important to read it carefully or find analysis by a legal expert to learn more. Many lesser laws I didn't include on this list have lots of carveouts, exceptions and latitude in how surveillance cameras can be used, rendering them fangless for privacy purposes.

But that's not all you can do. I've also seen the rise of advocacy initiatives like The Plate Project from the Institute of Justice that you can join, contribute to or just read up on to do more. And don't forget about the local level -- voicing concerns at a city council forum could help limit surveillance contracts before they even begin. 

For more information, check out if your landlord can watch you with a security camera, and if it's legal to record audio and video in your own home.