License Plate Readers: What Defense Actually Works (2026)

A note on funding: CypherpunkGuide carries no surveillance advertising — no ad networks, tracking pixels, or sponsored content. It is funded by transparent streams: reader donations now; subscription and editorially-aligned affiliate later. We answer to our readers, not to advertisers.

A license plate is the one identifier the state requires you to display in public, bolt to your car, and drive past every camera on every road you use. For most of their history, the automated cameras that photographed those plates — automated license plate readers, or ALPRs: roadside and patrol-car cameras that photograph every passing plate, stamp it with a time and place, and store it in a searchable database — were a niche police tool. They are now a dragnet — a net that catches every car that passes, not just the ones under suspicion. Flock Safety, the fastest-growing vendor, crossed 100,000 cameras in 2026; layered over Motorola’s older Vigilant network and thousands of local systems, the result is a country where — wherever a reader is deployed — your car’s movements are recorded, timestamped, and retained by default, and where most states still have no law that specifically governs any of it.

The abuse is not hypothetical, and it is not rare. Officers keep getting arrested for using these systems to hunt the people they used to date. A Pennsylvania officer tracked his estranged wife more than 250 times. A Kansas police chief, according to the department audit that exposed him, ran an ex-girlfriend and her new partner through the cameras 228 times. A Milwaukee officer logged 179 searches on a girlfriend and her ex. Flock’s own chief legal officer, asked about misuse, told the surveillance-industry outlet IPVM that using the system to “figure out where an ex-girlfriend is” was “actually the most common thing.” The company selling the dragnet knows precisely what its most common abuse looks like.

So what can one person do about a camera they do not own, on a road they do not control? Most of the answers you will find are worse than useless. Plate covers, reflective sprays, and tilt brackets are illegal in much of the country and, independent testing shows, do essentially nothing against a modern reader. We pulled the affidavits, indictments, and prosecutors’ press releases behind more than a dozen of these cases and cross-checked each against a disconfirming search — dropping two widely-cited “ALPR” stories that turned out to be a covert GPS tracker and a camera misreading an innocent driver’s plate, not plate-reader abuse at all. What the verified record shows is that the defenses that actually lower your risk are almost the inverse of what the how-to articles rank first.

The table below is our own synthesis: not a vendor’s talking points and not a rehash of a single advocacy tally, but the cases we could tie to primary court records, read for the pattern the coverage skips.

Read across them and the controls reorder themselves. None of these women were reached because a clever disguise failed. They were reached because the person watching had a badge, a database, and no one reviewing the log — and that is a different problem than “how do I hide my plate” sets out to solve.

What an ALPR Network Actually Is

#

An ALPR network is not a camera; it is a searchable history of where your car has been. Each device is a passive sensor: it reads every plate in view, whether or not anyone is suspected of anything, and writes a row — plate, timestamp, GPS coordinate, often a photo of the vehicle and its surroundings — into a database that can be queried in seconds. String enough of them together and a single query returns a journey map: the route you drove, the times you left and returned, the church, clinic, union hall, or lover’s house you parked outside. The Electronic Frontier Foundation’s technical overview describes the core property plainly — ALPRs collect data on everyone, not just people under investigation.

Two features make this different from a beat cop noticing your car. The first is retention: readings are kept, so the surveillance is retroactive. A search run today can reconstruct where you were last month. Retention limits, where they exist at all, run from three minutes in New Hampshire to 21 days in Washington to 60 days or more elsewhere, and in most states there is no cap. The second is networking: one town’s cameras are routinely searchable by agencies in other states. In 2025, EFF and the ACLU documented San Francisco police running more than 1.6 million searches shared out of state, some tied to immigration enforcement — searches the department’s own policy did not authorize. Congress’s research service has catalogued the resulting legal gaps; the short version is that the technology outran the law by about a decade.

Retention is where that gap is widest, and it is worth seeing how little of the country caps it at all:

The Abuse Is the Pattern, Not the Exception

#

The single most important fact about license-plate surveillance is that its most common documented misuse is not catching criminals — it is officers tracking women. That is not an activist’s framing; it is the vendor’s. When we set the court records side by side, the same story repeats across states: a current or former officer uses a system built for public safety to follow an intimate partner, an ex, or a woman he has fixated on.

That detail — the log did not catch him, the victim did — recurs almost everywhere. In Georgia, a chain of departments only surfaced misuse after adopting Flock’s audit tooling and actually looking: Braselton in November 2025, then Coffee County, Cherokee County, and Albany by July 2026 — four agencies in eight months, once someone finally reviewed the records. Not every one of these was ex-partner tracking; what they share is that an audit, not the system itself, is what caught them. The lesson is not “audit logs make you safe.” It is the opposite: a log that no one reads is a record of the crime, not a defense against it. Anyone who tells you the system is safe because it is “fully audited” is describing a smoke detector with the battery removed.

The scale is genuinely uncertain because the tally keeps climbing. The Institute for Justice’s Plate Privacy Project has been logging these police-stalking cases for years, and the count has only grown as more departments audit and more victims ask. Our own floor — the officers we could tie to guilty pleas, convictions, or active criminal charges — runs to a dozen, across seven states, and it is only a floor: new cases surfaced almost every month through 2026. Treat every specific number as a snapshot that will be out of date by the time you read it, and the pattern as permanent.

A caution that cuts the other way, because credibility requires it: not every dramatic “plate reader” story is one. A widely-shared California stalking case involved a covert GPS tracker, not ALPRs; another viral “Flock” incident was the system misreading an innocent woman’s plate and nearly getting her wrongly charged — a real harm, but a different one. Precision here is not pedantry. If you defend against the wrong mechanism, you spend your effort in the wrong place — the same failure the surveillance sells you when it promises a plate cover will help. For how scattered records get fused into a single profile in the first place, see our guide to AI-scale deanonymization.

The Gendered Layer: When the Watcher Knows Where She Sleeps

#

A license-plate dragnet is not experienced equally, because being findable is not equally dangerous for everyone. For a woman leaving an abuser, a person seeking reproductive care in a hostile state, or an activist a government dislikes, a system that turns a plate into a location is not an abstract privacy concern — it is the exact capability their threat model is built to deny. And it is precisely these people the record shows getting tracked.

The reproductive-care case is now documented in detail. In 2025, EFF revealed that a Texas sheriff searched more than 83,000 cameras nationwide to find a woman who had a self-managed abortion, using a “missing person” pretext. Washington’s response was to write the harm directly into law: the state’s 2026 Driver Privacy Act (SB 6002) bans using ALPR data for immigration enforcement and for tracking people seeking reproductive health care. When a legislature has to specifically prohibit using plate cameras to hunt abortion patients and immigrants, it is telling you what the cameras were already being used for.

This is why the intimate-partner cases are the center of the story rather than a lurid sidebar. The officers who tracked their exes were not exploiting an obscure flaw or writing custom code; they were using the system’s ordinary search box — no technical exploit required — for exactly the misuse its own vendor calls most common. For a survivor, the relevant fact is brutal in its simplicity: if your abuser has a badge, or a friend with one, the dragnet already knows your new commute. No plate cover changes that. What changes it is severing the link between the car and you, and using the legal machinery that lets you find out who has been searching — both covered in the defense section below, and both boring, which is why almost no one sells them to you.

What Actually Works: A Defense Matrix by Effectiveness

#

The honest ranking of individual defenses is close to the reverse of what most guides publish. The measures that get top billing — physical gadgets that “block” the camera — are the least effective and the most likely to be illegal. The measures that actually move your risk are legal, structural, and collective, and they are boring enough that the affiliate-driven listicles skip them. Here is the ranking the evidence supports, worst to best:

Start at the bottom, because that is where the leverage is. Political action is not the consolation prize; it is the highest-yield defense. Communities are canceling ALPR contracts in real numbers — by mid-2026, dozens of cities had dropped Flock over unauthorized federal and out-of-state data sharing, many after residents showed up to a council meeting with the audit records in hand. The ACLU’s “Get the Flock Out” toolkit exists precisely because this is the intervention that scales: one persuaded city council protects every driver in town in a way no personal gadget can — though never quite permanently. A later council can switch the cameras back on, as Richmond did in 2026 after a pause, which is why a cancellation is a fight you win and then keep.

Next, your legal rights, which are real but need managing expectations. In California and a growing list of states you can file a public-records request for a department’s ALPR policy and usage audits, and — where the law provides it — request the deletion of data about you. The catch, documented in ongoing litigation, is that Flock often characterizes itself as a mere “service provider” and routes individual requests back to the city, which may or may not act. Use the right; do not assume it is self-executing. California’s attorney general has sued at least one city over illegal data sharing, which is a reminder that enforcement, when it comes, tends to come from officials and courts rather than from individual opt-outs.

The one structural move an individual fully controls is the most effective personal defense on the list: break the link between the car and your identity for the trips that matter. A car-share vehicle, a rental, or a ride you do not own produces a plate that leads somewhere other than you. It will not hide your daily commute, but for the sensitive trip — the clinic, the shelter, the meeting — it is the difference between a plate that names you and one that does not. It is the vehicular version of the same principle that runs through the whole Sovereignty pillar: change the infrastructure, not just the behavior.

What is left is the row everyone starts with and should end with: physical obfuscation does not work and can get you fined. RadarTest’s independent review of reflective plate products found no measurable effect against modern readers, which combine infrared and visible-light capture with automatic exposure; meanwhile plate covers and sprays are explicitly illegal in California, New York, Florida, and elsewhere. You would be paying to break the law in exchange for nothing.

The Limits of Individual Defense

#

Against a passive, networked, retroactive dragnet, individual technique is necessary and insufficient at once. This is the limit the affiliate guides never state plainly, and stating it is the whole point of this article. You can rent a car for the clinic run and file your deletion requests, and you should. You cannot, alone, un-network a hundred thousand cameras, revoke another state’s access to your city’s data, or make a system that already recorded last month’s movements forget them. The reader that photographed your plate this morning did not care who you are, and no amount of personal cleverness reaches back to unmake the record.

The cases say so when you read them as a set. The victims who were tracked did not make an OPSEC mistake; a person with authorized access simply pointed the system at them. What actually moved those situations was not a gadget but the audit that got read, the reporter who published, the council that canceled the contract, the legislature that wrote a retention limit — the lever cypherpunks have always named, where personal defense meets institutional power and hands the rest to collective action. The Supreme Court has begun to signal that long-term, aggregated location tracking raises constitutional questions the dragnet’s operators would rather avoid; that pressure is built by lawsuits and legislation, not by tilting your plate. This is the same conclusion our study of state-mandated identity systems reached from the other direction: the durable fix is upstream, in the rules, not downstream, in the individual’s toolkit.

A license plate is the precise inverse of that power: an identifier you are forced to reveal to every camera, whether you consent or not. Defend the individual trip where you can — and then push on the conditions, because the vendor that calls stalking its “most common” use will not cap its own retention out of beneficence.

Bottom Line — Which Defense Matches Your Risk

#

There is no single answer, because the right defense depends entirely on who might point the system at you and how much it would cost you if they did.

• If you are an ordinary driver who dislikes being tracked: skip the gadgets entirely, and spend the same energy on the one thing that scales — a records request to see your local department’s ALPR policy, and a message to your city council. Your leverage is political, not technical, and it protects your neighbors too.
• If you are leaving an abusive partner — especially one with law-enforcement access: assume the dragnet already knows your routine, and defend the sensitive trips by not driving a car registered to you. In parallel, use your state’s data-access rights to find out who has been searching your plate; in the documented cases, that request is what exposed the officer.
• If you are an activist, journalist, or organizer: treat your vehicle as a beacon and plan around it — car-share to sensitive meetings, and pair this with the identity and infrastructure discipline in our activist doxxing defense guide, because the plate is only one of the signals that places you.
• If you are seeking reproductive or immigration-sensitive care in a hostile state: the threat is documented and specific. Do not drive your own car to the appointment, know your state’s retention and sharing rules before you go, and support the legislation — like Washington’s — that bans these searches outright.

Across all four, the same truth holds that held in every surveillance failure before it: you cannot out-gadget a dragnet. You can lower your exposure on the trips that matter, exercise the legal rights that force the system into the light, and — past the limit of what one person can do — act with others to take the cameras down.

Frequently Asked Questions

#

How do I defend against license plate readers?

#

Not with gadgets. Plate covers, reflective sprays, and tilt brackets are illegal in many states and do essentially nothing against modern readers. The defenses that work, in order of effectiveness, are political (push your city to cancel or cap its ALPR contract), legal (file public-records and data-deletion requests under your state’s law), and structural (for sensitive trips, drive a car that is not registered to you, such as a car-share or rental). Against a passive, always-on dragnet, lowering your exposure on the trips that matter and changing the rules through collective action beat any personal device.

Are license plate covers or reflective sprays legal — and do they work?

#

Generally no on both counts. Products marketed to “block” ALPR cameras — covers, reflective sprays like PhotoBlocker, infrared film — are explicitly illegal in California, New York, Florida, and other states, where a violation can run to roughly $2,000 once state assessments are added. Independent testing, such as RadarTest’s, found no measurable effect against modern readers, which use combined infrared and visible-light capture with automatic exposure. You would be paying to break the law in exchange for no real protection.

Can I get my license plate data deleted or find out who searched it?

#

Sometimes, depending on your state. In California and a growing number of states, you can file a public-records request for a department’s ALPR policy and usage audits, and where the law allows it, request deletion of data about you. In several documented stalking cases, a victim’s request to see who had searched their plate is exactly what exposed the officer. The limitation is that vendors like Flock often call themselves a “service provider” and route individual requests back to the city, which may not act — so treat the right as real but not self-executing.

How long do police keep license plate reader data?

#

It varies enormously and is usually uncapped. Among states with limits, retention runs from three minutes in New Hampshire to 21 days in Washington to 60 days or more elsewhere, but most states have no ALPR-specific retention law at all, meaning data can be kept and searched retroactively for months or years. Because the records are retained and networked across jurisdictions, a search run today can reconstruct where a car was weeks ago — the property that makes the technology a surveillance tool rather than a real-time alert.

Is Flock Safety legal?

#

Operating ALPR cameras is legal in most of the United States, but specific uses and data-sharing arrangements are increasingly being challenged as unlawful. By mid-2026, Flock faced class-action lawsuits, a state attorney general’s suit over illegal out-of-state data sharing, congressional scrutiny, and dozens of canceled city contracts after audits revealed unauthorized federal and cross-state searches. “Legal to deploy” and “legal in how it is actually used” have turned out to be very different questions.

Cora Aegis

Cora Aegis writes privacy-first OPSEC guidance at CypherpunkGuide, reading the primary records for the mechanism most coverage skips — here, how a plate you are required to display becomes a searchable map of your life, and which defenses against it are real.

More about Cora →