wa-law.org > bill > 2025-26 > HB 2332 > Original Bill
The legislature finds that it plays an important role balancing the need to ensure public safety and an individual's right to privacy under both the federal Fourth Amendment to the United States Constitution and the broader protection of individual rights guaranteed by Article I, section 7 of the Washington state Constitution.
The legislature further finds that the dramatic expansion of surveillance technology across the country has demonstrated the need to establish sensible guardrails on the use of surveillance data collected from monitoring the location and travel of individuals, without a warrant, to ensure its use by law enforcement and other government agencies must not come into conflict with existing protections for Washingtonians and ensure that it is not being used for purposes prohibited under state and federal law.
The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.
"Agency" includes all state agencies and all local agencies.
"Audit trail" means all records of queries and responses in an automated license plate reader system, and all records of actions in which system data is accessed, entered, updated, shared, or disseminated, including the:
Location of cameras used as part of the automated license plate reader system;
Date and time of access;
Data elements used to query the automated license plate reader system;
Specific purpose for accessing or querying the automated license plate reader system, including the offense type for any criminal investigation;
Associated call for service or case number; and
Username of the person or persons who accessed or queried the system.
"Audit trail data" means all forms of data collected or generated by an automated license plate reader system for purposes of producing an audit trail.
"Automated license plate reader data" means all data collected by automated license plate reader systems including, but not limited to, global positioning system coordinates, location, date and time, speed of travel, photograph, license plate number, automobile characteristics, or other identifying information.
"Automated license plate reader system" or "ALPR" means a system, software, or computer algorithm, whether used independently or in combination with one or more mobile or fixed automated cameras, that is used to convert images of license plates into computer-readable data. An ALPR excludes automated traffic safety cameras that do not interface or interact with an ALPR system.
"Court order," "warrant," or "subpoena" means a court order as defined in RCW 43.17.420.
"Law enforcement agency" has the same meaning as in RCW 10.116.010.
"Local agency" includes every county, city, town, municipal corporation, quasi-municipal corporation, special purpose district, local housing authorities, or any office, department, division, bureau, board, commission, or agency thereof, or other local public agency including their respective employees and agents.
"State agency" includes every state office, department, division, bureau, board, commission, or other state agency, and their respective employees and agents.
"Watch list" means a list of license plate numbers to be compared against a license plate number obtained from an automated license plate reader system.
Except as provided for in this section, it is unlawful for any agency to access, operate, or use an automated license plate reader system or its associated automated license plate reader data.
An agency may access, operate, or use an automated license plate reader system and its associated data only for the following authorized purposes:
Any law enforcement agency may use an automated license plate reader system for the purpose of comparing captured automated license plate reader data with:
Data on any of the following watch lists maintained by either a federal or Washington state agency: The department of licensing, the state criminal justice information system, the federal bureau of investigation kidnappings and missing persons list, and the Washington missing persons list; or
License plate numbers that have been manually entered into a state or local automated license plate reader system database, upon an officer's determination that the license plate numbers are relevant and material to an investigation of a vehicle that is:
(A) Stolen;
(B) Associated with a missing or endangered person;
(C) Registered to an individual for whom there is an outstanding felony warrant; or
(D) Related to or involved in a felony.
b. Any parking enforcement agency may use an automated license plate reader system for the following purposes:
i. Enforcing time restrictions on the use of parking spaces; or
ii. Identifying vehicles on a watch list for impoundment or immobilization under a local ordinance enacted under RCW 46.55.240, provided the list includes only license plates of vehicles subject to that ordinance.
c. An automated license plate reader system may be used as a component of photo toll systems authorized by RCW 47.56.795 or 47.46.105.
d. Any transportation agency may use an automated license plate reader system for the following purposes:
i. Providing real-time traffic information to the public, traffic modeling, and traffic studies such as determining construction delays and route use; and
ii. Enforcing commercial vehicle systems at Washington state patrol enforcement sites and weigh stations.
It is unlawful for any agency, as described in RCW 43.17.425, to use an automated license plate reader system for immigration investigation or enforcement, or both, in accordance with RCW 10.93.160, or for any protected health care services under chapter 7.115 RCW, or to track or otherwise monitor activity protected by the Washington state Constitution and the first amendment to the United States Constitution.
It is unlawful for any agency to collect automated license plate reader data on the premises or immediate surroundings or access to or from facilities that provide protected health care, as described in chapter 7.115 RCW, or at facilities conducting an immigration matter as defined in RCW 19.154.020, schools, places of worship, courts, or food banks.
[Empty]
A positive match by an automated license plate reader system alone does not constitute reasonable suspicion as grounds for a state or local law enforcement officer to stop the vehicle. The officer shall develop independent reasonable suspicion for the stop or immediately confirm visually that the license plate on the vehicle matches the image of the license plate displayed on the automated license plate reader system and confirm by other means that the license plate number is on one of the lists specified in subsection (2)(a) of this section.
Automated license plate reader data collected by or on behalf of an agency, as authorized pursuant to section 3(2) of this act, shall not be used or shared for any other purpose and shall not be retained longer than 72 hours, with the following exceptions:
When retained pursuant to a valid, court-issued, probable cause felony warrant or subpoena, provided the data is deleted at the conclusion of the criminal or civil case. ALPR data may be shared in discovery in accordance with applicable court rules;
When retained for the purpose of parking enforcement, provided the data is deleted no later than 12 hours after collection;
When retained for the purpose of toll collection, for as long as such captured ALPR data is needed to support the assessment and collection of a toll pursuant to section 3(2)(c) of this act;
When retained for the purpose of traffic studies, provided the data is deleted no later than 30 days after collection;
When retained for the purpose of enforcing commercial vehicle systems, provided the data is deleted no later than four hours after collection; and
When retained for the purpose in section 3(2)(a) of this act for as long as such captured ALPR data is needed as evidence of specific unlawful conduct enumerated in section 3(2)(a) of this act.
An agency that uses an automated license plate reader system pursuant to section 3(2) of this act shall not:
Disclose, share, or permit access to automated license plate reader data except as required in a judicial proceeding;
Provide any other entity with direct access to the automated license plate reader system, except with other state or local agencies authorized to collect ALPR data under section 3 of this act. A third-party vendor providing ALPR services may directly access an ALPR system and data.
Any agency that uses a watch list pursuant to section 3(2) (a) and (b)(ii) of this act must ensure the watch list is updated no less than once every 24 hours.
An agency shall not sell, lease, rent, or purchase automated license plate reader data or audit trail data.
An agency may obtain privately held automated license plate reader data only pursuant to a valid, court-issued, probable cause warrant.
Automated license plate reader data is not subject to disclosure under the public records act, chapter 42.56 RCW, except such data may be used for bona fide research as defined in RCW 42.48.010 and does not include individually identifiable information.
Any ALPR vendor must provide technical controls preventing unauthorized data sharing, secondary transfer, or access by nonauthorized agencies, including federal civil immigration enforcement in accordance with this chapter.
If an ALPR operator accesses or provides access to ALPR data, the ALPR operator shall do both of the following:
Maintain a record of that access. At a minimum, the record must include all of the following:
The date and time the data is accessed;
Data elements used to query the ALPR system;
The username of the person who accesses the data and, as applicable, the organization or entity with whom the person is affiliated;
The purpose for accessing the data;
Require that ALPR data only be used for the authorized purposes in this act.
Any information obtained in violation of section 3 of this act is inadmissible in any civil or criminal case in all courts of general or limited jurisdiction in this state, except with the permission of the person whose rights have been violated in an action brought for damages under section 11 of this act.
By July 1, 2027, the attorney general shall develop and publish model policies on the use of automated license plate reader systems consistent with this act.
[Empty]
By December 1, 2027, any agency that uses an automated license plate reader system pursuant to section 3(2) of this act shall:
Adopt a policy governing use of the automated license plate reader system consistent with the model policies established under subsection (1) of this section and submit copies of the applicable policies to the attorney general; or, if the agency did not adopt policies consistent with the model policies, provide notice to the attorney general stating the reasons for any departures from the model policies and an explanation of how the agency's policies are consistent with the provisions of this act, and include a copy of the agency's relevant policies; and
Submit an annual report on its automated license plate reader system practices and usage to the appropriate committees of the legislature. The report must also be conspicuously posted on the agency's public website. The report shall include:
(A) The number of matches that resulted in arrest and prosecution;
(B) The number of stolen vehicles and stolen license plates recovered due to use of the system;
(C) The number of preservation requests and disclosure orders received;
(D) The number of times automated license plate reader data or audit trail data was shared with or accessed by another governmental entity and the identity of each of those governmental entities;
(E) The number of times automated license plate reader data was shared or accessed pursuant to a judicial warrant;
(F) Any changes in policy that affect privacy concerns;
(G) Results from the agency's internal audit of its ALPR system; and
(H) The total annual number of ALPR reads, hits, matches, and alerts.
b. Prior to or coincident with implementation of an automated license plate reader system, a local law enforcement agency shall take measures to promote public awareness on the use of such system.
After December 1, 2026, whenever an agency modifies or repeals any policies pertaining to the use of automated license plate reader systems, the agency shall submit notice of such action with copies of any relevant policies to the attorney general within 60 days.
By December 31st of each year, the attorney general shall publish on its website a report on the requirements of this section, including copies of the model policies, information as to the status of individual agencies' policies, and copies of any agency policies that depart from the model policies.
Each agency operating or accessing an automated license plate reader system shall maintain audit trail data documenting all access to and use of the system. Audit trail data must be retained for two years and must include, at a minimum:
The identity of each user and the date, time, and purpose of each system access or search;
Search term entered, where applicable;
Any export, download, or sharing of ALPR data; and
Any audit trail data generated by or made available through a third-party vendor providing ALPR services. Each agency shall ensure that all such vendor audit trail data is downloaded or otherwise obtained and retained by the agency in accordance with this section.
Each agency shall conduct an internal audit at least once each year to review:
All access to and use of the ALPR system, as reflected in the audit trail data; and
The agency's compliance with the data retention, purging, and sharing requirements established under this chapter and agency policy.
The state auditor has jurisdiction to audit agency compliance with this act.
Upon request by the state auditor, each agency shall furnish all materials necessary to support such an audit, including but not limited to:
ALPR audit trail data;
Internal audit reports; and
Any audit trail data provided by or made available through a third-party vendor providing ALPR services.
After completing an audit, the attorney general shall:
Issue findings of any noncompliance;
Make recommendations to achieve or restore compliance; and
Require corrective action as needed to ensure compliance with this act.
The legislature finds that the practices covered by this chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of this chapter is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.
Any person who willfully and intentionally queries, accesses, or uses an automated license plate reader system for a purpose not specifically authorized under this chapter, or who willfully and intentionally retains, sells, shares, permits access, or disseminates automated license plate reader system data or audit trail data in violation of this chapter, is guilty of a gross misdemeanor.
A person injured by a violation of this chapter may bring a civil action to recover any equitable, declaratory relief, or injunctive relief with respect to the violation; and recover all other appropriate relief, including monetary damages. The court may award to a person aggrieved by a violation of this chapter who prevails in an action brought under this section the costs of the action, including reasonable attorneys' fees.
If any provision of this act or its application to any person or circumstance is held invalid, the remainder of the act or the application of the provision to other persons or circumstances is not affected.
This act is necessary for the immediate preservation of the public peace, health, or safety, or support of the state government and its existing public institutions, and takes effect immediately.