A Virginia prosecutor’s recent decision not to charge a police officer for sharing license plate reader data with federal authorities without authorization could spur reform efforts in the commonwealth.

Automated license plate readers, commonly used to identify vehicles and investigate crimes, have drawn criticism over privacy concerns and alleged misuse, sparked disagreement over how they’re used by authorities, and forced local governments to reconsider contracts.

Under state law, law-enforcement agencies may share data obtained through ALPR systems under certain circumstances. The statute prohibits sharing or disseminating the data to “any database of any other state, federal, private, or commercial entity.” 

The statute does not, however, expressly prohibit sharing or disseminating the data directly to out-of-state or federal law-enforcement officers.

Although the recent data-sharing case in Isle of Wight was intended to support an investigation, Senate Majority Leader Scott Surovell, D-Fairfax, said localities should face penalties if they don’t share data the right way. 

“I think there needs to be consequences for localities that improperly share data,” Surovell said after Thursday’s crime commission meeting, adding that some law enforcement agencies have not followed the laws governing ALPR use that took effect July 1, 2025.

Nearly 13% of law enforcement agencies using ALPR systems in the state reported providing continuous access to out-of-state law enforcement, and nearly 6% reported providing continuous access to federal law enforcement, according to the crime commission’s 2025 survey 

About 30% of the 361 total agencies did not respond to the survey. None of the agencies were identified in the survey results.

Of the 361 law-enforcement agencies surveyed, around 70% responded (251), and 44% (159) reported using ALPR technology. 

Among those agencies, 20% reported retaining ALPR data for longer than the law’s general 21-day limit. State law allows data to remain if it’s needed for an ongoing investigation, prosecution, or civil action until the investigation concludes.

ALPRs are different from automated speed enforcement and red-light enforcement cameras that capture speeding vehicles or vehicles entering intersections after the traffic signal turns red and issue citations.

ALPRs in practice

One of the most high-profile instances of ALPR use in the state came in 2015, when Virginia law enforcement used the technology to help find the gunman who shot two journalists in Roanoke during a live broadcast and then fled three hours away to Northern Virginia.

Nationally, similar cases show how ALPRs have been used to improve and solve investigations. 

But Chris Kaiser, policy director for the ACLU of Virginia, said claims that ALPRs help solve cases are hard to assess because it is often unclear whether the technology actually made a difference.

More importantly, Kaiser warned, Virginia’s ALPR safeguards may not prevent unauthorized out-of-state access, and the cloud-connected system could expose statewide data if one agency fails to comply, raising broader privacy and oversight concerns.

“If one agency or even one officer allows unauthorized access to the system, that means the whole state’s set of data is compromised,” Kaiser said.

He also argued that ALPRs enable broad, warrantless surveillance that threatens privacy and can negatively impact people’s activities, while evidence that they significantly improve crime-solving is weak.

Last year, House Majority Leader Del. Charniele Herring, D-Alexandria, carried legislation that allowed the use of license plate reader systems, like those operated by Flock, by establishing statewide approval, restricting police use of ALPR technology, requiring documentation and reporting and creating oversight to monitor use and accountability.

The measure was signed into law by Gov. Abigail Spanberger earlier this year.

Under the new law, the system’s uses are limited to investigating suspected criminal violations when there is reasonable suspicion that a crime occurred, investigating missing or endangered persons or people associated with human trafficking, and receiving notifications involving missing or endangered persons, outstanding warrants, human trafficking, stolen vehicles, or stolen license plates.

Data may be shared with other Virginia law enforcement agencies, commonwealth’s attorneys, a criminal defendant or their counsel, or their ALPR vendor.

ALPR data may also be shared if officers receive a court order or court-issued subpoena, or to alert the public to an emergency situation, a missing or endangered person, a person associated with human trafficking, or a person with an outstanding warrant.

Herring, chair of the crime commission, nor her office responded to multiple requests for comment about the use of ALPRs in Virginia since the law was passed. 

Notable cases

Police departments in Richmond and Smithfield are among the most prominent agencies to share data from their Flock system, which has received the most public attention.

Recently, Isle of Wight Commonwealth’s Attorney Georgette Phillips said her office would not bring any charges against the Smithfield police officer, who shared data from its ALPR system with the FBI, which was investigating the March 12 shooting at Old Dominion University that killed one person and injured several others.

Phillips wrote to the Mercury that the officer was not found in violation because the officer had no criminal intent to violate the statute after the department was contacted to assist with the investigation.

She said the department was contacted after the investigation determined a resident purchased the firearm used in town.

“A law-enforcement agency may share system data with another law-enforcement agency as part of a criminal investigation of Virginia Code,” Phillips said.

The attorney said the department now knows about the prohibition on sharing system data with federal law-enforcement partners and has implemented additional safeguards to prevent future incidents.

In an Oct. 12 statement, town leaders emphasized that the officer shared the information for a legitimate investigative purpose.

“However, a legitimate purpose does not remove our responsibility to understand and follow the requirements governing that information,” the statement added.

The town’s authorities said that when the information was shared with the FBI, the department believed the FBI was included in the definition of law enforcement agencies. However, the town later learned that was not the case and that it requires a court order or subpoena before it can share this information with the FBI.

“Since this issue was identified, we have taken steps to ensure our officers understand the statute’s restrictions on sharing license plate reader data, including the requirements that apply to requests from federal and out-of-state agencies,” the  statement read. “We have reinforced the expectation that officers seek guidance before releasing information whenever there is uncertainty about what the law permits.”

A similar data-sharing case occurred in the city of Richmond earlier this year when a police sergeant shared data with the FBI on a homicide investigation. 

On Oct. 10, Richmond Mayor Danny Avula said the city would not renew its contract with Flock Safety for ALPRs, citing public concern over surveillance, data privacy, and police access to vehicle-tracking information. The city has not decided, however, to abandon license plate reader technology altogether.

What’s next

The Virginia State Crime Commission is expected to submit results of a statewide survey detailing the use of ALPR systems to lawmakers by Nov. 1. 

Lawmakers will return to Richmond in January to discuss related legislation. Some lawmakers, including Sens. Lashrecse Aird, D-Henrico, and Glen Sturtevant, R-Chesterfield, have publicly expressed interest in banning the readers, signaling bipartisan interest in further action. Others have called for more transparency.

No legislation has yet been filed as of Thursday afternoon.

Following the Smithfield Police case, Aird said Virginia’s rules already restrict sharing license plate reader data, but the decision not to prosecute raised doubts about whether the rules would be enforced and strengthened the case for banning the technology. 

“There really is nowhere to go from there, but to revoke the use of the technology,” she said.