Skip to content
Submit incident
AII-1001-13877
ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.Supporting sources are pending verification.

Virginia Police Departments Violate ALPR Data Retention and Sharing Laws

The Virginia State Crime Commission reported in January 2026 that multiple police and sheriff's departments were violating state laws governing automatic license plate reader data, including sharing data with out-of-state and federal agencies and retaining information beyond the 21-day legal limit. The report found that 26 agencies lacked formal ALPR policies and 55 conducted no public awareness efforts, despite statutory requirements.

January 2026 Β· Virginia Police Departments Β· Privacy and surveillance
January 2026
AII-1001-13877
Quick facts
Category
Privacy and surveillance
Country
United States
Date
January 2026
Drafted by
Raidu Incident Detection

What happened

The Virginia State Crime Commission published a January 2026 report on law enforcement use of automatic license plate readers (ALPR), finding widespread violations of the state's ALPR statute that took effect July 1, 2025.

Twenty law enforcement agencies reported providing continuous access to ALPR data to out-of-state agencies, and nine provided continuous access to federal agencies, despite the statute's prohibition on sharing data outside Virginia law enforcement, prosecutors, defense attorneys, vendors, and court orders.

Thirty-three agencies admitted to retaining ALPR data beyond the 21-day legal limit, with some retaining data for up to 60 days for fixed cameras, 180 days for mobile cameras, and 30 days for portable units.

Twenty-six agencies reported having no formal ALPR policy at all, fourteen had policies still in progress, and fifty-five reported zero public awareness measures, despite statutory requirements for formal policies and public awareness efforts.

Reported impact

Nearly one-third of Virginia's 361 law enforcement agencies did not respond to the state's mandatory compliance survey, leaving their ALPR use unknown and unverified.

Legislators indicated that violations of the ALPR statute, including data sharing and retention violations, are classified as misdemeanor offenses under Virginia law.

Index analysis

The violations represent a systematic failure of oversight despite the statutory framework that took effect in July 2025 after negotiations between public safety and privacy advocates.

The Virginia Association of Chiefs of Police executive director acknowledged that survey language and statutory language may need clarification, suggesting ambiguity in implementation guidance despite formal requirements.

Governance controls

Delegate Charniele Herring, the lawmaker who sponsored the guidelines, was set to send letters to agencies whose survey responses indicated non-compliance with statutory requirements.

The Virginia State Crime Commission stated that measures would be taken in 2026 to address the compliance issues identified in the report.

Classification

Category
Privacy and surveillance
Industry
Government, security and defence
Country
United States
Harm status
Potential harm
Intent
Unintentional
Timing
Post-deployment
Harm types
Human or fundamental rights, Public interest
Harmed
General public
Regulations
GDPR (cited)

Sources and evidence

Sources not yet published

This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.

How sources are verifiedSuggest a source for this incident