A regional garage operator upgrading three facilities to gateless, plate-based entry this summer asked its integrator a simple question: does anyone need to sign anything for this? The integrator’s answer was less simple than expected. In California, and in a growing number of other states, deploying a system that reads and stores license plates is not just a procurement decision. It is a step into a specific, six-year-old privacy statute that most parking operators have never read — and that a general manager focused on lane throughput and payment reconciliation may not know applies to a parking garage at all.

That statute is California’s SB 34, codified at Civil Code sections 1798.90.5 through 1798.90.55. It has been in force since January 1, 2016. It was written broadly enough to cover the automated license plate recognition (ALPR) systems that toll authorities and police departments run — but also, explicitly, the plate-reading systems that a growing share of parking operators are installing to speed up entry and eliminate paper tickets. Six years on, with plate-based access control now standard in a lot of new PARCS deployments, more operators than ever meet the statute’s definition of an “ALPR operator” without having done anything to comply with it.

That gap matters more in mid-2022 than it did a year ago, for reasons that have little to do with parking specifically. A wave of new state privacy legislation, a Supreme Court decision that has put location data under a spotlight it hasn’t had before, and a parking industry that is adopting frictionless, camera-based entry faster than it is updating its privacy paperwork are converging on the same operators at the same time.

What SB 34 Actually Requires

SB 34’s core mechanism is a privacy-and-usage policy requirement. Any ALPR operator — defined as a person or entity that operates an ALPR system, with the statute’s own list of exclusions for certain transportation agencies — must implement a written policy governing its use of the data, and if the operator has a website, post that policy conspicuously on it.

The statute doesn’t leave “written policy” vague. It specifies what the policy has to cover, including: the authorized purposes for using the system and collecting the data; the job titles or descriptions of employees and independent contractors authorized to access or use the data, and how that access is monitored; a description of how the operator ensures compliance with its own policy, including training; a description of how the operator maintains data security; the length of time ALPR data will be retained, and the process for determining whether to retain it; and the circumstances under which the data may be shared with other people or entities, along with what protections apply to any shared data.

Nothing in that list requires the operator to be a law-enforcement agency. It applies to a private garage operator, a university, a hospital system, or a downtown parking authority — any entity that installs a plate-reading system as part of controlling entry to a lot or garage, whether the goal is limiting access to residents and monthly parkers or simply collecting a fee at the gate. Standard PARCS hardware that reads a plate at entry and matches it at exit to close out a ticketless transaction meets that description. So does a plate-based enforcement patrol vehicle used to check permit compliance in a municipal lot.

The Liability Isn’t Theoretical

SB 34 doesn’t rely on a regulator to enforce it. The statute gives any individual whose information was collected in violation of its terms the right to bring a civil action, and it sets minimum liquidated damages of $2,500 per violation — recoverable without having to prove any actual monetary loss, plus the possibility of punitive damages and attorney’s fees where a court finds a willful or reckless violation.

For a facility processing several hundred transactions a day, the arithmetic is not subtle. A garage operator who has never posted a privacy policy is not exposed because plate data was misused or breached — the statute’s remedy attaches to the underlying failure to have and publish a compliant policy in the first place, independent of whether anything has gone wrong operationally. That structure is unusual by the standards of most operational compliance obligations parking managers deal with, where the exposure typically follows from an incident. Here, the paperwork gap is the exposure.

Six years after the statute took effect, a fair number of operators that adopted plate-based systems well after 2016 — during the accelerated shift toward contactless, ticketless entry that picked up through 2020 and 2021 — appear to have inherited the compliance obligation along with the hardware, without anyone flagging that the two came bundled together.

Why This Summer Is Different

None of the above is new law. What’s new is the surrounding climate, and three threads worth watching are converging in the middle of 2022.

First, the technology itself is spreading faster. Frictionless, license-plate-based entry has become a default recommendation from PARCS vendors rather than a premium option, driven by demand for touchless transactions that started with pandemic-era hygiene concerns and has persisted because it also speeds throughput and cuts hardware maintenance. More lots and garages are collecting plate data today than were collecting it when SB 34 passed, in states well beyond California.

Second, other states are actively building their own comprehensive privacy frameworks this year. Utah’s governor signed the Utah Consumer Privacy Act in March, and Connecticut’s governor signed the Connecticut Data Privacy Act in May, joining California, Virginia, and Colorado as states with broad consumer data laws on the books, even though most of those laws don’t take effect until 2023. None of these general statutes is an ALPR law in the way SB 34 is — but each one further establishes that location-linked identifying data, which a stored, plate-matched vehicle record plausibly is, sits inside the kind of information state legislatures are now actively regulating. Parking operators evaluating a new markets footprint this year are doing so against a visibly moving privacy-law backdrop, not a static one.

Third, and more specifically, the Supreme Court’s decision overturning Roe v. Wade in late June has produced an unusually fast, unusually broad public conversation about what location-tracking data can reveal about a person’s movements — including data as mundane-seeming as where a vehicle has been parked. Attorneys and privacy advocates have been quick to note that any system logging a plate against a place and time is, functionally, a movement record, and that the appetite to scrutinize who holds that kind of record and how carefully has grown sharply in a matter of weeks. Parking operators are not the center of that conversation. But an operator that has never posted the privacy policy state law already requires is not well positioned to explain its practices if that conversation reaches its own facility.

A Patchwork, Not a Standard

California is not the only state with an ALPR-specific statute, and operators running multi-state programs should not assume SB 34’s specific structure travels. More than a dozen states already have some form of ALPR-specific law on the books, and the details diverge meaningfully: some apply only to law-enforcement or transportation-agency use, some (like California’s) reach private commercial operators directly, and retention periods, permitted-use lists, and enforcement mechanisms vary by state rather than following a single national template.

That divergence is the operationally important point for anyone managing plate-based systems across more than one jurisdiction. A retention or disclosure practice built to satisfy one state’s statute will not automatically satisfy another’s, and a policy written to cover a single-state footprint needs a fresh review — not a rename — before it’s applied to a facility in a different state. Operators should treat their state’s current statute, not a national summary, as the authoritative source, and revisit it periodically rather than assuming a policy drafted at deployment stays current.

What a Municipal or Multi-Site Operator Should Actually Check

For a parking authority, university system, or multi-site private operator reviewing exposure this summer, a few concrete steps do most of the work:

Confirm whether your system meets the statutory definition. If a system reads a plate, converts it to text, and stores or matches that text in any searchable form — including standard PARCS ticketless-entry hardware — it likely qualifies as an ALPR system under California’s definition, and equivalent definitions in other states with ALPR statutes tend to be similarly broad.

Check whether a privacy policy exists and is actually posted. Not drafted once and filed away — publicly posted on the operator’s website, where SB 34 requires it, and consistent with what the facility’s systems actually do.

Review the seven required policy elements against current practice, not against whatever policy language a vendor supplied at installation. Retention periods in particular tend to drift as software gets upgraded, and a policy that states a retention window the current system doesn’t actually enforce is itself a compliance gap.

Ask vendors directly what they retain, for how long, and who can access it. Most municipal and commercial plate-based systems run on vendor-supplied platforms, and the operator’s compliance obligation doesn’t transfer to the vendor just because the vendor holds the data.

Treat multi-state deployments as multiple compliance problems, not one. A policy that satisfies California law is a starting template, not a finished document, for a facility in a different state.

None of this requires new legislation or a court ruling to become relevant. The obligation already exists, has existed since 2016, and the population of parking operators it covers has grown substantially in the years since — largely without anyone in the industry treating it as a live compliance question rather than a legal curiosity.

Frequently Asked Questions

Does SB 34 apply to private parking garages, or only to government agencies?

It applies to both. SB 34’s definition of an ALPR operator covers any person or entity operating an ALPR system, including private parking garage and lot operators using plate-based access control or fee collection, not just police departments or transportation agencies. The statute makes an explicit reference to systems used to control garage or lot access and collect parking fees.

What counts as an ALPR system under California law?

Any system that captures a license plate image, converts it to text (typically through optical character recognition), and stores that information in a searchable format. Standard ticketless PARCS hardware that reads a plate at entry and matches it at exit to close a transaction generally meets this definition, even though it wasn’t designed as a law-enforcement surveillance tool.

What happens if a parking operator hasn’t posted a privacy policy?

SB 34 allows an individual to sue directly, with minimum liquidated damages of $2,500 per violation available without proof of actual harm, plus potential punitive damages and attorney’s fees for willful or reckless violations. The exposure attaches to the missing or noncompliant policy itself, independent of whether any data was actually misused or breached.

Do the new state comprehensive privacy laws, like Connecticut’s and Utah’s, replace ALPR-specific statutes like SB 34?

No. The 2022 wave of comprehensive consumer privacy laws regulates personal data broadly and operates alongside, not instead of, state-specific ALPR statutes. Most of these general laws don’t take effect until 2023, and none is a substitute for reviewing whether a plate-based parking system already triggers an existing ALPR-specific law like California’s.

Is there one national retention limit for license plate data collected at parking facilities?

No. Retention rules vary by state, and in states without an ALPR-specific statute, no dedicated retention limit may exist at all. Operators running facilities in multiple states should confirm the specific requirement in each jurisdiction rather than assume a uniform figure, and should build vendor contracts around the most restrictive applicable requirement where footprints overlap.

Further Reading from Authoritative Sources