Washington State spent years without a dedicated statute governing automated license plate readers. Local agencies and their vendors set their own retention windows, wrote their own use policies, and answered to whatever general public-records and surveillance-oversight rules already existed — not to anything written specifically for ALPR. That changed in 2026. Senate Bill 6002, the Driver Privacy Act, is Washington’s first comprehensive state law aimed squarely at ALPR systems, and unlike some of the ALPR privacy statutes that came before it in other states, it doesn’t treat parking enforcement as an afterthought. It names parking enforcement explicitly, as its own permitted-use category with its own conditions attached.

For municipal parking operations and the vendors that supply their camera systems, that specificity cuts both ways. Parking enforcement keeps a clear, unambiguous legal basis for ALPR use — something not every state’s ALPR law bothers to spell out. But that basis now comes with real compliance obligations: retention limits, certification requirements, and audit trails that didn’t exist before and that a parking division can’t simply delegate to whichever vendor sold the cameras.

What the Driver Privacy Act Actually Regulates

SB 6002 was introduced by Washington State Senator Yasmin Trudeau as prime sponsor, with a large bipartisan-adjacent list of Senate cosponsors, and moved through the Senate Law & Justice Committee in January 2026 before eventually passing as an engrossed substitute bill. Governor Bob Ferguson signed it into law on March 30, 2026, making Washington one of a growing list of states — the Senate committee’s own analysis counted at least 16 as of early 2026 — with a dedicated ALPR statute rather than relying on general privacy or surveillance law to cover the technology.

The bill’s core structure will be familiar to anyone who has tracked ALPR legislation in other states: it defines which agencies may operate ALPR systems and for what purposes, sets limits on how long the resulting data can be kept, restricts who that data can be shared with, and prohibits a specific list of uses regarded as privacy-sensitive regardless of the agency operating the system.

What makes the Washington approach worth a parking-specific read is that the bill doesn’t lump parking enforcement in with general law-enforcement uses. The version analyzed by the Senate committee treated it as a distinct category, with its own conditions — a structure that matters because it means parking’s legal footing under the statute doesn’t automatically track whatever happens to felony-investigation uses in a future amendment.

Parking Enforcement as a Named Permitted Use

Under the bill as analyzed by the Senate Law & Justice Committee, ALPR use by a state or local agency is unlawful except for a defined list of purposes. Parking enforcement appears on that list on its own terms: a parking enforcement agency may use ALPR “when enforcing time restrictions on parking uses, or identification of vehicles on a watch list for impoundment.” That sits alongside — but separately from — the law-enforcement category (watch-list matching for stolen vehicles, missing persons, and felony warrants), toll enforcement, and transportation-agency uses like real-time traffic information and commercial vehicle enforcement at weigh stations.

That’s a meaningfully different posture than a law that simply says “ALPR may be used by law enforcement” and leaves parking programs to argue by analogy that time-limit enforcement counts. Explicit statutory language naming parking-time enforcement and impoundment-watch-list identification gives municipal parking divisions and their vendors a clean answer to “are we allowed to do this” — provided they also meet the conditions the same bill attaches to that permission.

The bill also builds in a check against ALPR being used to justify enforcement action on its own: a positive ALPR match alone does not establish grounds for a stop or citation without independent, verifiable grounds consistent with the applicable enforcement process. For a parking program, in practice that generally means the match still needs to be confirmed against the actual signage, permit record, or citation criteria before an officer issues a ticket or authorizes a tow — not treated as self-executing proof.

The Retention Question — and Why the Exact Number Needs Verification

This is the piece of the bill most likely to change a parking division’s day-to-day vendor configuration, and it’s also the piece where the public record is least settled at the moment of writing.

The Senate Law & Justice Committee’s analysis of the bill, dated January 20, 2026, described a tiered retention structure: a 72-hour default deletion requirement for most ALPR data, with several purpose-specific carve-outs layered on top — a 12-hour deletion window specifically for parking-enforcement data, a 30-day window for traffic studies, retention “as long as needed” for active toll collection, a four-hour window for commercial vehicle enforcement, and open-ended retention for data held as evidence in a felony investigation or under a subpoena.

The bill was subsequently amended in the House before final passage as an engrossed substitute, and the retention framework changed as a result. The best available reading of the enacted text (ESSB 6002) sets the general default retention period at 21 days — longer than the January committee draft’s 72-hour figure — and shifts the trigger for the parking-specific short-retention window from “after collection” to “after final disposition of the matter,” meaning the clock for parking data starts at a different point than the committee draft contemplated. Because retention periods are consistently the most negotiated, most frequently revised provision in ALPR legislation, parking operations and their vendors should still confirm the exact current figures against the final enacted statute text on the Washington State Legislature’s own bill-tracking page, or wait for the Attorney General’s model ALPR policy, due by statute no later than July 1, 2027, rather than configuring a system from either the committee draft or this summary alone. Treat the underlying pattern — parking-enforcement data retained for a meaningfully shorter window than the general default — as the durable signal of legislative intent, even as the exact figures get finalized through implementation guidance.

Certification, Training, and the Attorney General’s Role

Beyond permitted uses and retention, the bill creates an affirmative certification obligation. Agencies operating ALPR systems — which, for a city, typically means the parking or transportation department directly, not just the police department — must register their systems with the state Attorney General’s office and certify three things: that the system complies with the law, that written policies governing its use are actually in place, and that a documented training process exists for the staff who will operate it.

That last requirement is easy for a parking division to underestimate, because ALPR-equipped enforcement vehicles are often treated as a hardware and vendor-contract question rather than a personnel-training question. Under a certification regime, “we bought compliant cameras” doesn’t satisfy the statute on its own — the agency also has to be able to show a training record for the people using them.

The bill also directs the Attorney General to develop model ALPR policies that agencies statewide can adopt, with agencies required to have their own compliant policies in place and submitted to the Attorney General by a subsequent deadline, and to file annual reports covering matches, data sharing, and audit results. For a parking operation, that’s a recurring compliance task, not a one-time setup step at the point of buying new cameras.

Audit Trails and the Public-Records Angle

Two additional provisions are worth flagging specifically because they touch functions parking divisions already handle: records requests and data governance.

First, the bill requires agencies to log ALPR data access — who queried it, when, and for what purpose — and to maintain that audit trail for an extended period, with the state auditor holding jurisdiction to review compliance. A parking enforcement system that can’t produce that log isn’t just a policy gap; under this statute, it’s a compliance failure independent of whether the underlying enforcement action was proper.

Second, the bill narrows public-records disclosure of ALPR data itself, generally exempting it from release except in limited circumstances such as bona fide research that strips individually identifying information, while treating the separate access-log/audit data differently. Parking and records staff who currently field public-records requests touching ALPR-adjacent data should expect their response process to change under the new framework, and should coordinate with their city or county’s records officer and legal counsel on how the exemption is being applied locally, rather than assuming the pre-2026 practice still holds.

What This Means for Vendor Contracts

Most municipal ALPR deployments run on commercial camera and software platforms rather than agency-built systems, which means a meaningful share of the statute’s practical impact lands on vendor contract language rather than internal agency policy alone.

The bill restricts data sharing broadly — an agency generally cannot disclose or permit access to ALPR data outside a narrow set of circumstances, and cannot buy, sell, or lease ALPR data — and requires a warrant before an agency can obtain ALPR data held by a private entity. For a parking division, the practical questions worth raising with any current or prospective ALPR vendor include: does the vendor’s default retention configuration match the parking-specific window the statute contemplates, rather than a longer general-purpose default; can the vendor produce the access-logging detail the audit requirement calls for; and does the contract itself pass through the statute’s restrictions on data sale, sharing, and law-enforcement access, rather than leaving those questions to the vendor’s own discretion.

How Washington Fits the Broader State Pattern

Washington’s Driver Privacy Act arrives amid a wider wave of state-level ALPR legislation, and parking operators managing deployments in more than one state will recognize the general shape even where Washington’s specific numbers differ: permitted-use lists that generally protect routine parking and traffic enforcement, prohibited-use lists aimed at more surveillance-adjacent applications, retention limits that vary considerably by state and by purpose within a state, and — increasingly — a private right of action that raises the practical stakes of a compliance failure beyond regulatory enforcement alone. Washington’s law adds a Consumer Protection Act violation and private lawsuit right on top of gross-misdemeanor criminal exposure for willful violations, which is a materially different enforcement posture than states that rely on agency-level discipline alone.

Operators running ALPR programs across several states are generally better served by building internal retention and access-logging practices around the more restrictive end of that multi-state pattern, rather than treating each state’s minimum as a separate configuration to maintain — a principle that holds regardless of exactly where Washington’s final retention numbers land once the amended bill’s text is fully confirmed.

What Municipal Parking Staff Should Do Now

A few concrete steps make sense regardless of how the retention-period ambiguity above resolves: confirm with your city or county attorney’s office whether your parking division has been identified as an “agency” required to register its ALPR system with the state Attorney General; request written confirmation from your camera and software vendor of their current data-retention default and whether it can be configured per use case; ask your vendor directly whether they can produce the access-log detail the audit provision requires, in a format your agency could hand over to the state auditor if asked; and calendar the Attorney General’s July 1, 2027 model-policy deadline and the subsequent agency compliance deadline, since those dates will likely bring more concrete, agency-specific guidance than the bill text alone provides today.

Frequently Asked Questions

What is Washington’s Driver Privacy Act?

The Driver Privacy Act (Senate Bill 6002) is Washington State’s first comprehensive law regulating automated license plate reader systems. Signed by Governor Bob Ferguson on March 30, 2026, it defines permitted and prohibited ALPR uses, sets data retention limits, restricts data sharing and sale, and creates certification, audit, and reporting requirements for agencies that operate ALPR systems.

Does the law allow parking enforcement to use ALPR?

Yes. The bill’s committee analysis names parking enforcement as its own permitted-use category, covering enforcement of posted time restrictions and identification of vehicles on an impoundment watch list. That’s separate from the general law-enforcement permitted-use category, giving parking programs an explicit statutory basis rather than one inferred by analogy.

How long can parking enforcement retain ALPR data under the new law?

The Senate committee’s January 2026 analysis described a 12-hour deletion window specific to parking-enforcement data, against a 72-hour general default. The bill was amended before final passage, and the enacted version appears to set a longer 21-day general default while keeping a shorter, separately-triggered window for parking-enforcement data. Agencies and vendors should confirm the exact enacted figures against the current statute text or the Attorney General’s forthcoming model policy rather than relying on committee-stage numbers alone.

Does the Driver Privacy Act restrict private ALPR vendors like Flock Safety?

Indirectly. The law restricts government agencies from obtaining privately held ALPR data without a warrant, and bars agencies from buying, selling, or leasing ALPR data. It doesn’t directly regulate a private vendor’s own data practices, but it materially changes what an agency can lawfully do with data a vendor supplies or holds on its behalf.

What happens if an agency violates the Driver Privacy Act?

Willful violations are classified as gross misdemeanors, and the law treats a violation as a Consumer Protection Act violation, giving injured parties a private right to sue for damages, injunctions, and attorney fees — in addition to whatever regulatory consequences apply. That combination raises the practical compliance stakes beyond what agencies managed under the prior absence of a dedicated ALPR statute.

Further Reading from Authoritative Sources