What is your license plate telling police?

Every day, Atlanta police cruisers roll through parking lots, idle along busy streets, and creep through traffic to hunt for lawbreakers.

Occasionally, the computer inside one of their cars sounds an alarm and displays a license plate on the screen that might have expired registration, been reported stolen, or be tied to some other illicit activity. The image comes courtesy of an automatic license plate recognition, or ALPR, scanner mounted somewhere on the cruiser. The high-tech tool can document every tag in a parking lot, or read the decals of every vehicle passing through an intersection, within a matter of minutes.

Over the past six months, the Atlanta Police Department has used 11 of these patrol-mounted cameras, plus one in a fixed, undisclosed location. Each camera is capable of reading hundreds of plates per minute, converting the tag images into usable text, and then cross-referencing the information against multiple databases. Police are then able to decide whether to investigate further.

But as the scanners scout for ne’er-do-wells, they also collect information of law-abiding citizens going about their lives. Personal information such as names and addresses aren’t stored. But what happens to other types of data collected by the scanners, like geographic locations, tag numbers, times, and dates, isn’t clear. Some police departments in other cities and states deposit the information into a privately held national database, whether a person is suspected of a crime or not. When asked, the APD declined to say where the data it collects from ALPR scanners goes.

The use of license plate scanning is growing in police departments across the nation. The practice has raised concerns among civil liberty advocates such as the ACLU of Georgia that want to know what’s being done to safeguard people’s privacy.

“We think there’s a way you can balance the state’s interest in tracking down stolen vehicles and locating people without warrants in a way that safeguards the privacy of innocent individuals,” says Chad Brock, an ACLU of Georgia attorney who oversees research into ALPR scanners. The legal group’s parent organization has asked hundreds of police departments around the country for detailed information about their systems and how they store the data they accumulate.

Taken individually, each snapshot captured by an ALPR camera amounts to little more than a car’s location at a particular time. But combine enough of those snapshots, and a picture of a person’s life and habits can start to emerge.

“[ALPR scanners] could potentially be used to track the movements of people who attend political protests or other kinds of unpopular events,” Brock says. “Maybe it’s in a particular church that may or may not be favored within the community, or visiting particular doctors. ... Without limits on the collection or retention of shared data, government at all levels will start to quickly amass huge amounts of information about where we travel by car.”

Lawmakers have struggled to keep up with police departments’ enthusiasm for the new technology. Only a handful of states have legislation governing how officers can use the scanners and the data they collect. In Georgia, the use of ALPR scanners is totally unregulated.

In Washington, D.C., a city with one of the nation’s highest concentrations of ALPR scanners, police are required to delete surveillance footage after 10 days if it’s not tied to an investigation. But no such regulations exist for ALPR data. Here in Atlanta, it’s a felony for police officers to pull a person’s criminal record if they’re not investigating a crime. But there’s nothing stopping them from looking up a stranger’s information by scanning that person’s license plate.

Tags scanned by some U.S. police departments are stored in databases accessible only to law enforcement. One such database is operated by ALPR camera manufacturer Vigilant Solutions. The California-based company’s National Vehicle Location Service, or NVLS, is the largest data-sharing initiative of its kind in the United States. The database contains records from more than 825 million license plate scans on its private server, and adds as many as 50 million every month. Although the APD uses a Vigilant system, it won’t say exactly what happens to citizens’ data or where it’s stored. Vigilant Solutions and APD representatives declined to comment about specifics of the database, but APD spokesperson Carlos Campos says the information collected by the cameras is only accessible to law enforcement officers with a username and password. In addition, the system keeps a log of who accessed what information.

Many major metro police departments haven’t waited for state legislatures to act and are drafting their own guidelines for how long information is stored and how it can be used. Atlanta police have started to follow suit, and say they’re crafting their own policy to address issues like data retention. But, for now, boundaries and guidelines are far from clear.