Automatic license plate recognition systems (law enforcement use and vendor duties)
VA ALPR law
Government records · Location
Limits police use of automatic license plate readers to criminal investigations with reasonable suspicion and missing or endangered person cases, requires system data to be purged after 21 days and audit trails after two years, and bars selling or sharing the data with private or out-of-state databases. Vendors must certify they will not sell or share Virginia ALPR data and must notify the agency of third-party data requests; contract terms under subsection C apply from July 1, 2026.
- Where
- Virginia
- Citation
- Va. Code § 2.2-5517 (Title 2.2, Chapter 55.6)
- Status
- In force
- In force since
- 2025-07-01
- Enforced by
- Criminal prosecution for misuse; Department of General Services approval of systems
- People can sue
- No
- Penalties
- Willful misuse, or selling or sharing ALPR data in violation of the section, is a Class 1 misdemeanor (2.2-5517(N)).
- Applies to
- Virginia law-enforcement agencies using ALPR systems
- Private vendors that contract with law-enforcement agencies to install, use, or maintain ALPR systems (2.2-5517(A)-(C), (Q))
What a privacy notice must say
- Vendors must immediately notify the contracting agency of any subpoena, warrant, or other third-party request for ALPR data unless legally barred.Va. Code § 2.2-5517(Q)
Practices it requires
- Vendors must certify they will not sell or share Virginia system or audit trail data except at the contracting agency's request for a permitted purpose, and will access it only for maintenance and quality assurance.Va. Code § 2.2-5517(B)(1)
- Agencies may not sell ALPR data or share it with private, commercial, federal, or other-state databases except as listed.Va. Code § 2.2-5517(F)
Security duties
- Vendor systems must be able to purge system data after 21 days and audit trail data after two years unrecoverably, and meet VITA security standards.Va. Code § 2.2-5517(B)(2)-(3), (B)(5)
Other duties
- Contracts must make the agency the owner of system and audit data and require the vendor to meet the approval requirements.Va. Code § 2.2-5517(C) · From 2026-07-01
Sources
- Official text
- Va. Code § 2.2-5517 (Virginia Law, law.lis.virginia.gov)
- 2025 HB 2724 (Acts 2025, c. 720, approved 2025-05-02; applies to ALPR use on or after 2025-07-01; subsection C effective 2026-07-01) bill history (Virginia LIS)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Research reference, not legal advice.