Twenty-one day deletion, a bar on federal and out-of-state access to publicly owned camera data, prohibited locations, and a private right to sue. It took effect the day it was signed.
We hold or directly cite the underlying record — a contract, ordinance, policy, procurement file, or public-records response.
Engrossed Substitute Senate Bill 6002 requires automated license plate reader data held by Washington public agencies to be deleted within 21 days, subject to enumerated exceptions — 12 hours for parking enforcement, four hours for commercial vehicle enforcement, 30 days for traffic studies, indefinite for tolling, and longer where a court orders it. It makes state and local agencies the legal owners of the data and limits sharing to judicial proceedings and to authorised state or local agencies and vendors. It prohibits use on the premises of or immediately surrounding schools, places of worship, courts and food banks, and near protected health care and immigration facilities. Violations are gross misdemeanours and carry a private right of action for damages and attorney fees under the Consumer Protection Act. The act contains an emergency clause and took effect on enactment in late March 2026.
Every fight this site covers is a fight over four fields — how long the data is kept, who can search it, where the cameras may point, and what happens when somebody breaks the rules. Washington is the first state to legislate all four at once, and the fourth one is the one nobody else has done. A private right of action under the Consumer Protection Act means enforcement does not depend on a prosecutor deciding an ALPR violation is worth their week, or on an agency auditing itself. A resident harmed by a violation can bring the case. That is the difference between a policy and a rule. Notice, too, what the statute chooses to do about federal access: rather than negotiating sharing agreements agency by agency, it removes the option from publicly owned systems as a matter of state law — while leaving subpoenas intact, which is the correct place for the line, because a subpoena is a legal process and a network query is not. Washington has effectively answered the question the Twin Cities are still arguing about, and it answered it before the searches happened rather than after. For anyone drafting a state bill, this is the text to start from.
Washington ALPR data held by public agencies must be deleted within 21 days, with enumerated exceptions.
The exceptions are 12 hours for parking enforcement, four hours for commercial vehicle enforcement, 30 days for traffic studies, indefinite retention for tolling, and longer retention where ordered by a court.
State and local agencies operating ALPR systems are the legal owners of the data, and sharing is limited to judicial proceedings and to authorised state or local agencies and third-party vendors.
Use is prohibited on the premises of, or immediately surrounding, schools, places of worship, courts and food banks, and near protected health care and immigration facilities.
Violations are gross misdemeanours and carry a private right of action for damages and attorney fees under the Consumer Protection Act.
The act contains an emergency clause and took effect on enactment.
The law bars the federal government and agencies outside Washington from accessing data generated by publicly owned cameras in the state, while leaving federal subpoena authority intact.
Research by the University of Washington Center for Human Rights found that multiple Washington law-enforcement agencies had ALPR networks shared with federal immigration authorities during 2025, before the law.
Accounts of the signing date differ by a day between outlets. The statute took effect on enactment either way, and we treat the precise date as pending the governor's own signing record rather than picking between two secondary reports.
A statute is not compliance. Nothing here establishes what Washington agencies are actually doing now — Renton switched its cameras off on March 30 specifically because it did not yet know whether it complied, which is a reasonable response and not evidence that anyone else did the same.
Engrossed Substitute Senate Bill 6002 is, as far as we can establish, the most restrictive state law on automated license plate readers in the United States. It carries an emergency clause, so it took effect on enactment in late March 2026 rather than waiting the usual ninety days.
Four things, in order of how much they change:
Deletion within 21 days. Data held by a public agency must go. The exceptions are narrow and specific rather than open-ended: 12 hours for parking enforcement, four hours for commercial vehicle enforcement, 30 days for traffic studies, indefinite for tolling, and longer where a court orders it. Note the shape of that list — each exception is tied to a purpose that does not require a searchable movement history.
Ownership and sharing. State and local agencies operating the systems are the legal owners of the data, and sharing is limited to judicial proceedings and to authorised state or local agencies and vendors. Reporting on the law describes it as barring the federal government and out-of-state agencies from accessing data from publicly owned cameras in Washington — while leaving federal subpoena authority intact.
That last distinction is the right one, and it is worth being explicit about why we think so. A subpoena is legal process: it is written down, it is directed at something, and it can be resisted. A standing network query is none of those things. A law that blocked subpoenas would be picking a fight with the Supremacy Clause. A law that blocks the query removes the thing that made sharing frictionless, which is the actual problem.
Prohibited locations. No use on the premises of, or immediately surrounding, schools, places of worship, courts, or food banks, and none near protected health care and immigration facilities. This is the first place in American law we are aware of that treats camera siting as a civil-liberties question rather than a traffic-engineering one — the recognition that a reader outside a mosque or a food bank collects a different kind of information than one on a highway, regardless of what it technically records.
Enforcement that does not depend on the violator. Violations are gross misdemeanours, and there is a private right of action for damages and attorney fees under the Consumer Protection Act.
Almost every ALPR safeguard in the country is enforced by the agency that would be breaking it.
An agency writes a use policy. The agency audits itself against the policy. If the audit finds something, the agency decides what to do. Chandler, Arizona is the good version of that loop — a city audited itself, found use it could not explain, and shut the program down. It is also, tellingly, remarkable enough that we wrote a story about it.
A private right of action changes who can start the process. It does not depend on a prosecutor deciding that an ALPR violation is worth a week of their time, or on a police department volunteering that it broke a rule. A person harmed by a violation can bring the case, and the attorney-fee provision is what makes that theoretically available right practically usable by somebody who is not wealthy.
That is the difference between a policy and a rule.
Compare this with Minnesota, where roughly thirty agencies searched suburban camera data for immigration purposes last winter and local officials found out afterwards, from reporters.
Washington had the same exposure. The University of Washington’s Center for Human Rights documented multiple Washington agencies with networks shared to federal immigration authorities during 2025. The state’s answer was to remove the option from publicly owned systems as a matter of law, rather than to ask each of a few hundred agencies to configure a checkbox correctly and hope.
One of those is a policy that scales. The other is what Minnesota is doing now, city by city, after the fact.
A statute is not compliance. Nothing here establishes what Washington agencies are actually doing. Renton switched its cameras off on March 30 precisely because it did not yet know whether it complied — a reasonable response, and not evidence that anyone else did the same. Whether 21-day deletion is happening across the state is an open question, and the honest answer today is that nobody has published one.
We also do not know whether the law reaches systems that are privately owned but queried by public agencies, which is the obvious route around it and the one worth watching.
If you are in Washington: the law gives you standing you did not have. A records request asking your agency to demonstrate 21-day deletion is now a request about a legal obligation rather than about a preference.
If you are anywhere else: this is the text to hand your legislator. The four provisions above — deletion, ownership and sharing, prohibited locations, private enforcement — are separable, and a state that adopts only the fourth has done more than a state that adopts only the first.
The policy-ask templates cover how to put this in front of a council or a committee.
We hold or directly cite the underlying record — a contract, ordinance, policy, procurement file, or public-records response.
Not yet obtained
Verified as of
Ask whether your agency complies
A statute is not compliance. Where a law sets a retention or access rule, a records request asking the agency to demonstrate it is now a request about a legal obligation.
Questions this story leaves open
This Unsurveilled record is licensed CC BY 4.0. Linked source material remains the property of its publishers. Spotted an error? Tell us — corrections are logged in public, not quietly edited away.
