Modesto police find federal agencies had prohibited access to license plate data
The Modesto Police Department recently discovered that several federal agencies — including Border Patrol — had access to information from its Automated License Plate Reader system, despite a California law restricting data sharing.
As the name suggests, ALPR technology automatically detects license plates, helping law enforcement recover stolen vehicles, locate missing persons, identify vehicles connected to violent crimes and support time-sensitive and ongoing investigations.
Under state law, ALPR data sharing is limited to California public agencies.
Despite attempts to bring the system into compliance with state law, MPD found still-active connections to several federal agencies. The agencies included the U.S. Forest Service, U.S. Park Police, IRS Criminal Investigations, San Diego Sector Border Patrol, Marine Corps Logistics Base Barstow, the Department of Veterans Affairs and the U.S. Marshals Service.
The Police Department stated it immediately disabled the identified connections, conducted multiple reviews to ensure no out-of-state or federal access remains active and implemented mandatory monthly compliance audits. It also strengthened policy language to clarify legal sharing limits and increased administrative oversight of the ALPR program.
“In the interest of transparency, we are sharing this information with our community. We will continue to review our systems and practices to ensure they align with both legal requirements and community expectations,” the department stated in a Facebook post.
The issue was discovered while preparing a response to a Public Records Act request. The Bee had submitted a PRA regarding the department’s use of ALPRs in February. On March 5, the city requested a two-week extension to “search for, collect and appropriately examine a voluminous amount of separate and distinct records demanded in a single request.”
Nick Hidalgo, a senior staff attorney with the ACLU of Northern California, said that even when agencies align their policies with state law, audits or Public Records Act requests have revealed that other state or federal agencies still had access to their information. That’s been the case in places including San Francisco and Mountain View.
“If we give the benefit of the doubt to the San Francisco, Mountain View and Modestos of the world and assume that they are trying to comply with the law, they’ve all three failed,” Hidalgo said.
Threats to privacy
ALPRs can pose a serious threat to civil liberties and have been used to target immigrant communities, protesters and people seeking reproductive health care, Hidalgo said.
Concerns about mass surveillance in Modesto have surfaced before. At a Community Police Review Board meeting in July, MPD showed photos of masked individuals arrested during last summer’s No Kings protest, captured by surveillance cameras. Some members of the public expressed discomfort over the level of the monitoring.
Because states can do only so much to limit federal law enforcement, the most effective approach is to avoid sharing unnecessary information and comply with California law, he said.
Senate Bill 34, which passed in 2015, requires operators of ALPR systems to implement strict privacy and security policies, maintain access logs and protect license plate data as sensitive personal information that cannot be sold to private parties.
All installation and maintenance of ALPR equipment, as well as ALPR data retention and access, are managed by the operations division commander, according to MPD’s policy. The commander is also responsible for developing guidelines and procedures to comply with the requirements of state law.
ALPR vendors, like Flock Safety and Motorola, are incentivized to share information because the wider their information reaches, the more money they make.
Hidalgo said that Flock in particular, which Modesto uses, is untrustworthy and “woefully incapable of complying with S-B 34 and respecting California’s right to privacy.” It appears Flock had turned on a nationwide-sharing setting on at least a few of its clients without informing them or obtaining their consent, he added.
Andrew Crocker, surveillance litigation director with the Electronic Frontier Foundation, said he has seen reports across California of local law enforcement agencies inadvertently sharing ALPR data with federal agencies.
He called it especially concerning that information from Modesto could have been accessed by Border Patrol. Crocker described ALPRs as a largely unregulated system of mass surveillance, but noted that at least MPD acknowledged the issue.
“When you collect all this information about everyone continuously over a long period of time, you are creating a very dangerous and also very appealing source of data for lots of folks,” Crocker said.
Electronic Frontier Foundation is involved in a lawsuit against the city of San Jose over its use of automated mass surveillance technology. The nonprofit is seeking a warrant requirement before agencies can search the ALPR database.
Both Crocker and Hidalgo agreed that the solution is to cancel all Flock contracts, as it cannot be trusted to comply with state law — whether the failures are deliberate or not. Hidalgo went further, suggesting that all cameras be removed entirely. “They do not make our community safer. All they do is subject us to constant, unblinking surveillance.”
MPD stated that it remains committed to ensuring that ALPR technology is used strictly within the boundaries of California law.
This story was originally published March 13, 2026 at 2:00 PM.
