Somewhere in California right now, a tow truck is rolling down a residential street, and a camera bolted to its bumper is quietly photographing every license plate it passes. Each image gets a timestamp, a location, and a permanent home in a private database that, as of last year, held more than nine billion historical plate scans. Nobody who owns those plates signed up for it. Almost none of them know the database exists.
That’s the real subject buried inside a California Court of Appeal ruling handed down on July 20, in a case that on paper reads like a routine defeat for a privacy plaintiff. Guillermo Mata sued Digital Recognition Network, a private company that sells license plate tracking hardware and the data it generates to insurers, skip-tracers, repossession agents, and anyone else with what the company’s own policy calls a “legitimate commercial interest” in finding somebody’s car. Mata lost. The Fourth Appellate District affirmed, in an opinion certified for publication, a lower court’s finding that he lacked standing to sue, because having his license plates scanned more than fifteen times over several years didn’t, by itself, count as harm under California law.
Treat that as the whole story and you’ll miss the point. This isn’t really a case about one driver’s failed lawsuit. It’s a case about how a state law written to rein in license plate surveillance ended up doing the opposite for the private sector, and about an entire industry of vehicle-tracking businesses that most car owners have never heard of, built one tow-truck camera at a time.
California’s Automated License Plate Recognition statute, passed in 2015, bills itself as a check on exactly this kind of tracking. It requires anyone running a network of plate-scanning cameras, public or private, to post a usage policy, secure the data, and log who accesses it. Most drivers assume a law like this reins in the actor everyone worries about first: the police. It doesn’t, at least not for the industry built around companies like DRN. Government agencies operating these camera networks are legally barred from selling or sharing the data they collect with anyone except other government agencies. Private operators face no such limit. As one California appellate panel put it earlier this year, the statute vests private companies “with wide leeway to determine what to do with this data.” The law that sounds like a privacy statute functions, for a private commercial network, mostly as a paperwork requirement: post a policy, and you are most of the way to compliant.
DRN’s cameras aren’t hidden in traffic signals or bolted to patrol cars. Court records describe hardware mounted on vehicles “like tow trucks or other physical infrastructure,” meaning a meaningful share of that nine-billion-image archive was built by contractors whose day job is repossessing cars, driving ordinary residential streets at all hours, and sweeping up every plate in view along the way. The mundane business of hooking up a delinquent Silverado has, as a byproduct, helped assemble one of the largest private vehicle-location databases in the country.
The line between a “government camera” and a “private camera” is blurrier than most drivers assume, and that ambiguity cuts against accountability rather than for it. A West Virginia man who tore down what he believed were county-owned plate readers now faces felony charges over equipment the county may not have owned at all. Vendors, not municipalities, frequently hold the hardware and the data contracts, an arrangement close to the one that let DRN operate for a decade under a policy Mata’s attorneys called meaningless, with no regulator positioned to force a fix.
Mata’s theory of harm was not frivolous. His attorneys argued that being tracked, having your comings and goings logged and stored indefinitely by a company you never agreed to deal with, is itself an invasion of privacy, regardless of what happens to the data afterward. Courts have accepted versions of that argument in other privacy disputes. Not this one. The appellate panel found that California’s ALPR law draws a hard line between violating the statute’s rules and being harmed by a violation, and that a plaintiff must show both. Mata’s own deposition undercut his case: his data had never been breached, never accessed by anyone but his own attorneys, never linked to stalking, financial loss, or identity theft. Asked what harm he’d suffered, he said his privacy “has been violated,” a belief the court treated as sincere and, legally, beside the point.
Misuse isn’t hypothetical. A review by the Institute for Justice found more than a dozen documented cases of police officers using plate-reader systems to track romantic interests, precisely the kind of concrete harm the court said Mata’s case lacked. Prove that a scan turned into a stalking incident, an identity theft, or a financial loss, and a plaintiff has standing. Simply existing inside the database, fifteen scans deep, does not. That reasoning tracks a broader shift in privacy law, where courts have grown skeptical of lawsuits built on the idea that a statutory violation is automatically an injury. The practical effect is a one-way door: a plaintiff can’t sue over the surveillance itself, only over what someone later does with it, but by the time misuse is provable, the location history, the routines, the home and work addresses are long since collected, sold, and dispersed to whoever paid for access.
That door closed the same summer that police-operated plate cameras are facing the opposite momentum. The LAPD dropped Flock Safety’s camera network amid public backlash, and several small Connecticut towns reached the same conclusion within weeks. A pending Fourth Circuit case, sharpened by a recent Supreme Court ruling on cellphone location tracking, could reshape how courts treat government-run camera networks under the Fourth Amendment entirely. Even police departments struggle to manage what they already collect: Oakland’s network generated so many hits in a single year that the department muted its own stolen-car alerts just to keep the system usable. If law enforcement can’t manage the flow from a few hundred cameras, it’s worth asking what quality control looks like inside a private network processing nine billion images for customers who pay by the query.
None of this is academic for anyone who owns, insures, or finances a car. DRN’s stated customers include repossession agents doing skip tracing and insurers investigating claims, companies with, in the statute’s own words, a “legitimate commercial interest” in finding a specific vehicle. None of them need a warrant. None of them need consent. Fall behind on a car loan, and your payment history may already sit alongside a location profile assembled from cameras you never saw, mounted on trucks you never noticed, governed by a policy you never read, and after this ruling, largely unenforceable by you unless something worse happens next.
None of this required a subpoena or a warrant. It required a business model: sell the hardware, harvest the exhaust, and monetize the pattern of people’s daily lives before anyone thinks to ask who’s watching.
Nine billion images did not pile up because a surveillance state built itself. They piled up because no one with standing to object could prove, in a courtroom, that being watched had cost them anything. Until that changes, the tow truck idling down your street at midnight might be doing more than looking for someone else’s car.