On the last day California lawmakers met this year, Senate Bill 1013 sat in a stack of legislation that had already cleared the state Senate by a vote of 28 to 9 and worked its way through four Assembly committees. Nobody had to vote it down. Assembly Majority Leader Cecilia Aguiar-Curry simply never called it up for a floor vote before the gavel came down on the session, and a bill built to regulate the cameras that read your license plate every time you drive past one died without a single “no” attached to it.
That’s the fifth year running that California has tried and failed to write real rules for automated license plate readers, or ALPR, the acronym doing most of the heavy lifting in Sacramento’s committee rooms. It’s tempting to read that streak as privacy losing to law and order, again. It isn’t, not really. It’s a story about how little the outcome depended on an actual vote at all, and how comfortable both the industry and the agencies using its cameras have gotten with that arrangement.
A Bill That Got Smaller Every Time It Moved
SB 1013, introduced by state Sen. Sabrina Cervantes and co-authored by Assembly Member Josh Lowenthal, would have limited law enforcement’s use of license-plate data to locating suspects or missing people, required privacy and cybersecurity training for anyone who touches the system, restricted default sharing into national databases, and ordered the Attorney General’s office to run random misuse audits. None of that is exotic. It’s the kind of oversight most drivers would probably assume already exists for a technology quietly logging their car’s location dozens of times a week.
It also wasn’t the bill’s first draft. Earlier language would have required police to delete license-plate records after 30 days. By the time the bill reached its final Assembly-amended form, that had been traded for a 60-day “archive,” after which investigators would need a warrant to search it, unless the plate was tied to an active case. Gov. Gavin Newsom vetoed a nearly identical bill last year specifically because it ordered police to delete records after 60 days, an even stricter mandate than this year’s warrant-gated compromise. Sacramento didn’t just fail to regulate this technology once. It failed after already conceding most of what law enforcement asked for.
The Exemptions Nobody Highlighted
Here’s the detail buried under the privacy-versus-policing framing that dominated the coverage: SB 1013 was never just about police. Its definitions section, the dense part of any bill that quietly decides who the law actually touches, carved out its own list of agencies that don’t count as regulated “ALPR operators” at all. Transportation agencies collecting toll data. Public transit operators. Campus transportation departments. Airports. State parking facilities. The California Air Resources Board.
Read that last one again. CARB, the agency that enforces California’s emissions rules, is exempt from the same privacy framework lawmakers spent five years fighting over for the local sheriff’s department. Everyone paid attention to the fight over police misuse. Almost nobody noticed how many other arms of state government get to run the identical camera technology with none of the guardrails on the table.
The Industry Already Wrote Its Own Rules
While Sacramento argued over a 60-day archive window, Flock Safety, the company whose cameras sit behind most of this fight, quietly did something more aggressive on its own. The company’s current marketing materials advertise a recommended default retention period of seven days, down from 30, alongside mandatory multi-factor authentication and expanded audit tools for every customer.
Seven days is shorter than anything Sacramento could agree to codify. That should sound like good news, and it’s worth sitting with why it isn’t, exactly. A statute is enforceable by the Attorney General’s office and survives whether or not the company that wrote it changes its mind next quarter. A “recommended default” is a setting, adjustable by the vendor, with no outside auditor checking whether any individual department actually adopted it. California’s Legislature spent five years failing to require something the industry now advertises as already exceeding. That’s not evidence the law was unnecessary. It’s evidence of who currently sets the terms, and it isn’t anyone voters can hold accountable in November.
Who Actually Wins When Nothing Passes
Nearly 40 law enforcement agencies and police unions lobbied against SB 1013, and the California State Sheriff’s Association didn’t soften its opposition even after the bill’s requirements were watered down. Their argument, that license-plate data helps locate missing people and close cold cases, isn’t wrong. Flock’s own figures claim more than 10,000 missing people located last year alone. That’s real, and it’s the reason this fight keeps resetting to zero every session instead of ending in a durable compromise.
But the bill’s own definitions reveal something the “hot list” framing obscures: alerts attach to a plate number, not a driver or a VIN. Trade in a car and its old plate can eventually be reissued to someone else’s vehicle; a flag tied to a years-old case can follow the reissued number just as easily as the original one. The Auto Wire has already documented what that looks like in practice, from a press-fleet Range Rover flagged nationwide over one mistyped digit to a Milwaukee homicide alert that stayed active long enough for Brookfield officers to draw guns on the wrong people weeks later. Neither case involved misuse. Both were the system working exactly as designed, on top of records nobody was required to double-check.
It’s not only sheriffs and camera vendors who benefit from the status quo. A separate, privately run plate-scanning network built largely on repossession tow trucks has logged nine billion plates nationwide and sells access to lenders and insurers; a California court ruled that legal, absent proven harm, while SB 1013 was still alive in committee. Florida’s own attempt to rein in police cameras this year left that exact same lender-and-insurer pipeline completely untouched. California’s bill, whatever its flaws, was at least aimed at the right target. It just never got to the floor.
California’s failure to regulate ALPR isn’t happening in isolation. Texas just moved to defund the insurance-fee-backed camera network it spent three years building. Los Angeles police walked away from Flock’s data-sharing network entirely, joining a wave of more than 200 agencies nationwide that dropped their contracts in August alone, the busiest month for cancellations since 2021, according to the privacy group Secure Justice. Every one of those moves happened at the local or executive level. None of them required a legislature to agree on statutory language first, because increasingly, none of them are waiting for one.
A National Pattern, Not a California Problem
That’s the pattern worth remembering. Regulation by contract cancellation is faster than regulation by statute, but it’s also reversible the next time a city council changes its mind or a new sheriff takes office. A durable law was the one tool that could have protected drivers regardless of who runs a given department in a given year. For the fifth year running, California’s Legislature chose not to use it, and this time it didn’t even have to explain why.
What to Actually Remember Here
Every year, Sacramento argues about how long police should be allowed to keep the data your license plate generates just by existing in public. Every year, the only thing that reliably gets deleted is the bill.
That’s not a bug in how California legislates. It’s a feature nobody put in a press release. Cervantes says she’ll bring the fight back next session. She’ll be doing it against the same mechanism that killed it this time: a calendar controlled by someone who never had to cast a vote at all.