Civil Liberties Groups Sue San José Over License Plate Reader Use

A group of civil liberties and immigrant support organizations is suing San José, alleging the city’s widespread use of hundreds of automated license plate readers amounts to a “deeply invasive” mass surveillance system that violates residents’ rights to privacy in California.

The city’s current arsenal of readers, often mounted on streetlight poles, is approaching 500, following an aggressive expansion push last year headed up by San José’s Police Chief Paul Joseph and Mayor Matt Mahan, under the banner of improved safety for residents. The lawsuit said the cameras scanned more than 361 million license plates last year in the city.

San José is far from alone in relying heavily on mass surveillance technologies, and not the only city to be sued for its alleged misuse.

Many other cities are also adding to their arrays of cameras, listening devices and scanners, and on Tuesday, the same day the lawsuit against San José was filed, Oakland was also sued, alleging that its police department has shared license plate reader data with federal agencies, going against state law.

California’s Attorney General Rob Bonta has also cracked down on similar violations, suing the city of El Cajon in October over its refusal to comply with the more than decade-old state law, SB 34, that bans such data from being shared with federal agencies or out-of-state law enforcement.

In San José, attorneys with the American Civil Liberties Union of Northern California and the Electronic Frontier Foundation, the organizations that filed the suit, say that because the city has so many readers and retains the plate and car data for a year, its surveillance of residents “is especially pervasive in both time and space.”

The lawsuit was filed on behalf of the California chapter of the Council on American Islamic Relations, known as CAIR-CA, and the Services, Immigrant Rights and Education Network, known as SIREN.

“For Muslim, immigrant, and other marginalized communities that already live with profiling, the idea that police can map your trips to the mosque, your lawyer, or your doctor — without a warrant — is chilling,” Zahra Billoo, executive director of the San Francisco Bay Area office of CAIR, wrote in an email.

The city’s cameras, from surveillance company Flock Safety, capture license plates on cars, but also the car’s make and model and other characteristics like roof racks or bumper stickers, and those captures happen millions of times each month. Flock’s software pings police when a car matching a “hotlist” is scanned by the cameras.

However, the lawsuit filed Tuesday doesn’t attack the use of the systems for quickly comparing cars to any current hotlists, attorneys say. Rather, the alleged violations of privacy rights and rights to be free from unreasonable searches and seizures stem from the police department’s retrospective reviews of the millions of data points the city keeps for a year.

Nick Hidalgo, a staff attorney for the ACLU of Northern California, said the lawsuit asks a judge to require San José police officers and other law enforcement agencies to get a warrant when they want to search the vast troves of stored data.

“It would be one thing if San José retained information for three minutes to check a license plate against a hotlist to make sure it wasn’t actively involved in an ongoing crime or an investigation,” Hidalgo said. “But that’s not what they do. They keep them for an entire year, which means that they can go back and look and see where a driver went to obtain medical care, where they worked, whether they attended a protest, or where they take their kids to school. It’s a huge overall scope problem.”

In April 2024, following a promotional event where Mayor Mahan climbed a ladder to help install a Flock camera in an East Side neighborhood, the city’s own data privacy officer, Albert Gehami, told KQED that keeping data not related to an investigation for a year is “excessive” and out of line with what many other police departments do.

The city attorney’s office at the time said if the City Council wanted to change the city’s policy on how long data is retained, they could, but no such action has been proposed.

The city attorney’s office did not respond to a request for comment on Tuesday. The police department declined to comment due to the pending litigation.

Mahan, in a statement sent to KQED, said the city has “built in robust data privacy and security measures throughout our ALPR system, including regular deletion of collected data that is not being actively used in an investigation.”

“While we take seriously our responsibility for data privacy and security, we can’t let fear of new tools get in the way of the safety of our families, especially given that this system is a big part of the reason we’ve solved 100% of homicides over the past three years,” he said.

The lawsuit cites the city’s Flock Transparency Portal data, showing there were 923,159 hotlist hits out of the city’s 361,494,941 total scans in 2024, or roughly 0.2% of scans. “In other words, nearly everyone whose ALPR information is stored by San José were under no suspicion whatsoever at the time the ALPR system captured that information,” the lawsuit said.

Between June 5, 2024, and June 17, 2025, the lawsuit said San José police officers conducted 261,711 searches of its Flock database, averaging several hundred times per day.

But because the department also shares its data with law enforcement agencies up and down the state, the database was searched a total of 3,965,519 times during that same period.

“Short of choosing not to drive, there is no way for a person traveling within the city of San José to avoid having their location information caught up in the SJPD’s ALPR surveillance web,” the lawsuit said. “Yet many San José residents have no choice but to drive because the city is a car-dependent series of communities, too large to commute by foot and often lacking meaningful public transportation alternatives.”

While public safety officials have touted the use of the readers as a way to cut down crime and improve safety, the police department has previously refused to offer data points or metrics to show how the systems are a success.

“We like to measure our success in terms of usefulness in our pursuit of public safety by solving and reducing crime,” Sgt. Jorge Garibay, a department spokesperson, told KQED in 2024.

“Crime trends fluctuate, as do crime types. What most of these have in common is a mode of transportation to and from the scene of crime. When that mode is a vehicle, ALPR success is achieved when a hit has been broadcasted and officers have a tangible lead to follow up on.”

Hidalgo, from the ACLU, said the system vendors like Flock Safety or Vigilant will always point to a handful of cases where the technology was useful for law enforcement. The San José Police Department’s Flock Safety portal, for example, also has a list of about 30 past incidents in 2024 and 2023 where the technology was used to make an arrest.

“But when you compare how often they are actually useful to just how much information they’re collecting and how rare those hits are … it really shows you that these are not the right technologies to protect people,” Hidalgo said.

The attorneys could have brought a similar lawsuit in many cities or jurisdictions in the state, Hidalgo said, as dragnet surveillance has become more commonplace. But the privacy violations are even worse in San José, due to the size and scope of its system, he said.

“But we’re very hopeful that if we obtain a positive ruling in this case, that it will encourage other jurisdictions … to reconsider how they use their license plate reader data.”