CA SB274

Limits retention of automated license plate recognition (ALPR) data to 60 days for information that does not match an authorized hot list, and requires public agencies to delete non-matching data held longer than 60 days within 14 days as of January 1, 2026

Restricts law enforcement use of ALPR information solely to locating vehicles or persons reasonably suspected of involvement in public offenses

Requires new ALPR vendor contracts beginning January 1, 2026 to prohibit default access to national ALPR databases and prevent automatic sharing of an agency's collected scans with other agencies

Mandates ALPR operators and end-users implement employee access safeguards, supervisory approval, robust authentication protocols, and data security/privacy training for all employees accessing ALPR information

Requires the Department of Justice to conduct annual random audits of public agencies using ALPR systems to verify compliance with usage and privacy policies, contingent upon budget appropriation