Case Study 25-2: The License Plate Reader Data Economy — Vigilant Solutions and the Privatization of Vehicle Location History

Case Study 25-2: The License Plate Reader Data Economy — Vigilant Solutions and the Privatization of Vehicle Location History

Background

The license plate reader market in the United States is dominated by a small number of companies that provide both the hardware (the cameras and readers) and the data management platforms (the databases and analytical tools). The most significant player in this market is Vigilant Solutions, acquired by Motorola Solutions in 2018 — giving Motorola control over what is estimated to be the largest private database of vehicle location records in the United States.

Vigilant Solutions' LEARN (Law Enforcement Archival and Reporting Network) database aggregates LPR data from law enforcement agencies, private security companies, repossession companies, and parking operators across the country. As of recent estimates, the database contains billions of license plate captures — records of specific vehicles at specific locations at specific times — with new records added daily from thousands of participating readers.

How the Commercial LPR Ecosystem Works

The commercial LPR ecosystem operates through a data-sharing model that creates a surveillance network extending far beyond what any single agency or company could build independently.

Participants in the ecosystem:

Law enforcement agencies: Many police departments purchase Vigilant Solutions' LPR readers and, in doing so, agree to share their captured plate data with LEARN. In exchange, they receive access to the full LEARN database — including data captured by other participating agencies and by private sector participants. This is a data exchange: your data for access to everyone else's data.

Repossession companies: "Repo men" operate some of the densest LPR networks in the country — typically mounted on their vehicles, constantly capturing plates in residential areas, shopping centers, and anywhere vehicles are parked. Repossession LPRs are specifically looking for vehicles subject to repossession orders, but they capture and retain all plates they encounter, not just targets. This data flows into commercial aggregators.

Parking operators: Private parking companies use LPRs for access management and payment enforcement. Their readers capture every vehicle that enters or exits a parking facility — including the date, time, and facility location. This data is commercially valuable.

Private security firms: Campus security, corporate security, and neighborhood security services use LPRs to monitor their areas of responsibility. Their data is often included in commercial aggregation networks.

The result is a surveillance network assembled not by any single institution but by the aggregation of commercially acquired data from dozens of different sources — each individually justified by a specific operational need, collectively constituting a comprehensive vehicle location monitoring system.

The Reach of the Network

The geographic reach of the LEARN database and similar commercial aggregation networks is difficult to fully characterize because the data sources are numerous and the aggregation is proprietary. But available evidence suggests it is extensive.

A 2021 study by the Electronic Frontier Foundation and MuckRock, using FOIA requests to document LPR data sharing agreements, found that: - Hundreds of U.S. law enforcement agencies have formal data-sharing agreements with Vigilant Solutions / Motorola - Many agencies were sharing data with Vigilant without active city council authorization or public disclosure - The data-sharing agreements gave Vigilant extensive rights to aggregate and use the data beyond the law enforcement purpose - Some agencies were unaware of the full extent of data sharing they had agreed to

In urban areas with dense LPR coverage — some jurisdictions have fixed LPR coverage at most major intersections plus mobile LPRs on multiple patrol vehicles — it is feasible to reconstruct a vehicle's movements throughout a day from the LPR record. Over weeks or months, these reconstructed movement patterns document: - Home address (where the vehicle is parked overnight) - Work location (where it parks during working hours) - Religious affiliation (which place of worship it visits) - Medical care (which medical facilities it visits) - Political activity (which political meetings, protests, or campaign offices it visits) - Social relationships (whose residences it visits and how frequently)

This is a comprehensive location history of a person's life, assembled from commercial vehicle location surveillance, accessible to any law enforcement agency with a LEARN subscription and to any commercial customer Motorola chooses to serve.

The Civil Liberties Implications

No warrant required: The Supreme Court's Carpenter v. United States (2018) held that law enforcement must obtain a warrant to access historical cell phone location data from carriers, because such data is sufficiently comprehensive that it violates a reasonable expectation of privacy. The court reasoned that cell phone location data provides an "all-encompassing record" of a person's movements that differs in kind, not just degree, from other forms of location evidence.

Whether Carpenter applies to LPR database searches is an open legal question. Courts have reached different conclusions. Law enforcement agencies routinely access LPR records without obtaining warrants, reasoning that vehicle location on public roadways does not carry a reasonable expectation of privacy. This reasoning ignores the aggregation issue: a single observation of a vehicle on a public road is qualitatively different from a database containing every location of that vehicle over months or years.

Immigration enforcement: U.S. Immigration and Customs Enforcement (ICE) has been a significant customer of commercial location data, including LPR data from commercial aggregators. ICE has used LPR data to locate undocumented immigrants for enforcement actions — tracking vehicles associated with individuals of interest to specific locations, enabling physical apprehension.

This use was not disclosed in the marketing for any of the individual data sources — repossession companies, parking operators, or municipal police departments — that contribute to the aggregated LPR database. Their data was collected for specific operational purposes; it was repurposed for immigration enforcement through commercial aggregation.

Abortion surveillance: As discussed in the chapter's main text, the post-Dobbs environment has highlighted LPR data's potential use in abortion surveillance. Surveillance cameras near abortion clinics in states that have criminalized abortion capture the plates of every vehicle approaching. This data, if retained and accessible to state law enforcement, could document which individuals visited abortion facilities — potentially providing evidence in state criminal investigations of abortion.

The Governance Gap

The commercial LPR data ecosystem has developed largely in advance of its governance framework:

Most states lack specific LPR data retention limits
Most states lack restrictions on commercial aggregation of LPR data
Federal privacy law does not specifically address LPR data
Carpenter's warrant requirement has not been definitively extended to LPR databases by any federal circuit court
Municipal LPR policies, where they exist, typically address only police department use — not commercial aggregation networks

This governance gap is not unique to LPRs — it reflects a general pattern in American privacy law: technology develops faster than regulation, and by the time comprehensive regulation is debated, the industry is mature and politically powerful enough to resist strong restrictions.

Several states (California, Minnesota, New Hampshire, Vermont) have adopted some LPR-specific restrictions — typically addressing retention periods and law enforcement use. But no state has comprehensively addressed the commercial aggregation dimension: the private database companies that aggregate LPR data from multiple sources and sell access.

Discussion Questions

Vigilant Solutions / Motorola's LEARN database aggregates LPR data from law enforcement agencies, repossession companies, parking operators, and private security. Each data source collected its data for a specific, arguably legitimate purpose. Does the commercial aggregation of these individually-justified data sources create something that requires additional governance, or is it just efficient data sharing? Justify your position.
The Carpenter v. United States (2018) decision extended warrant protection to historical cell phone location data on the grounds that it provides an "all-encompassing record" of a person's movements. Apply the same reasoning to historical LPR database records. Should Carpenter extend to LPR databases? What arguments support extension? What arguments oppose it?
ICE's use of commercial LPR data for immigration enforcement was not disclosed to any of the data sources that contributed to the aggregated database — the repossession companies, parking operators, and municipal police departments whose data fed the network. Does this constitute deception? Who bears responsibility — the individual data sources, the commercial aggregator, or the law enforcement agency that purchased access?
The chapter's main text raises the LPR concern in the context of abortion surveillance following Dobbs. Is this concern speculative or realistic? What specific evidence exists that LPR data is being used or could be used for this purpose? What legal restrictions, if any, currently prevent it?
Design a comprehensive state-level LPR governance framework that addresses: (a) retention limits for law enforcement LPR databases; (b) commercial aggregation of LPR data; (c) permitted uses of LPR databases; (d) warrant requirements for historical LPR access; and (e) community notification and transparency requirements. Be specific — propose actual time limits, definitions, and enforcement mechanisms.

This case study connects to Chapter 25's main text on license plate readers and fusion centers, Chapter 15 (IoT and location tracking), and Chapter 31 (legal frameworks including Fourth Amendment case law). The Electronic Frontier Foundation maintains a regularly updated LPR resource at eff.org/pages/license-plate-readers.