LPR Cameras in Parking Lots: Privacy Policy and Retention Rules

If your parking lot runs license plate recognition (LPR) cameras, you need a written data policy. It should say why you collect plates, who can see them, who you share them with, and how long you keep them. Cities are cutting retention to 30 days or less, and California courts now let drivers sue lots that skip the policy.

What changed this month

Two city decisions in October 2026 show where LPR rules are heading.

On October 15, the Tempe City Council voted 6-1 to permanently ban city use of LPR cameras, according to AZFamily. The ordinance also destroys existing city LPR data. Tempe had 33 Flock cameras. The ban covers the city. It does not cover the 20 cameras Arizona State University runs on its Tempe campus.

In Kansas, Overland Park police cut LPR data retention from one year to 30 days, KCUR reported on October 13. The new rules also require monthly search audits. They ban freeform searches and require a written request before data is shared with an agency that has no agreement in place.

Neither rule targets private parking lots. But they set the bar that drivers, boards and courts will compare you to.

The state laws already on the books

LPR law is a patchwork. At least 16 states have LPR-specific statutes, according to a July 2026 analysis in the National Law Review. About eight set retention limits. Roughly six restrict private or government use outright.

Four states passed new LPR laws Washington, New Mexico, Kentucky and Connecticut, per MultiState. Connecticut caps retention at 21 days unless the data is needed for a legitimate law enforcement purpose. Indiana, Nevada, Ohio, Utah and Virginia have said they will take up the topic next session.

Some states let drivers sue. Arkansas allows actual damages or $1,000 in liquidated damages, whichever is greater. Nebraska allows a private damages suit. Washington's SB 6002 adds a civil remedy.

The takeaway for owners: the rule that applies to your lot depends on the state. A portfolio that spans states needs one policy that meets the strictest one.

California: the policy is the whole case

California is the sharpest risk. Its LPR statute, Civil Code sections 1798.90.5 to 1798.90.55, covers private operators, not just police.

Under section 1798.90.51, an LPR operator must post a written usage and privacy policy. If you have a website, the policy must be posted there in a conspicuous place. At a minimum, it must cover seven things:

1. The authorized purposes for using the system.
2. The job titles of staff and contractors with access, and their training.
3. How the system is monitored for security and legal compliance.
4. The rules for selling, sharing or transferring plate data.
5. The title of the official custodian responsible for the policy.
6. How you keep data accurate and fix errors.
7. How long you keep data and how you decide when to destroy it.

In Bartholomew v. Parking Concepts, Inc. (Feb. 5, 2026), a California appeals court held that a garage's failure to post its policy was enough to plead a violation, according to McGuireWoods. The court treated the driver's "right to know" as the harm. Review was denied May 13, 2026.

The damages floor is $2,500 per violation, plus possible punitive damages and attorney fees. McGuireWoods reports a "noticeable increase" in class actions since the ruling. Suits can be filed with no cure notice, even against a business with one camera.

How long should a parking lot keep plate data?

Keep it only as long as the business purpose needs. For most lots, that is short.

Map each use to a retention window:

• Paid parking and permits. You need the entry and exit reads to bill a session or confirm a permit. Once the session is paid and the dispute window closes, the raw read has done its job.
• Violations. Keep reads tied to an open citation or notice until it is resolved or appealed. Delete the rest on schedule.
• Security incidents. Hold specific records under a written incident hold. Do not keep every read "just in case."
• Reporting. Use counts and occupancy totals. They do not need plate numbers.

Use the strictest benchmark that applies to you. Connecticut's 21-day cap and Overland Park's 30-day window are useful reference points. Write the number into the policy, set the system to auto-delete, and audit that it happens.

Short retention cuts risk on two fronts. Less stored data means less to lose in a breach. It also means less to hand over when someone asks.

Sharing rules: vendors, police and tow operators

Most LPR data leaves the lot through a vendor. Your camera maker, software platform, payment app and enforcement contractor may all touch it.

Take these steps:

1. List every party that receives plate data. Include cloud hosts and analytics tools.
2. Put limits in each contract. Name the purpose, the retention window, a ban on resale, and breach notice duties.
3. Set a police request process. Require a written request with a case number and stated purpose, the same standard Overland Park now uses for outside agencies.
4. Turn off default network sharing unless you have decided, in writing, to allow it.
5. Log every search. Review the log monthly.

Remember that the policy must name a custodian. Pick a title, not a person, so the role survives staff turnover.

A 10-point LPR checklist for owners and boards

Use this list at your next board or asset review:

1. Confirm which states and cities your lots sit in.
2. Check each state's LPR statute for retention caps and private-use rules.
3. Write one usage and privacy policy that covers all seven California elements.
4. Post it on your website and at lot entrances.
5. Set a retention number for each use and turn on auto-delete.
6. List every vendor that touches plate data.
7. Add data terms to every vendor contract.
8. Assign a custodian by job title.
9. Train every staff member who can search the system.
10. Audit searches and deletions every month.

This is general information, not legal advice. Have counsel review your policy for each state you operate in.

How Wins Parking handles LPR programs

Wins Parking designs, installs and manages LPR camera programs for owners across the country. Our parking management services cover permits, paid parking, enforcement and revenue reporting.

On a new site, our Wins Design & Build team plans camera locations, power, data runs and signage during design, so the policy notice is part of the build. On an existing lot, we audit the cameras, software and vendor contracts you already have. Then we set retention windows, sharing rules and audit routines that fit your state.

We also tie LPR into the rest of the operation. That includes permit lists, enforcement practices and payment systems. For a primer on how the cameras work, see our LPR systems guide. Results from our programs are on our case studies page.

Next step

Want a second look at your LPR setup before a driver or board asks? Call (970) 279-1744 or start at https://winsparking.com/contact.