Your license plate has a price, and the government isn't the only buyer

By Jarom Gillins, Director of Policy. October 6, 2026.

In this statement

Where the evidence comes from
The network keeps running after a city cancels
Private networks already sell plate and driving data to insurers
Utah's limits apply to government holders
What Utah cannot currently see
What UCC asks lawmakers to consider
Sources

Where the evidence comes from

This statement follows UCC's September 9, 2026 paper, If Weber County Followed the Law, How Did This Happen?, which looked at the contracts Utah agencies sign. That paper closed by describing a duty to protect privacy from our own government and from entities profiting off our private lives and habits.^[1] It dealt with the first part of that duty, and this statement deals with the second. The evidence comes from the Utah Code as currently in force, the vendor's published customer terms, Federal Trade Commission orders and findings, a Utah Privacy Commission task force report and reporting from other states, and each source is attributed where it is used.

The network keeps running after a city cancels

Lawmakers have started asking who controls the government's share of this data. At the Law Enforcement and Criminal Justice Interim Committee on September 16, 2026, Sen. Calvin Musselman asked whether the agency or the vendor controls Utah-generated data, and other lawmakers asked whether Utah data could be used to train artificial intelligence.^[2] In its final report, presented to the Government Operations Interim Committee on September 23, 2026, the Utah Privacy Commission's ALPR Task Force recommended that government ownership extend to "raw camera data" and "derived information," with vendors acting only as custodians.^[3] Those are the right questions for the government's side of the network, but the recommendation is limited to data collected by or on behalf of a Utah governmental entity, and the same questions have not been asked about the network's private customers.

Surveillance network vendors, Flock among them, sell directly to homeowners associations, property managers and businesses. Inman, citing the Electronic Frontier Foundation, describes how a police department can reach feeds from other agencies and from private cameras across the country, depending on how each customer has set its sharing, and notes that for an association's cameras that decision sits with the board.^[4] Flock's published terms apply to public and private customers alike, and the permitted purpose they describe expressly includes business purposes and the prevention of commercial harm.^[5] Flock has said that a private business owns and controls its own data, that sharing is off by default, and that sharing happens only when the customer chooses it.^[6] UCC takes that statement at face value. It describes the customer's data and says nothing about what the vendor keeps, and it leaves every decision about Utahns' data with a private party operating under no public rule.

Cancelling a contract does not change any of that. After the Los Angeles Police Department let its Flock contract expire, Knock LA reported that a neighborhood association had raised $200,000 in 2024 to pay for Flock cameras of its own, with an informal understanding that LAPD would eventually take over ownership and control of the data.^[7] Some private customers also share well beyond their own property. Records the Electronic Frontier Foundation obtained from the Johnson County, Texas Sheriff's Office showed that the office could tap into Flock cameras at 173 Lowe's locations around the country and at dozens of Home Depot stores in Texas,^[8] and later reporting described Lowe's as sharing with departments across state lines.^[9] In Ohio, shared-network records obtained by the Dayton Daily News showed local departments with access to Lowe's and Home Depot camera data from stores across the state.^[10] When agencies in other states search cameras located in Utah, that raises a Fourth Amendment question this statement does not take up. Its concern is the private side of the network.

Private networks already sell plate and driving data to insurers

Plate data collected by private parties is already bought and sold. Digital Recognition Network, now part of Motorola Solutions, sells plate-reader cameras to repossession agents, buys back the plate sightings those cameras collect, and sells access to that data to insurers and lenders, among others. Insurance Business reported in 2017 that about 200 insurance carriers were paying for that access,^[11] and the company's website described its data as helping "insurers improve pricing at underwriting."^[12] When a California driver brought a class action under that state's plate-reader law, a California appellate court affirmed judgment for the company in July 2026, holding that plaintiffs must show actual harm beyond the invasion of privacy itself.^[13]

Driving data from connected cars has moved the same way. On January 14, 2026, the Federal Trade Commission finalized a 20-year order against General Motors and OnStar after finding that the company collected drivers' precise location and driving behavior and sold it to consumer reporting agencies, which packaged it into reports for insurers. The order bars GM from sharing that data with consumer reporting agencies for five years and requires drivers' affirmative consent going forward.^[14] A separate class action filed in April 2025 alleges that Toyota and an affiliate passed driving data to Progressive, and the court sent that case to arbitration under Toyota's terms.^[15] FTC staff have also reported that retailers frequently use personal information, including precise location, to set individualized prices for the same goods and services.^[16]

Utah's limits on selling and keeping plate data apply to government holders

Utah's plate reader law is among the strongest in the country for government use. A Utah governmental entity may not sell captured plate data, may use it only for the purposes the statute lists, and may keep it for no longer than nine months.^[17] Those rules are written for the government holding the data, so the same identifying data about the same Utahns carries almost none of them once a private customer or the vendor holds it, and the people it describes learn how it was used, if at all, after the fact. UCC's concern is that difference in obligation. UCC does not object to cameras or to a commercial market for data.

The difference grows as the sensors change. Leonardo markets SignalTrace, first reported by 404 Media in June 2026, as an add-on to plate reader deployments that captures Bluetooth, Wi-Fi and RFID signals and links them to vehicles.^[18] The company also pitches it to retailers, and its own materials describe deploying it in retail parking lots and inside shopping centers to track the movements of people involved in organized retail crime.^[19] Because an RF sensor converts no plate image, SignalTrace is not a license plate reader system as Utah law defines one, and the plate reader law would not reach it at all.

What Utah cannot currently see

Logan shows how little of this is visible. The Herald Journal reported that the city of Logan has installed no Flock cameras and that every Flock camera within city limits is private, located in commercial parking lots.^[20] Utah's limits on selling and keeping plate data reach none of those cameras, and whether they, or any other privately paid-for camera in Utah, feed a shared network is not publicly known. UCC has found no record of SignalTrace or a comparable RF sensor in Utah, but nothing in Utah law would require a private operator to disclose one, and what vendors keep and derive from Utah data is described only in their own terms. Utah currently has no way to find out.

What UCC asks lawmakers to consider

For lawmakers

A business watching its parking lot and an association watching its entrance are ordinary uses of a camera, and none of what follows is aimed at them. UCC's interest is what happens to identifying data after it is captured, whoever holds it. Each direction below already has a model in Utah law, and the problem it addresses is the same in any state where these networks operate.

Rules can be written around the system instead of around who pays for it. The definitions in our September 9 paper turn on recognition: a persistent identifying system records an identifier so it can be recognized on later, separate occasions. A mapping service that photographs a street captures plates in passing without recording them to recognize again, while a surveillance network is built to do exactly that, so the same test can reach a privately paid-for network, and any sensor it uses, as readily as a government one.

Utah already bars government from selling captured plate data or using it outside the purposes the statute lists.^[17] Comparable limits could follow persistent identifying data into private hands, or could be made conditional on the affirmative consent of the person the data describes, which is what the FTC now requires of General Motors.^[14]

Utah also requires genetic testing companies to insist on valid legal process before disclosing genetic data to law enforcement or any other government entity.^[21] A duty like that falls on the party actually holding the data, so it applies wherever the request comes from.

The Department of Transportation already keeps a record of every special use permit it issues to a law enforcement agency for a plate reader, along with its stated purpose.^[22] A similar record for fixed identifying systems visible from public roads, showing who authorized and pays for each one and whether it feeds a shared network, would let a Utahn who sees a camera find out what it is connected to.

Once identifying data captured in Utah is pooled into a national or international network, no Utah rule on how long it is kept or what it is used for can follow it, regardless of whether a government or a private party paid for the camera. The Task Force recommends keeping government-collected data out of such networks because Utah cannot control access to the data or carry out required deletion once it is mixed with data from other jurisdictions.^[3] The records from Texas and Ohio show private cameras already feeding networks like these elsewhere, and UCC asks lawmakers in Utah and elsewhere to consider whether their residents' data should enter them at all.

Sources

The paper this statement follows

The September 9 paper read Utah's plate reader law against the contract Weber County signed. This statement takes up the second half of the duty it described.

Read the September 9 paper See the underlying records