In February 2026, the California First District Court of Appeal held that, at the pleading stage, the plaintiff had sufficiently pled that a parking garage’s failure to publicly display an automated license plate recognition (“ALPR”) usage and privacy policy violated California Civil Code Section 1798.90.51(b).
The case, Bartholomew v. Parking Concepts, Inc., 118 Cal. App. 5th 438 (1st Dist. Feb. 5, 2026), as modified on denial of reh’g (Feb. 27, 2026), review denied (May 13, 2026), has driven a new wave of putative class action filings, plaintiff recruitment campaigns, and investigations into ALPR operators and vendors, including shopping malls, hotels, office parks, and medical centers.
Businesses using an ALPR system, even those that maintain only a single camera or collect ALPR information from only a single, easily avoidable location, may be sued under the statute without sending a pre-suit cure notice. Importantly, a court may award “[a]ctual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500),” as well as punitive damages, attorney fees, and injunctive relief. Cal. Civ. Code § 1798.90.54(b).
The ALPR Statute’s Requirements
Under Section 1798.90.51(b), an ALPR system operator must implement a usage and privacy policy that ensures “the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties.” The statute requires various disclosures to be listed in the policy, including why the operator uses the ALPR system to collect information, how and why the operator may share information with third parties, how the operator will ensure the accuracy and security of the information, and how long the operator will retain the information.
The statute does not define the authorized purposes for using an ALPR system nor prescribe how an operator should protect or share ALPR information. Rather, the statute requires transparency: an operator must make the policy “available to the public in writing” and, if the operator has a website, post the policy conspicuously on that website.
Section 1798.90.53(b) also has substantially similar requirements for ALPR end-users with some subtle differences covering the access of ALPR information, the designation of an owner of ALPR information, and the implementation of a process for periodic system audits.
Subsequent Class Action Lawsuits
Following this appellate decision, there has been a noticeable increase in putative class actions filed across California courts. ALPR operators and end-users in high-traffic areas, such as healthcare facilities and retail chains, are particularly vulnerable to inflated class sizes (or mass arbitration actions) due to the potential recoverable statutory damages.
Recommendations for Compliance
Businesses using an ALPR system, whether as an operator or an end-user, should first ensure they have an ALPR usage and privacy policy in compliance with this law. Businesses should also confirm whether vendors receive ALPR information and implement contractual safeguards with them to mitigate any potential violations of this law.