California parking operators face $2,500 ALPR policy risk

Parking BOXX published a guide on California’s ALPR privacy-policy rules as lawsuits multiply over operators that use plate-reading systems without public policies. The company says the law can trigger liability even without a data breach, putting parking operators, property managers, retailers, HOAs and public agencies at risk.

Why it matters: - California’s ALPR law can expose parking and property operators to statutory damages of $2,500 per violation, plus attorney’s fees. - The requirement applies to the technology in use, not the type of business running it, which broadens the compliance risk. - Operators that miss the policy requirement can face lawsuits even if no plate data is stolen or misused.

What happened: - Parking BOXX published an educational guide on California’s Automated License Plate Recognition privacy-policy requirements for parking operators and property managers. - Aaron Asp, CEO of Parking BOXX, said the guide is meant to help property owners understand that the camera technology, not whether parking is free or paid, triggers the law. - The guide is available at the company’s blog post.

The details: - California Civil Code §§ 1798.90.5–1798.90.55 requires a written ALPR usage and privacy policy to be made public by any operator or data user of a true ALPR system. - The rule applies to parking facilities, property managers, retailers, HOAs and public agencies. - A standard security camera does not trigger the statute, but a dedicated plate-reading system does. - If an operator has a website, the policy must be posted conspicuously online. - Posting the policy only at the physical location does not satisfy the statute. - Civil Code § 1798.90.54 gives harmed parties a private right of action. - A 2026 California appellate decision, Bartholomew v. Parking Concepts, Inc., said operating ALPR technology without a publicly posted policy is enough to trigger liability. - Within six weeks of that ruling, four class actions were filed statewide, including one against ALPR vendor Flock Safety. - At least eight more investigations were underway, and additional suits later targeted Home Depot’s California stores and Motorola’s Vigilant ALPR network. - The most recent of those suits was filed in June 2026. - The guide also says policies can fall short when a third-party vendor operates the ALPR system. - The full guide includes a downloadable compliance reference, sample policy language and an explainer video. - Parking BOXX advises having any policy reviewed by qualified legal counsel before publishing it. - Parking BOXX said it has more than 85 years of parking industry experience and operates across North America. - The company provides parking revenue systems, parking management systems, pay stations and access control.

Between the lines: - The wave of lawsuits suggests California plaintiffs are testing the statute aggressively, especially against visible operators and vendors. - The legal exposure appears to hinge on documentation and public disclosure, not just on data-security incidents. - Third-party vendor arrangements may not insulate property owners from compliance obligations.

What’s next: - Parking operators and property managers are likely to review whether their cameras qualify as true ALPR systems and whether their policies are publicly posted. - More litigation is possible while California’s ALPR rules remain under ongoing legal challenge. - Operators considering new or existing ALPR deployments may need counsel review before publishing or updating a policy.

The bottom line: - In California, ALPR compliance is not optional, and a missing public policy can become a costly lawsuit trigger.