Oregon

Oregon ALPR law

ORS § __. ___ [Added by 2026 c. 77 § 4 to 9]

Before deploying or using an ALPR, law enforcement agencies must establish and publish policies and procedures for the use of an ALPR and the use, storage, and retention of captured data. Policies must include requirements for system and data security, access controls, hot list of accuracy, authorized user training, data retention and destruction, audit processes, and prohibition on use that would violate state law. Law enforcement agencies may only use ALPR systems for specified purposes including identifying vehicles used in crimes, vehicles registered to persons with outstanding warrants, vehicles associated with missing persons, uninsured vehicles, unregistered vehicles, parking regulation and access control. Data not related to court proceedings or ongoing investigations must be retained for no more than 30 days, while data related to court proceedings or investigations may be retained for the same period as other evidence. Agencies may compare data only with specified databases including Department of Transportation records, NCIC databases, Law Enforcement Data System, FBI records, and hot lists that are frequently updated. Officers must include specific information in search entry logs including authorized user identifiers, employing agency, search inputs, date and time, case numbers, law enforcement purpose, and crime type if applicable. Officers must visually confirm vehicle characteristics to match alerts before conducting traffic stops based on automated alerts. Law enforcement agencies may not provide access to data to any governmental entity or agency not created pursuant to the Oregon Constitution or state laws except under specified circumstances. Contracts with third party vendors must specify that data is the agency's property and not owned by the vendor, vendor access requests including warrants and subpoenas must be directed exclusively to the law enforcement agency, data must be encrypted using end-to-end encryption, vendor must comply with FBI Criminal Justice Information Services Security Policy, and vendor may be held liable for misuse or improper release of captured license plate data. Requires a vendor audit process. Prohibits vendors from accessing, disclosing, selling, sharing or otherwise using data. Creates a civil action for an individual to sue the vendor if data is disclosed, shared, sold, etc. Provides exceptions for existing contracts for ALPR systems and makes the law applicable upon the expiration of the existing contract, prohibits extension or renewal of existing agreements.

Summary quoted from NCSL, Automated License Plate Readers: State Statutes, updated September 28, 2026. Not legal advice; read the statute.