California ALPR Privacy Lawsuit Wave Hits Businesses [2026]

A parking garage in San Francisco just became the reason law firms across California are telling clients to open their ALPR files. In February 2026, the First District Court of Appeal ruled in Bartholomew v. Parking Concepts, Inc. that a business running automated license plate reader (ALPR) cameras without a published, compliant privacy policy can be sued — even if nobody's data was ever misused. The California Supreme Court declined to review the decision in May 2026, so it stands.

Since then, reported filings have hit shopping malls, hotels, office parks, medical centers, parking operators, big-box retailers, and grocery chains. The statute behind it, part of the Civil Code's ALPR title (the "1798.90.5" family of sections), carries liquidated damages of $2,500 per violation — multiplied by every person whose plate was scanned during the class period. For a mid-size property with regular foot and vehicle traffic, that math gets uncomfortable fast.

This piece walks through what the ruling actually says, what the underlying statute requires, and where a tool like BGBlur's license plate blur genuinely helps — and where it doesn't. The short version: BGBlur protects you on the publishing side, when ALPR or security footage leaves your internal system and goes public. It is not a substitute for the usage-and-retention policy your ALPR system itself is required to have.

What Did Bartholomew v. Parking Concepts Actually Decide?

The court held that operating an ALPR system without implementing and publicly posting the required usage and privacy policy is, by itself, a legally cognizable harm — not a "bare technical violation" as the trial court had characterized it. The plaintiff alleged Parking Concepts collected his license plate data at a garage it operated without making any privacy policy publicly available. The trial court dismissed on the theory that he hadn't shown actual injury from misuse of the data.

The Court of Appeal reversed, reasoning that the statute grants individuals a "right to know" who is collecting their ALPR data, for what purpose, and how long it's kept — and that denying someone that information is itself the harm the legislature intended to remedy, independent of any downstream breach or misuse. Reported case coverage puts the opinion at 118 Cal. App. 5th 438, originally filed February 5, 2026 and modified on denial of rehearing February 27, 2026. The California Supreme Court denied review on May 13, 2026, closing off further appellate correction in the near term.

That combination — no need to prove misuse, plus a $2,500 statutory floor per violation — is what turned a previously dormant law into an active litigation vehicle almost overnight.

What Does California's ALPR Statute Actually Require?

Policy, Retention, and Purpose Limitation

California's ALPR law requires any "ALPR end-user" — public or private — to maintain a written usage and privacy policy covering the authorized purposes for collecting and using plate data, retention periods and the process for determining deletion, who can access the information, and the security safeguards protecting it. Under Civil Code section 1798.90.51, that policy must be available in writing and, if the entity operates a website, posted conspicuously on it.

The statute doesn't cap retention at a single fixed number for private end-users the way it does for the CHP (60 days, per separate provisions covering state agencies) — instead it requires the end-user to define and publish its own retention period and destruction process. Purpose limitation matters too: ALPR information can only be accessed and used for the purposes the policy actually discloses, and reasonable security procedures — administrative, technical, and physical — must protect the data from unauthorized access or disclosure.

The Private Right of Action and Statutory Damages

The private right of action lives in Civil Code section 1798.90.54, which lets a harmed individual sue for actual damages or liquidated damages of $2,500, whichever is greater, plus punitive damages for willful or reckless violations and reasonable attorney's fees. Before Bartholomew, several trial courts required plaintiffs to show real injury beyond the missing-policy technicality. That's the exact reading the Court of Appeal rejected.

Who Is Getting Sued, and Why Is the Exposure So High?

Any commercial property using plate-reading cameras for parking enforcement, access control, or loss prevention counts as an ALPR "end-user" under the statute — regardless of whether it owns the camera hardware or contracts a vendor like Flock Safety or a parking management company to run it. That's a far broader net than most operators assume; you don't need to be a data broker or a law enforcement agency to fall inside the statute's reach.

Reported post-Bartholomew filings and law-firm client alerts describe class actions against:

• Shopping malls and retail centers using plate cameras at parking structure entrances
• Hotels with gated or camera-monitored parking for guests
• Parking operators running paid garages and surface lots
• Office parks and medical campuses using ALPR for access control
• Grocery chains and big-box retailers with loss-prevention plate cameras

Because damages run per person whose plate was scanned rather than per incident, and California's applicable limitations period can reach back several years, commentary on the litigation surge has floated per-property exposure scaling into the tens of millions of dollars for a single high-traffic location over a multi-year class period. That's why property managers, parking operators, and retail security teams who treated their ALPR policy as a back-office formality are now moving it to the top of the legal risk register. Our California CCPA video privacy guide covers the broader California consumer-privacy backdrop this sits inside — CCPA/CPRA classifies license plate images as personal information too, so ALPR exposure often compounds with consumer-privacy obligations rather than existing in isolation.

Does a Compliant ALPR Policy Cover You Once Footage Gets Published?

No — and this is the distinction businesses most often get wrong. A compliant usage and privacy policy under section 1798.90.51 governs how your internal ALPR system operates: what it collects, who can query it, how long it's retained, and what purposes it serves. That's a policy, IT-configuration, and legal-documentation exercise, and BGBlur doesn't touch it — you need counsel and your camera vendor to build and publish that policy correctly.

But the moment footage from that system — or from any adjacent security camera, dashcam, or incident-report video — gets pulled out and published externally, a different exposure point opens up. A marketing team clipping a parking-lot promo reel, a security team sharing an incident video with an insurer, or a social media post showing "a day at our property" can all end up broadcasting readable license plates to an audience the original ALPR policy never contemplated. That's not a retention or purpose-limitation problem anymore; it's a publication problem, and it sits closer to general privacy and publicity exposure than to the ALPR statute itself.

This is exactly where a redaction tool earns its keep — not as a substitute for the underlying policy, but as the last step before footage leaves the building. Our guide on license plate redaction and why it matters goes deeper on why publishing unredacted plates creates liability independent of how the footage was originally collected.

How BGBlur Reduces Exposure on the Publishing Side

BGBlur's license plate blur automatically detects and tracks plates across video frames — including handheld footage, security camera exports, and dashcam clips — and blurs them before the video is shared or published. It runs entirely in the browser, so footage never has to leave your device to a third-party server for processing, and uploaded files are deleted within 24 hours regardless of whether you export the result.

For teams handling footage adjacent to an ALPR system, that covers several recurring scenarios:

• Marketing and social content: Property walkthroughs, event recaps, or "behind the scenes" clips shot in a parking structure or lot often catch dozens of plates in the background. Blurring them before posting removes the readable data without reshooting.
• Incident reports and insurance claims: Security teams sharing clips with an insurer, a corporate office, or a claims adjuster can redact bystander plates while keeping the plate relevant to the actual incident visible if needed, or blur all plates if the claim doesn't require them.
• Public records and FOIA-adjacent releases: Properties that share footage in response to a request or a media inquiry can redact third-party plates without redacting the whole frame.
• Demo and training content: Security vendors and property managers producing sales or training material from real camera footage can blur plates (and faces) so the same clip can be reused publicly.

Processing supports up to 4K output, batch handling for multiple clips at once, and the same motion-tracked detection that BGBlur uses for dashcam footage — a use case that overlaps directly with fleet and delivery-vehicle ALPR-adjacent footage.

What BGBlur Does Not Do — and Why That Distinction Matters

BGBlur is not a policy-drafting tool, a data-retention system, or a substitute for legal review of your ALPR vendor contract. If your business runs ALPR cameras and hasn't published a compliant usage and privacy policy under section 1798.90.51, redacting outbound footage won't close that exposure — the missing policy is the violation Bartholomew addresses, and it exists independent of anything you publish.

Practically, that means two separate workstreams for any business running plate cameras:

1. Fix the ALPR system itself. Work with counsel to draft and publicly post a usage and privacy policy covering purpose, retention, access, and security — and audit whether your camera vendor's default retention settings match what you're prepared to disclose publicly.
2. Fix what leaves the building. Any time footage from that system (or an adjacent security or dashcam feed) gets exported for marketing, claims, media, or public release, redact plates and faces before it goes out.

Skipping the first step and doing only the second leaves you exposed to a Bartholomew-style claim regardless of how careful your publishing process is. Skipping the second while nailing the first still risks separate publicity and privacy claims the moment plates show up in a public post. Retail security teams evaluating their overall footage-handling process may also find our body cam and FOIA redaction guide useful for structuring both workstreams side by side.

How to Redact Plates Before Publishing Footage: A Step-by-Step Approach

1. Identify what's leaving the internal system. Before any clip from a security, ALPR-adjacent, or dashcam source goes to marketing, social, an insurer, or a public request, flag it for a privacy pass.
2. Upload the clip to BGBlur. The tool runs in-browser — no install, and nothing is stored beyond the 24-hour processing window.
3. Let AI detect plates automatically. Motion-tracked detection follows plates across frames, including moving vehicles and changing angles, without manual frame-by-frame masking.
4. Choose what else needs blurring. Bystander faces, addresses, or other identifying details can be redacted in the same pass using BGBlur's face blur and object blur tools.
5. Export and publish. Output supports MP4, MOV, and WebM up to 4K, so the redacted clip is ready for social media, a claims portal, or an internal report without extra conversion steps.

This workflow doesn't touch your ALPR system's internal policy — it's a pre-publication safeguard that sits downstream of whatever compliance program your legal team builds for the camera system itself.

Who Should Be Paying Attention to This Right Now?

Mall and shopping center operators running ALPR at garage entrances are among the most frequently named defendants in reported post-Bartholomew filings — any public-facing parking structure is a natural target for a class claim.

Hotels with gated or camera-monitored parking face the same exposure, often compounded by long guest-list retention windows that make an unpublished policy look worse in discovery.

Third-party parking operators managing lots for multiple properties carry exposure across every site they operate, multiplying the class size if the same non-compliant policy (or lack of one) applies system-wide.

Retail security and loss-prevention teams publishing or sharing footage externally — for social proof, press, or law-enforcement cooperation — need the publishing-side redaction workflow regardless of how their ALPR policy shakes out.

Dashcam and delivery fleet operators capturing plates incidentally during normal driving footage face a lighter-touch version of the same publishing risk when dashcam clips get posted or submitted as evidence; see our guide to blurring any dashcam video for the broader anonymization workflow.

Pro Tips for Reducing ALPR-Adjacent Publishing Risk

1. Separate the two workstreams explicitly. Give your legal team ownership of the ALPR policy and retention audit, and give your marketing/security ops team ownership of pre-publication redaction — don't let one team assume the other has it covered.
2. Default to blurring all bystander plates, not just the ones directly relevant to an incident, when footage is going anywhere public.
3. Audit vendor defaults. Many ALPR vendors set default retention windows that don't match what a business is prepared to disclose in a public policy — check before you publish anything.
4. Batch-process backlog footage. If your team has months of stored clips destined for marketing or training use, run them through a redaction pass before archiving rather than one at a time as needed.
5. Document the redaction step. Keeping a record that outbound footage was screened for plates and faces strengthens your position if a dispute ever arises over a specific published clip.

The Bottom Line

Bartholomew v. Parking Concepts didn't create new obligations — it just removed the argument that a missing ALPR privacy policy is harmless on its own. Combined with a $2,500-per-violation statutory floor and no misuse requirement, that's enough to turn a compliance afterthought into active litigation risk for any mall, hotel, parking operator, or retailer running plate cameras in California.

Fixing the underlying policy is a legal and IT project outside what any blur tool can solve. But the moment footage from those systems — or adjacent security and dashcam feeds — gets published, shared with an insurer, or posted publicly, a separate and very solvable risk opens up. BGBlur's automatic, motion-tracked license plate blur closes that publishing-side gap in minutes, without reshoots, manual masking, or sending footage to a third-party server. If your team is auditing its ALPR exposure this year, pair the policy fix with a publishing-safe workflow — try BGBlur's license plate blur tool on your next outbound clip and see the redaction applied automatically.

Update — August 6, 2026: Bartholomew is a statutory privacy-policy claim under California's ALPR law — a different legal theory from the Fourth Amendment challenge now playing out in Kansas. See our breakdown of Grimmett v. Wichita and the "GPS tracking device" argument against warrantless ALPR surveillance, plus the parallel Flock Safety and Motorola/Vigilant class actions over unauthorized data sharing.