Records show UC Merced police is sharing license plate data with border patrol
Several federal and out-of-state agencies — including the Border Patrol — have access to the UC Merced Police Department’s license plate reader data, despite a California law prohibiting information sharing outside the state.
Automated license plate reader technology helps law enforcement recover stolen vehicles, locate missing persons, identify vehicles connected to violent crimes and support time-sensitive and ongoing investigations.
A list of all agencies that the department shares with and receives detection data from was shared with the Merced Sun-Star. The document was obtained through a Public Records Act request.
Under state law, ALPR data sharing is limited to California public agencies.
The nine federal agencies that have access to UC Merced’s data include the U.S. Marshals Service, the San Diego Sector Border Patrol and the U.S. Secret Service. It also shares the data with 187 non-California entities in 38 states.
Four cameras, through the vendor Motorola Solutions, are located at the campus’s main entrance, at Bellevue and Lake roads, where more than 9,000 students enter each day. There’s also one in the Bellevue parking lot.
This makes it nearly impossible for anyone who drives onto campus to avoid the cameras.
Mike Katz-Lacabe, director of research at Oakland Privacy, said this is of big concern to undocumented students at the university, especially with graduation around the corner, bringing thousands of families to campus.
“The fact that a police department is currently in violation of California state law is very disturbing. And in a way, that in particular puts their student population at risk,” Katz-Lacabe said.
UC Merced is a Hispanic-serving institution with a 58.2% Hispanic student population and has previously stated its commitment to welcoming and supporting undocumented students.
The university did not respond to a list of questions from the Merced Sun-Star, but instead sent a statement. “The use of this technology is intended to be in compliance with California state law on how information is collected, stored, shared, and used,” it reads. “We are currently conducting a review of the technology, the associated policies, and prior usage to ensure our practices continue to meet legal requirements and community expectations.”
The university did not clarify whether it was aware that ALPR data is being shared with agencies outside of California.
Privacy concerns with ALPR data sharing
ALPR data sharing could unintentionally aid federal or out-of-state agencies with enforcing immigration law and abortion bans, among other things.
For example, if a woman traveled to California from Texas to seek an abortion, a Texas agency could search its license plate reader database for her license plate and determine she was in another state.
Some agencies outside of California also work with immigration through the 287(g) Program, which reimburses local agencies for working with Immigration and Customs Enforcement.
Earlier this month, 404 Media reported that Florida’s Fish and Wildlife Conservation Commission police were performing dozens of license plate lookups on Flock cameras for ICE.
“So even if you thought you weren’t sharing it for immigration enforcement, because you’re sharing it with the FBI, who historically did not do immigration enforcement — surprise, you are now,” Katz-Lacabe said.
California law limits to data sharing
Senate Bill 34, which went into effect in 2016, requires operators of ALPR systems to implement strict privacy and security policies, maintain access logs and protect license plate data as sensitive personal information that cannot be sold to private parties.
In 2023, the state Attorney General’s Office issued guidelines, reminding agencies of their obligation to ensure their data cannot be shared with agencies outside of California.
Katz-Lacabe, who regularly files Public Records Act requests on ALPR sharing, said he too often sees agencies sharing ALPR data with federal and out-of-state agencies.
Organizations like Oakland Privacy have been trying to get guardrails, transparency and accountability around license plate readers for several years, Katz-Lacabe said. His organization has particularly been trying to place limits on data retention.
Most law enforcement departments use whatever the vendor’s default settings are, which for the popular vendor Flock Safety is 30 days.
“As the data is your property, it is held according to the retention policy set forth by you,” states Motorola Solutions, in a FAQ document.
According to UC Merced PD’s policy manual, all ALPR data downloaded to the server is stored for a minimum of one year.
“Thereafter, ALPR data should be purged unless it has become, or it is reasonable to believe it will become, evidence in a criminal or civil action or is subject to a discovery request or other lawful action to produce records,” the policy states.
Agencies on the receiving end of the data would continue to have access to information shared by others beyond that timeframe only if it’s associated with a case or active investigation.
Modesto police’s ALPR sharing lapse
In March, the Modesto Police Department discovered, while preparing a response to a Public Records Act request, that several federal agencies had access to information from its ALPR system.
According to audit queries, MPD changed its data-sharing settings on Feb. 23, before releasing the public record and revealing the sharing lapse on social media over two weeks later.
The Police Department stated it immediately disabled the identified connections, conducted multiple reviews to ensure no out-of-state or federal access remains active and implemented mandatory monthly compliance audits. It also strengthened policy language to clarify legal sharing limits and increased administrative oversight of the ALPR program.
“In the interest of transparency, we are sharing this information with our community. We will continue to review our systems and practices to ensure they align with both legal requirements and community expectations,” the department stated in a Facebook post.
