AI Frontier Institute

Providing for automated license plate reader systems; imposing duties on the Pennsylvania State Police; and imposing penalties.

View primary source →

Pennsylvania House Bill 2825 (2026) has not been enacted. It was referred to the House Judiciary Committee on 2026-10-05. If enacted, it would add Chapter 75 to Title 44 to regulate automated license plate reader (ALPR) systems used by local police, campus police and the Pennsylvania State Police. Contracts (§ 7503): Agency–vendor ALPR contracts would have to require vendor compliance. They would make ALPR and audit trail data the agency's exclusive property. They would require 60 days' notice before any transaction giving a foreign adversary an ownership or controlling interest in the vendor, and let the agency terminate without penalty if that happens. They would require the vendor to purge data after the retention period and cooperate with audits. Vendor limits (§ 7504): Vendors could not share data with third parties without written authorization in the contract. They could not sell or license data. They could not add facial, gait, biometric or cell-device tracking. They could not give data to a foreign adversary. They could not use data commercially. Section 7504(b)(5) would bar using ALPR data, directly or indirectly, to train, develop, test, validate or improve AI, machine learning, behavioral prediction or consumer profiling systems. Vendors would act only as custodians. Retention (§ 7504(d)): Agencies must purge data within six months, unless it is preserved as evidence in a criminal case, a pending or reasonably anticipated civil action, or as otherwise provided by law. Audits (§ 7505): Agencies would audit compliance annually, or hire an independent entity to do so. They would submit results to State Police within 30 days. State Police could audit agencies and vendors. Noncompliance would have to be remedied promptly. Vendor access (§ 7506): Vendor maintenance access would require express agency authorization, be time-limited, and be recorded in an audit trail. Permanent or continuous remote access would be barred. Police use (§ 7507): Use would be limited to official law enforcement or public safety purposes. A search warrant would be required for sustained monitoring of a person's or vehicle's movements, or for reconstructing patterns across multiple days and locations. Exceptions would cover alert verification and locating stolen, wanted or missing-person-related vehicles. Personal, political or commercial use would be prohibited. Users would have to document each query. Sharing, including with federal agencies, would have to be logged. Agencies would have to publish notice 30 days before deploying a system. Good-faith users would get immunity from civil liability and administrative discipline. Security (§ 7508): Data would have to be stored in the U.S., follow FBI CJIS and CLEAN requirements, and be encrypted. Vendors would have to notify agencies immediately of security incidents. State Police would issue regulations. Audit trails would be kept at least five years. Records (§ 7509): ALPR data and audit records would be exempt from the Right-to-Know Law. Enforcement (§ 7510): The Attorney General could sue vendors or authorized users who willfully violate the chapter. Courts could issue injunctions, order data destroyed, impose civil penalties up to $25,000 per violation, and award costs. The act would apply to contracts entered into on or after its effective date (Section 2) and would take effect in 60 days (Section 3).

← Back to the tracker