This bill creates a new chapter in Title 10 RCW establishing rules for automated license plate reader (ALPR) systems and driver privacy protections. It generally forbids state and local agencies from operating or accessing ALPR systems or ALPR data except for specific, authorized uses: law enforcement comparisons with specified federal and Washington databases for investigations involving stolen vehicles, missing or endangered persons, persons with outstanding felony or gross misdemeanor warrants, or vehicles related to a felony or gross misdemeanor; parking enforcement for enforcing local ordinances with limited plate databases; and transportation uses such as real-time traffic information, traffic studies, and commercial vehicle enforcement at weigh stations. The bill also declares agencies operating ALPR systems to be the legal owners of the data they collect and bars certain uses and collections, including for immigration enforcement, monitoring protected health care services, and collecting data on the premises or immediate surroundings of specified sensitive facilities (health care providers, immigration facilities, schools, places of worship, courts, food banks). The law imposes operational and procedural limits: agencies using ALPR must register systems with the Attorney General within 180 days, maintain audit trails of all access (retained two years), conduct annual internal audits, and check/apply database updates at least every 24 hours. ALPR data retention is generally limited to 21 days with enumerated exceptions for retained evidence, parking enforcement (12 hours after final disposition), traffic studies (30 days), commercial vehicle enforcement (six months), and evidence in specified investigations; a positive ALPR match alone does not constitute reasonable suspicion for a stop. The bill bars agencies and vendors from selling, leasing, or otherwise providing ALPR data to nonauthorized entities, allows privately held ALPR data to be obtained only by a court-issued probable cause warrant, and makes ALPR data exempt from public disclosure under the Public Records Act except for limited, non‑identifiable bona fide research. The measure creates new enforcement and remedies: vendors must implement technical controls to prevent unauthorized sharing and may not change sharing permissions without agency consent; evidence obtained by knowing violation of the chapter is inadmissible in state courts except in a limited damages action; willful, intentional unauthorized querying, access, use, retention, sale, or dissemination of ALPR or audit trail data is a gross misdemeanor; injured persons may bring civil actions for equitable relief and damages with potential attorneys’ fees; the Consumer Protection Act applies to certain contracting persons. The Attorney General must publish model ALPR policies by July 1, 2027, agencies must adopt or explain departures and submit annual reports by December 1, 2027, and the act takes effect immediately. Important details are missing from the extracted text: the exact new RCW chapter number, some formal statutory definitions, the remainder of Section 5 and any additional enforcement or procedural provisions that may appear elsewhere.

If enacted, the law will force every state and local agency that operates or uses automated license plate readers to register their systems, adopt or explain policies based on Attorney General model rules, and change how they collect, store, share, and justify ALPR data. Agencies will need to purge most plate data within about three weeks (with narrow exceptions), keep two years of detailed audit logs, run annual internal audits, update vendor contracts and technical controls to block unauthorized sharing (including with federal immigration enforcement), and avoid scanning at or immediately around schools, health care sites, places of worship, courts, food banks, or immigration facilities. Law enforcement will also have to stop relying on a positive ALPR hit alone to stop a vehicle and must corroborate plate information before acting. The most affected parties are agencies that operate ALPRs and the vendors that supply them: they will face new recurring costs for compliance (registration, training, audits, reporting to the Attorney General and legislature, website posting), limits on monetizing or sharing data, and legal risks including a gross misdemeanor for willful misuse and civil liability for people harmed by violations. The Attorney General must produce model policies and reports by late 2027, and the act takes effect immediately, but some important statutory details and definitions and the complete text of certain operational rules and enforcement procedures are not present in the provided excerpts, leaving some implementation specifics unclear.