On November 10, the Virginia State Crime Commission voted on penalties for police agencies and officers that break the state's license plate reader law. It recommended a $5,000 minimum civil penalty for each record shared against the rules, standards for decertifying officers who break the sharing rules, and an exception that lets agencies share data with federal or out-of-state agencies without a court order when there is an "imminent threat of bodily harm," according to the Virginian-Pilot, the Virginia Mercury and WTOP. The commission did not recommend a ban.
The vote followed a statewide survey of how police use the cameras. "Seems to me that we need probably stronger consequences for law enforcement agencies that are not following the laws that we pass," Sen. Scott Surovell, a Fairfax Democrat, said when the findings were presented on November 5, WTVR reported.
The recommendations go to the General Assembly, which returns on January 13. None of them is law yet.
Facts are current as of November 14, 2026.
What the survey found
Most of Virginia's plate reader law took effect on July 1, 2025. In August 2026, commission staff surveyed every law enforcement agency in the state. The commission's report, posted for its November 5 meeting, gives these numbers:
| Finding | Number |
|---|---|
| Agencies that answered | 351 of 359 (98%) |
| Agencies that use plate readers | 191 of 351 (54%) |
| Agencies with no policy | 6 |
| Agencies that kept data longer than 21 days | 7 |
| Agencies that shared data on a continuing basis with other states' agencies | 4 |
| Agencies that shared data on a continuing basis with federal agencies | 1 (it no longer uses plate readers) |
| Agencies that reported unauthorized use by their own employees | 20 of 191 (10%) |
| Agency policies staff could not find posted online, though the law requires it | 59 of 178 (33%) |
The report gives examples of unauthorized use: searches run for federal or out-of-state agencies, and officers searching their own plates. "As of October 19, 2026, five charges involving one individual were filed in one district court and two charges involving another individual were filed in another district court," the report says. The charges appear to be related to cases in James City County and Chesterfield County, the report says, and all of them are pending.
Since the survey went out in August, at least 27 localities have announced they are re-assessing their use of the cameras, WTVR reported, and the Virginian-Pilot puts the number of agencies ending or re-evaluating their programs at more than 40. Henrico County ended its Flock contract on October 14 and county crews took down the cameras, WTVR reported. Richmond will not renew its contract, which runs to June 30, 2027, the Commonwealth Times reported.
What the commission recommended
Reports of the November 10 meeting give these details:
- The fine. The Virginian-Pilot reported "$5,000 for each record shared" against agencies that do not follow the rules. The Virginia Mercury described a $5,000 minimum civil penalty with each unlawfully shared record counted as a separate violation. WTOP reported a "$5,000 minimum civil fine for each record that's shared."
- Who enforces it. The Mercury reported enforcement power for local prosecutors. WTOP reported power for the attorney general to bring criminal cases.
- Audits. WTOP reported support for "an independent, random auditing process."
- Officers. The Pilot reported a recommendation to decertify officers who break the sharing rules. The Mercury reported that the commission "voted to establish standards," with final steps left to the legislative session.
The commission's own slides for the meeting say only: "Various measures could be adopted to monitor and enforce law enforcement agency compliance with the ALPR statute." It has not posted minutes.
"It's important that there's sufficient consequences, not just for individual police officers that are looking up their neighbors or boyfriends or girlfriends, or whatever, but also for the law enforcement agencies that don't seem compelled to follow the laws that we pass," Surovell said on November 10, per the Mercury.
What Virginia's law says now
The rules are in Va. Code § 2.2-5517:
- Retention. "System data shall be purged after 21 days of the date of its capture." Audit trail data is kept for two years. Data tied to an open investigation or case is kept until it ends.
- Uses. Police may use plate readers only for criminal investigations with reasonable suspicion, for missing or endangered people and human trafficking, and for alerts on warrants and stolen vehicles or plates.
- Sharing. Data may not go into "any database of any other state, federal, private, or commercial entity." Sharing is allowed with another police agency for the listed uses, with prosecutors, with the defense for discovery or a court order, under a court order or court-issued subpoena, with the vendor for maintenance, and to alert the public to an emergency, a missing or endangered person, a human trafficking case or a person with an outstanding warrant.
- The audit trail. Every search logs the date and time, what was searched, the purpose, a case or call number, and the username. Agencies must audit their own use at least once every 30 days.
- Penalty. Anyone who "willfully and intentionally" uses the system for another purpose, or shares data against the rules, "is guilty of a Class 1 misdemeanor." The Virginian-Pilot reports that this carries up to 12 months in jail or a $2,500 fine. The seven pending charges were filed under this section, per the commission's report.
- Public reports. Agencies report to the State Police by April 1 each year, including camera counts, search counts and "the number of identified instances of unauthorized use." The State Police send a statewide report by July 1. Each agency "shall publicly post the policy" and its report.
What you can see, and what you cannot
The law keeps the raw records private. "System data and audit trail data shall not be subject to disclosure under the Virginia Freedom of Information Act," it says. A Virginia resident cannot get the search log by records request.
What a Virginia resident can get:
- Your police department's policy. The law requires it to be posted. Check the department's website. Commission staff could not find 33% of policies online. If yours is not there, ask the department where it is posted.
- Its annual report. The first agency reports are due April 1, 2027, and the first State Police statewide report by July 1, 2027. They include the number of identified cases of unauthorized use.
- The contract. The law's records exemption names system data and audit trail data. A city's contract with a vendor such as Flock is a separate record. Our Flock camera guide explains how to ask for one in a public records request.
- A say in the bills. The commission's recommendations go to the General Assembly session that starts January 13. Find your delegate and senator at whosmy.vga.virginia.gov.
Outside Virginia
Rules differ by state. Ohio, for example, has no statute on plate readers, according to the National Conference of State Legislatures' state-by-state summary, updated September 28. The ACLU of Ohio says four bills were introduced in September, including SB 469, which would require deletion after 10 days, and HB 1009, which would make misuse a fifth-degree felony. The ACLU of Ohio says it does not expect them to pass before the session ends in December.
The NCSL summary lists each state's rules. Our Flock camera guide covers how to find out whether your town uses the cameras and how long it keeps the data.
Frequently asked questions
How long can Virginia police keep license plate reader data?
21 days from capture, unless the data is tied to an open investigation or case. Audit trail data is kept for two years.
Is misusing plate reader data a crime in Virginia?
Yes. Willfully using the system for an unauthorized purpose, or sharing data against the rules, is a Class 1 misdemeanor. As of October 19, 2026, seven charges against two people were pending.
Can Virginia police share plate data with ICE or other states?
The law bars putting the data into any other state's or federal database, and the commission's report says agencies may not share it with out-of-state or federal agencies without legal process such as a court order or subpoena. The Crime Commission recommended allowing sharing with federal or out-of-state agencies without a court order when there is an imminent threat of bodily harm. That is a recommendation, not law.
Can I get my town's plate reader search log in Virginia?
No. The law exempts system data and audit trail data from the Virginia Freedom of Information Act. Agencies must post their policy and an annual report, the first due April 1, 2027.
Is the $5,000 fine law?
Not yet. It is a Crime Commission recommendation for the 2027 General Assembly session, which starts January 13.
