# Arkansas Automatic License Plate Reader System Act The Arkansas statute that governs who may operate automatic-license-plate-reader systems in the state, what may be done with captured data, how long it may be kept, and what must be reported or made public. Codified at **Ark. Code Ann. §§ 12-12-1801 – 12-12-1808**, it was created by **Act 1491 of 2013** and materially amended by **Act 668 of 2025**, approved April 16, 2025. > [!success] Act 668 source gap resolved 2026-07-20 > The official enacted PDF is archived from the Arkansas General Assembly and independently matches the copy ARDOT produced ([[Act 668 of 2025]]; primary public record, [Act 668 of 2025](../../web%20archive/2026-07-20/arkleg.state.ar.us/act-668-2025.md)). The May 2022 FindLaw/Justia reproductions below remain useful only for provisions Act 668 did not amend and for the **pre-Act-668 baseline**; their stale “single enactment” history cannot establish current law. The Act is the statute Conway PD invokes — together with three Arkansas FOIA exemptions and the federal Driver's Privacy Protection Act — to withhold network-sharing, federal-search, hot-list, and audit-log records in `PD-2026-477`. See [[Custodian Response Letter]] and [[2026-05 Conway PD PD-2026-477 Withholding Response]]. ## The statute, section by section - **§ 12-12-1801 — Title.** The short-title section (primary public record, [Ark. Code § 12-12-1801](../../web%20archive/2026-05-22/codes.findlaw.com/ark-code-12-12-1801.md)). - **§ 12-12-1802 — Definitions.** Defines "captured plate data" as "the global positioning device coordinates, date and time, photograph, license plate number, and any other data captured by or derived from any automatic license plate reader system," and provides that "[c]aptured plate data shall not include any personal data." Also defines "alert," "automatic license plate reader system," "governmental entity," and "secured area" (primary public record, [Ark. Code § 12-12-1802](../../web%20archive/2026-05-22/codes.findlaw.com/ark-code-12-12-1802.md)). - **§ 12-12-1803 — Restrictions on use.** Act 668 retains law-enforcement comparison with OMV, ACIC, NCIC, an ongoing-investigation law-enforcement database, and the FBI for lawful purposes. It also authorizes defined parking, secured-area, private-property/public-safety, and Arkansas Highway Police weigh-station uses (primary public record, [Act 668 of 2025](../../web%20archive/2026-07-20/arkleg.state.ar.us/act-668-2025.md), pp. 1-2). - **§ 12-12-1804 — Protections.** Act 668 establishes a **60-day cap for private landowners/leaseholders/commercial businesses** and a **150-day cap for other eligible entities**, subject to law-enforcement preservation during an ongoing investigation and destruction when the investigation ends without charges or the criminal action concludes. It adds 24-hour governmental update language when updates are available, preserves the evidence-of-an-offense sharing rule, limits compelled non-law-enforcement release through the enacted subpoena provision, and restricts private third-party processing by contract and a 60-day limit (primary public record, [Act 668 of 2025](../../web%20archive/2026-07-20/arkleg.state.ar.us/act-668-2025.md), pp. 2-3). - **§ 12-12-1805 — Practice and usage data preservation.** Covered public users must compile specified statistics every six months for public review, preserve them 18 months, and make capture/retention/destruction policies publicly available. The required figures include scans, lists checked, confirmed matches, non-correlating matches, and arrest/prosecution outcomes. Failure to promulgate the required policies is grounds for evidentiary exclusion. Private users compile scan/match figures every six months and provide them to the Legislative Council when its chairs request them (primary public record, [Act 668 of 2025](../../web%20archive/2026-07-20/arkleg.state.ar.us/act-668-2025.md), pp. 4-5). - **§ 12-12-1806 — Use of data and data-derived evidence.** Excludes captured plate data and derived evidence from any proceeding if the disclosure would violate the subchapter (primary public record, [Ark. Code § 12-12-1806](../../web%20archive/2026-05-22/codes.findlaw.com/ark-code-12-12-1806.md)). - **§ 12-12-1807 — Penalties and enforcement.** The preexisting private-remedy provisions remain; Act 668 adds Attorney General enforcement through the Deceptive Trade Practices Act (primary public record, [Act 668 of 2025](../../web%20archive/2026-07-20/arkleg.state.ar.us/act-668-2025.md), p. 5). - **§ 12-12-1808 — Privacy.** Provides that captured plate data "may be disclosed only" to the person to whom the vehicle is registered, after that person's written consent, or "[i]f the disclosure of the data is permitted by the Driver's Privacy Protection Act of 1994, 18 U.S.C. § 2721 et seq." It also states that practice-and-usage data are "a public record for purposes of the Freedom of Information Act" (primary public record, [Ark. Code § 12-12-1808](../../web%20archive/2026-05-22/law.justia.com/ark-code-12-12-1808.md)). ## How it appears in the corpus - **The semi-annual LPR reports are the Act's § 12-12-1805 "practice and usage data."** Conway PD's semi-annual License Plate Reader reports — [[LPR Report First Half 2025]] and [[LPR Report First Half 2025 (PD-2026-477 Copy)]] — record exactly the fields § 12-12-1805(b) enumerates (plates scanned, hot lists checked, hits/matches, outcomes). Conway PD treats these reports as the public-facing compiled data the Act requires. - **The PCSO § 12-12-1805 report names the statute by section.** [[Pulaski County Sheriff's Office]]'s January 1 – May 19, 2026 practice-and-usage report ([[PCSO ALPR Six-Month Practice and Usage Report]]) states on its face that it is "compiled pursuant to Arkansas Code Annotated § 12-12-1805." It reports 1,422,898 plates scanned and 2,092 alerts — released only after a FOIA filing covering the same period — and states under "Match Outcomes Detail" that PCSO "does not currently track" the arrest-and-prosecution figures § 12-12-1805 enumerates. - **The 150-day public-entity ceiling recurs, but it is not the whole current rule.** CPD Policy 800-32 cites 150 days, while the Conway Flock contract uses a 30-day platform setting ([[CPD Policy 800-32 — License Plate Reader Vehicle Operations]], [[Flock Safety Order Form]]). Act 668 now pairs the 150-day ceiling for eligible public users with 60 days for private users and a defined investigation/criminal-action preservation-and-destruction rule. See [[Flock Audit Logs and Retention]]. - **The sharing provisions bear on the Conway network topology.** Section 12-12-1804(d) bars selling, trading, or exchanging captured plate data and permits law-enforcement-to-law-enforcement sharing only of data "that indicates evidence of an offense." The `PD-2026-354` production documented a 1,384-organization Flock sharing topology configured as a default-on platform state ([[SharedNetworks 2025-12-17 Snapshot]], [[Default-On Surveillance Data Sharing as Operational Model]]). The wiki records the statute and the documented practice; it does not adjudicate their relationship. ## The PD-2026-477 withholding framework In [[Custodian Response Letter]], Conway PD builds its withholdings on a public-versus-non-public distinction drawn from this Act, combined with three Arkansas FOIA exemptions and the federal DPPA: - **The Act.** The Department treats the compiled § 12-12-1805 practice-and-usage data as public, and treats "individual Flock Safety platform records" — search logs, query records, audit logs, network-sharing exports, hot-list records — as "captured plate data" or data "derived from" an ALPR system within § 12-12-1802, disclosure of which is restricted by § 12-12-1808. - **Arkansas FOIA § 25-19-105.** The Department cites three exemptions: **(b)(6)** (undisclosed law-enforcement investigations of suspected criminal activity), **(b)(11)** (computer-system and network security measures and access controls), and **(b)(13)** (personal contact information of nonelected employees) (primary public record, [Ark. Code § 25-19-105](../../web%20archive/2026-05-22/codes.findlaw.com/ark-code-25-19-105.md)). - **The Driver's Privacy Protection Act.** Section 12-12-1808's disclosure restriction carves out disclosure "permitted by the Driver's Privacy Protection Act of 1994, 18 U.S.C. § 2721 et seq." The [[DPPA (Driver's Privacy Protection Act)|DPPA]] (18 U.S.C. ch. 123, §§ 2721–2725) governs disclosure of personal information from state motor-vehicle records (primary public record, [18 U.S.C. ch. 123 — DPPA](../../web%20archive/2026-05-22/govinfo.gov/usc-18-chap123-dppa.md)). *Observation, distinct from the record:* the Act's § 12-12-1808(a)(2) and § 12-12-1805 make the compiled practice-and-usage data a public record, and the Act does not by its terms classify platform audit logs or network-sharing exports. Whether the operational records Conway PD withholds in `PD-2026-477` are "captured plate data" within § 12-12-1802, and whether the FOIA exemptions reach them, is a contested legal question; the wiki records the Department's stated position and the statutory text and does not resolve it. ## Timeline - **2013** — The Automatic License Plate Reader System Act is enacted by Act 2013, No. 1491. - **2025-04-16** — Act 668 is approved, expanding authorized uses and materially amending retention, update, sharing, reporting, policy, evidence, and enforcement provisions (primary public record, [Act 668 of 2025](../../web%20archive/2026-07-20/arkleg.state.ar.us/act-668-2025.md)). - **2026-05-22** — Conway PD invokes §§ 12-12-1802, 12-12-1805, and 12-12-1808 of the Act, with FOIA § 25-19-105(b)(6)/(11)/(13) and the DPPA, to withhold records in `PD-2026-477` ([[2026-05 Conway PD PD-2026-477 Withholding Response]]). - **2026-05-22** — Pulaski County Sheriff's Office releases its § 12-12-1805 six-month practice-and-usage report (the corpus's second § 12-12-1805 instance after Conway PD's semi-annual reports), with outcomes "not currently tracked" ([[PCSO ALPR Six-Month Practice and Usage Report]]). - **2026-07-08** — ARDOT's post-comment 12 CAR 150 draft ties permitted use to § 12-12-1803 and corrects its interagency-sharing reference from § 12-12-1803 to § 12-12-1804 ([[July 7 2026 Post-Comment LPR Rules Draft]], ¶¶ P0044, P0057). The disposition workbook says the sharing-citation error was inherited from the ASP rule ([[July 10 2026 Public Comment Dispositions]], `Sheet1!D16:E16`). ## Application to the Arkansas State Police (ASP) — 2024-2026 The 2026-06-05 ASP production ([[_overview|`arkansas-state-police/2026-06-05-batch-1-fiscal`]]) extends the Act's coverage to the corpus's first state-LE-agency. ASP is a "governmental entity" within § 12-12-1802's definition (the statute applies to any LE-agency operator of an ALPR system); ASP's documented procurement of an [[ELSAG ALPR Systems|ELSAG]] system from [[Leonardo US Cyber and Security Solutions, LLC]] is governed by §§ 12-12-1801-1808 on the same footing as Conway PD, LRPD, and PCSO's Flock systems. The ASP procurement raises several Act-application questions specific to state-LE deployment: - **§ 12-12-1803 permitted comparisons.** The Act permits ALPR comparisons against OMV, ACIC, NCIC, "a database created by law enforcement for the purposes of an ongoing investigation," and the FBI. ASP's procurement bundles a **One Time [[HIDTA LPR Network]] License** ([[Term Contract 4600055190 and PO 4502235324 — Initial Leonardo ELSAG Buy|PO 4502235324]], p. 26). Whether the HIDTA LPR Network qualifies as one of § 12-12-1803's enumerated permissible comparisons — or whether it operates outside the statute's permitted-use list — is an open Act-application question. - **§ 12-12-1804 retention, updates, destruction, and sharing.** The Act generally caps ASP's captured-plate retention at 150 days, permits case-related preservation only through the defined investigation/criminal-action conclusion, requires destruction at that point, and requires 24-hour captured-data updates when available. It restricts inter-LE-agency sharing to data “that indicates evidence of an offense.” ASP's configured retention, update history, preservation cases, destruction events, and dissemination logs are not yet documented in the corpus. The HIDTA LPR Network's data-flow architecture remains an application question. - **§ 12-12-1805 practice-and-usage report.** The Act requires every 6 months a public-facing practice-and-usage report (plates scanned, lists checked, alerts, outcomes). ASP's first § 12-12-1805 obligation will come due after its first 6-month period of operation — likely the second half of 2025 if the system became operational in March 2025 per the Leonardo pick-list dates. The report is not in this batch. Future production batches (Items 2 + 3) may surface it; if not, it is a future-FOIA target. - **§ 12-12-1806 use of data and § 12-12-1807 penalties.** Standard statutory provisions; not separately addressed in this batch. - **§ 12-12-1808 disclosure.** Practice-and-usage data are public records for FOIA purposes. Whether ASP's compiled § 12-12-1805 reports have been (or will be) disclosed to FOIA requesters is a future test. ## Act 668 of 2025 — enacted amendment and ASP's internal understanding The 2026-07-07 ASP production contains an **internal summary** of Act 668 (Tier-1 evidence of ASP's understanding, not legal authority) ([[Act 668 of 2025 — Internal ALPR-Law Summary]]; Tier-1 corpus, `Re_ LPR Law Amendment .msg`). The independently archived enacted act confirms the summary's principal subjects (primary public record, [Act 668 of 2025](../../web%20archive/2026-07-20/arkleg.state.ar.us/act-668-2025.md)): - **§ 12-12-1803** — expands authorized users beyond law enforcement to private landowners/leaseholders/commercial businesses (under conditions) and names the **[[Arkansas Highway Police]]** for commercial-vehicle compliance at weigh stations; - **§ 12-12-1804** — sets tiered retention (private 60 days; governmental 150 days; law-enforcement active-investigation until conclusion), bars commercial sale/trade of plate data, and requires subpoenas to compel release from non-LE users; - **§ 12-12-1805** — retains six-month public reporting (plates scanned, alerts, outcomes) and 18-month preservation, and adds Legislative Council reporting for private users; - **§ 12-12-1807** — adds Attorney General enforcement under the Deceptive Trade Practices Act. The email is substantially accurate at that level but compresses important enacted details: the 24-hour update clause, exact preservation/destruction triggers, subpoena language, third-party processor contract restriction, and evidentiary consequence for missing public policies. The official act, not the email, controls those propositions. - **Relevance to the Federal Public Defender dispute.** The [[Federal Public Defender FOIA and the No-LPR-System Position|Federal Public Defender]] argued (April 2025) that § 12-12-1805 keys on ALPR **"use,"** making ASP a governmental "user" subject to the Act regardless of whether it "has" a system — an argument that turns on the § 12-12-1805 obligation this Act (as amended) imposes. See [[T007 - ASP No-LPR-System Position vs Documented ELSAG Operation|T007]]. ## Relationship with A.C.A. § 27-52-110 (County Automated Enforcement Devices) The [[_overview|Pulaski County `#26-365`]] production surfaces a **separate Arkansas statute** that potentially intersects with the ALPR Act: **A.C.A. § 27-52-110** (Title 27, Chapter 52, Subchapter 1) — *"Automated enforcement device operated by county government or department of state government operating outside municipality"*. The Pulaski County procurement office included a copy of § 27-52-110 in the [[Pulaski County Flock Safety MSA and Order Form (Contract 6764)|Flock contract file]] as a reference exhibit. See [[A.C.A. § 27-52-110 — County Automated Enforcement Device Statute]] for the source page. § 27-52-110 differs from the ALPR Act in three key respects: | Dimension | ALPR Act (§§ 12-12-1801–1808) | § 27-52-110 | |---|---|---| | **Subject device** | Automatic license plate reader systems | "Automated enforcement device" — specifically requiring **speeding-violation detection** plus photo recording | | **Applies to** | Any "governmental entity" using ALPR | Only county / state-department LE agencies operating **outside a municipality** | | **Retention rule** | 60 days for private users; 150 days for other eligible entities; defined law-enforcement investigation/criminal-action preservation followed by destruction (§ 12-12-1804) | **Data not related to active investigation “shall not be retained”** by a county government (§ 27-52-110(e)) | | **Most recent amendment verified here** | 2025 (Act 668, approved April 16, 2025) | 2023 (Act 707, § 1; effective August 1, 2023) | **The threshold-application question.** Whether Flock Falcon cameras at PCSO are “automated enforcement device[s]” under § 27-52-110(a)(1)—which requires speeding-violation detection plus photographic recording—depends on the device and use. The PCSO records describe plate recognition/hot-list functions, not speeding enforcement. On that record, § 27-52-110 appears inapplicable; the current Act 668 framework in § 12-12-1804, not § 12-12-1808, supplies the ALPR retention rule. This is evidence analysis, not a legal ruling. If § 27-52-110 applied, its no-retention rule outside an active investigation would be stricter than both the Act 668 public-entity ceiling and a 30-day default platform setting. PCSO's contract file includes the statute without a produced legal opinion; inclusion alone does not establish what analysis the County adopted. ## Notes - The 2026-05-22 FindLaw/Justia reproductions remain archived for provisions Act 668 did not change and for historical comparison. Their “may not be the most recent version” warnings were material: their single-enactment history was stale. The authoritative 2025 amendment is the General Assembly's enacted PDF (primary public record, [Act 668 of 2025](../../web%20archive/2026-07-20/arkleg.state.ar.us/act-668-2025.md)); ARDOT's identical production copy is analyzed at [[Act 668 of 2025]]. - The companion § 27-52-110 statute was added to the corpus 2026-06-05 via the Pulaski County contract file (Westlaw printout). The corpus does not have a directly-archived Tier-2 copy of § 27-52-110 from arkleg.state.ar.us / codes.findlaw.com / govinfo.gov beyond the Westlaw reprint in the contract file. A Tier-2 archive of § 27-52-110 from a primary public-record source is an open follow-up. - This concept page concerns the statute. The technology it regulates is the subject of [[Automatic License Plate Reader (ALPR)]]; the local CPD policy implementing it is [[CPD Policy 800-32 — License Plate Reader Vehicle Operations]].