PROVIDENCE, RI — Rhode Island State Police have issued a statewide policy for automated license plate readers that lets data stay in police databases for as long as 30 days, even though camera maker Flock Safety now recommends a seven-day default.
The document gives the state its first written standards for Flock and other ALPR systems, but it also highlights how much is still unresolved. The rules are a template rather than a law, and the enforcement language depends on legal tools Rhode Island has not enacted. Gov. Dan McKee, who ordered the review, has asked lawmakers to turn the policy questions into binding rules next year.
McKee extended the camera pause after the original deadline passed
The policy grew out of McKee’s Aug. 18 decision to pause further expansion of automated plate readers. At the time, his office said State Police would not install or activate any more cameras and asked cities and towns to stop new deployments as well.
He gave State Police Col. Darnell Weaver and the Department of Public Safety 60 days to draft statewide standards with the Rhode Island Police Chiefs’ Association, the League of Cities and Towns and other stakeholders. Cameras already in use were allowed to keep operating. McKee said in announcing the pause that public safety and personal privacy are not mutually exclusive.
When that 60-day period expired on Oct. 19, the governor’s office did not lift the pause. Instead, it extended the hold indefinitely so lawmakers would have time to write legislation, according to Rhode Island Current. For State Police, that means a freeze. For local departments, it remains a request rather than a mandate.
The model policy limits use but allows police access after reasonable suspicion
The Statewide Automated License Plate Reader Policy is designed as a fill-in-the-blank document that departments can adopt and customize. Its opening language even leaves room for the agency name to be inserted. McKee is encouraging local police to use it, and a working group is supposed to review the policy each year.
Under the draft, ALPR data must be purged no later than 30 days after capture unless it is preserved for an investigation. Officers must also have reasonable suspicion that a crime was committed before searching the data. The policy bars use for traffic violations, unpaid fines, civil infractions, immigration enforcement, abortion restrictions, and actions that would infringe First Amendment rights or target people based solely on protected characteristics.
It also prohibits sharing data with U.S. Immigration and Customs Enforcement or any agency enforcing federal civil immigration law. Other police agencies can access the information only if they sign a written agreement promising to follow the same rules.
Plate readers check hot lists and store location data for later searches
Fixed plate readers photograph every passing vehicle, read the plate and then perform two tasks. First, they compare the plate against hot lists that can include FBI National Crime Information Center data, state DMV records and local lookout notices. Second, they store the read with a time and location so investigators can search it later.
The policy is careful to say an alert concerns a vehicle, not necessarily the driver. It also says an alert alone is not enough to justify a stop. Before taking action, officers must confirm the plate is still wanted and visually match the plate number, state and vehicle.
That distinction matters when plates are misread or when a stolen-vehicle entry has gone stale. The policy does not spell out exactly which DMV records enter the hot-list system, but quarterly audits and transparency portals are supposed to show more detail over time.
Flock shortened its own default retention period to seven days
The biggest gap in Rhode Island’s draft is the retention period. Police policy allows records to remain for 30 days, while Flock Safety said in August that its recommended default would move to seven days. The company said more than 90 percent of searches without a full plate happen within a week, which it used to justify the shorter setting.
Flock said existing customers could keep their current configurations, so departments already using a 30-day setting can adopt the state policy without changing anything. That means the new rules do not automatically force a shorter retention period. For privacy advocates, that difference is central because it determines how long a person’s travel history remains searchable.
Rhode Island’s policy says each department should also publish a transparency portal listing its hot-list sources, retention period, camera count and search activity. The Department of Public Safety, the police chiefs’ association, Providence police and the League of Cities and Towns are expected to review the policy annually.
ACLU says the draft leaves major privacy holes unresolved
The ACLU of Rhode Island said the draft offers less protection than it appears to promise. In a preliminary review issued the same day the policy was released, the group said the definition of a valid law-enforcement purpose is broad enough to cover almost any use unless a specific prohibition applies.
The group also criticized the 30-day retention period for being longer than Flock’s new default. It said the policy does not stop cameras from capturing people in a vehicle or block facial recognition. And while the draft warns that misuse could lead to criminal prosecution or civil liability, the ACLU said those consequences mean little without a statute creating a crime or a private right to sue.
The policy can support internal discipline, including firing an officer for intentional violations, but it cannot by itself create a lawsuit or exclude improperly gathered data from court, the group said.
Lawmakers will decide whether Rhode Island turns the policy into statute
Those questions were central to House Bill 8077, introduced Feb. 27 by Rep. Matthew Dawson of East Providence and nine co-sponsors. The bill would have required deleting plate data after 21 days, limited how cameras could capture vehicles, and sharply narrowed the purposes for which agencies could use the data.
It also would have required city and town council approval after a public hearing before new readers were purchased. The bill gave the attorney general power to seek an injunction, allowed lawsuits in superior court, and required improperly collected data to be destroyed and kept out of evidence except to prove the violation.
House Judiciary held the bill for further study on March 24, and it died when the session ended in June. A 2025 version met the same fate. McKee has said he will work with lawmakers to turn the draft into law, but the next General Assembly session does not begin until January 2027.
