Out in Public: Plate Readers, Face Scans, Events and Protests

Once you leave the house, most of the cameras pointed at you belong to someone else, and you cannot switch them off. The policy story lives in How License Plate Readers Work, the plate reader benefits, misuse and law lesson and the facial recognition lesson.

The threat: who is watching once you are out

Plate readers, and how one town's camera becomes a national search

A plate reader is a camera on a pole, a patrol car or a trailer that photographs every passing vehicle. Software reads the plate and saves it with the time, the place and the picture. Flock Safety, the largest seller to local police, says its cameras capture plates and "key vehicle characteristics, such as make, color, and body type," and that users can search full, partial and temporary plates. DeFlock adds features like dents, roof racks and bumper stickers. So a car can be found with no plate number at all. A white pickup with a ladder rack is a search.

One camera on one pole would be a small worry. The reach comes from the database behind it. Flock says customers "control their own data retention and sharing settings," and it advertises a network covering 49 states. When an agency turns sharing on, every agency it shares with can search its cameras. EFF counts at least 4,000 agencies able to search parts of Flock's network.

In May 2025 EFF, building on reporting by 404 Media, described a search by a Texas sheriff's officer looking for a woman who had self-managed an abortion. The logged reason read "had an abortion, search for female." That one search reached more than 83,000 cameras in 6,809 Flock networks, including networks in Washington and Illinois, where abortion is legal. The sheriff called it a missing-person search for her family. EFF later reported that deputies had queried the data in an abortion investigation.

In August 2025 Illinois Secretary of State Alexi Giannoulias said an audit showed U.S. Customs and Border Protection had accessed Illinois plate data, which state law limits for out-of-state abortion and immigration cases. Flock paused pilots with CBP and Homeland Security Investigations, and WTTW reported the company now limits federal agencies to one-to-one searches with specific police departments instead of blanket national or statewide sweeps.

Idaho Code 49-1432, added in 2025, limits police use of plate reader data to investigating crimes and traffic accidents and searching for missing or endangered people. It bars personal use, political activity, unrelated surveillance, and traffic tickets unless an accident is involved. Every query must be logged with the user, date, time and purpose, and agencies must audit those logs twice a year. The statute sets no retention limit and says nothing about sharing with agencies in other states. How long your drives sit in a database, and who outside Idaho can search them, comes down to each agency's settings.

The people most exposed are those whose regular stops say something private: a clinic, a church, a union hall, a support group, a new address after leaving an abusive home. The statute's ban on "personal use" points to the other risk. The person most likely to look up your car for no good reason may be someone with a login who knows you.

Face recognition in stores and venues

Face recognition turns a face into a set of numbers, called a template, and compares it with other templates. A "match" is only a similarity score that cleared a threshold someone picked. One-to-one checks you against one photo, the way TSA compares your face to the ID you hand over. One-to-many compares you against a whole watchlist, which is what a store does to spot past shoplifters. Errors pile up in the second kind, because every name on the list is another chance for a false hit, and grainy photos make it worse.

The clearest case on record is the FTC's December 2023 action against Rite Aid. From 2012 to 2020 the chain ran face recognition in hundreds of stores, matching shoppers against a watchlist built from tens of thousands of images, many low quality, taken from security cameras, employees' phones and news stories. The FTC said the system produced thousands of false matches. It matched shoppers to people enrolled for incidents thousands of miles away and flagged the same person at dozens of stores. False matches were more likely in plurality-Black and Asian communities. Rite Aid never tracked its error rate and discouraged employees from telling customers about the system. Employees acting on alerts followed people, searched them, called police and accused them of shoplifting in front of friends and family.

Rite Aid was banned from face recognition for surveillance for five years. The order also requires it to delete the images, to tell people when they are enrolled, and to post clear notice in stores. That last part matters to you, because a posted notice is how most shoppers learn a scan is happening.

Stadiums and concert venues add their own cameras, and ticket terms often carry a separate privacy policy. Airports run two face checks. TSA's checkpoint photo is optional, TSA says photos are not stored after a match except in limited testing, and travelers under 18 are not photographed. CBP's photo at international gates is optional for U.S. citizens, and CBP says it keeps their photos no more than 12 hours after verification.

Your phone as the witness: geofence warrants

Cameras have to see you. Your phone reports you without being seen. For years Google's Location History kept a running log of where its users went, for everyone who had it turned on. Police learned to ask Google for every device inside a drawn circle at a set time. That request is a geofence warrant.

The Supreme Court ruled on one this year. On May 20, 2019, a man robbed a credit union in Midlothian, Virginia, of $195,000. Investigators got a warrant for a 150-meter circle around it. Google returned anonymized data on 19 accounts, then more data on nine, then names for three. Okello Chatrie was one of them. The opinion notes Location History logged a phone's position "every two minutes or so," often within 20 meters. On June 29, 2026, in Chatrie v. United States, the Court held 6 to 3, in an opinion by Justice Elena Kagan, that getting that data was a Fourth Amendment search, because a person has a legitimate expectation of privacy in cell phone location data. It left the warrant's validity for the Fourth Circuit to decide.

Two facts from the opinion matter for you. Nineteen people landed in step one just for being nearby, and at a protest or a stadium that circle holds thousands. And the opinion says Google began storing Location History on individual devices in July 2025 and can no longer answer geofence warrants for that data. That closes one door. Phones still connect to cell towers, and EFF warns that apps can save GPS positions and send them later.

Protest day

A protest stacks all of these threats in one place. EFF's Surveillance Self-Defense guide, last reviewed June 26, 2026, lays them out. Reporting suggests police use Clearview AI to identify people in protest photos. In February 2026 Biometric Update reported that federal agents in Minneapolis were using Clearview AI and a phone app called Mobile Fortify on protesters and observers. EFF has seen plate readers used to track protesters. A transit card linked to your name can place you at the station nearest the march. A seized phone can be run through a forensic tool such as Cellebrite to pull photos, contacts, messages and location history. Photos posted by other marchers can let police or vigilantes find people. And EFF notes there is currently less legal protection against being forced to open a phone with your face or finger than against being forced to give up a passcode.

Organizers carry the most risk, along with anyone whose face ends up in a viral photo and anyone whose job, immigration status or safety depends on not being seen at a particular cause.

How to reduce it

Level 1 Everyday

The cheapest win in public is saying no to a scan that is optional. Declining the airport photos keeps your face out of one matching system on one day. It does not stop any other camera in the terminal or change what is on file from your passport or license, and since TSA and CBP say they keep few photos, the gain is modest.

The other Level 1 move is taking off any plate cover. It invites a stop under 49-428(2), and a traffic stop puts your name and plate on an officer's report anyway.

Level 2 Careful

You cannot opt out of a plate reader on a public road. You can know where they are. DeFlock's crowd-sourced map shows reported cameras. Knowing that the road past your clinic or church has two cameras lets you pick another route on the days that matter, which is legal. It does not stop the cameras you do pass, and the map is incomplete, so treat a blank area as unknown, never as clear.

For stores and venues, the defense is reading before you walk in. A business that will not answer a plain question about face recognition has told you something. If you are wrongly flagged, an FTC complaint will not undo a bad day at the register. It does put the incident on record with the agency that brought the Rite Aid case.

Level 3 Private

Protest-day habits answer the phone side of the threat: geofence sweeps, forced opening and seized-phone extraction. A passcode instead of a face or fingerprint addresses forced opening. Airplane Mode with Wi-Fi, Bluetooth and location off cuts most live reporting, though only turning the phone off is sure. Signal with disappearing messages limits what a seized phone still holds about your group. None of this hides your face from a camera, your plate on the drive in or your transit tap.

Level 4 Hardened

If you organize events or have a specific reason to fear being identified, the phone you bring matters more than its settings. Carry an old or prepaid phone with only Signal and the contacts you need, as EFF suggests, and leave your everyday phone at home. That breaks the link between the event and your daily life. It fails if both phones travel together, since EFF warns they can be linked by their locations. Turn the second phone off before you head home. Cost: an extra device and the discipline to keep it clean.

Masks come up every time, so here is only what the record shows. In 2026 two Idaho House bills, H0489 and H0685, targeted wearing a mask or disguise while committing a crime, with a sentencing enhancement. The Legislature's pages show H0489 returned to committee on January 27 and H0685 passing the House 38 to 31 on March 5, then referred to Senate Judiciary and Rules with no later action listed. Neither became law, and neither targeted lawful mask-wearing. Other states and cities have their own rules, so check before you travel to an event.

Level 5 Hyper-vigilant

Here you bring no phone, or only a powered-off one in a tested Faraday bag, and plan meeting points on paper. That defeats geofence sweeps and seized-phone extraction. It does nothing about your face, and it leaves you with no maps and no fast way to call for help, so go with someone who carries a working phone. Lesson 9 covers bags and testing.

The ladder for this topic