Privacy
Colorado License Plate Reader Laws in 2026: What Cities, Schools and Property Owners Need to Know
Colorado does not have a comprehensive license plate reader law. No single statute tells a city, a school district or a homeowners association how long it may keep plate reads, who may search them or who they may be shared with. Instead, three general laws apply, and the rest is decided by your policy and your vendor contract.
That gap became a statewide argument in 2025 and 2026. A bipartisan bill to tighten the rules died in April 2026, and several Colorado agencies changed or ended their programs on their own. If you run license plate recognition, or are thinking about it, here is where things stand as of October 2026.
The three laws that apply today
1. The three-year limit on government surveillance records
Colorado's passive surveillance statute, C.R.S. 24-72-113, passed in 2014. It requires government passive surveillance records to be destroyed after the third anniversary of their creation. After the first year, a custodian may access them only for specific purposes, such as evidence in a felony criminal case or a civil, labor or administrative proceeding, and must log who accessed them and why.
Lawmakers described the bill at the time as covering license plate readers along with traffic and photo radar cameras, and sheriff's office ALPR policies in Colorado cite it. In practice, three years is a ceiling, not a target. Most agencies keep reads for 30 to 180 days.
2. The limit on sharing for immigration enforcement
A 2021 Colorado law limits state and local agencies from sharing personal identifying information for federal civil immigration enforcement, and a license plate number counts as personal identifying information. Colorado law also bars sharing related to reproductive health care. These rules bind the agency, and a vendor's national search network can undercut them if the settings allow outside agencies to query Colorado data.
3. Open records
Plate data and the contracts behind it can be subject to the Colorado Open Records Act or the Criminal Justice Records Act, depending on who holds them. Residents and reporters have used records requests to obtain contracts, retention policies and search audit logs. Assume your program's paperwork will be read in public.
What changed in 2025 and 2026
- 2025: reporting showed that police outside Colorado had run immigration-related searches against Denver's plate reader data through a national lookup network. Denver restricted access to Colorado agencies that spring.
- February 2026: Denver decided to replace its Flock cameras with a different vendor when the contract ran out.
- February 2026: SB26-070, sponsored by a Colorado Springs Republican and a Boulder Democrat, passed its first Senate committee. It would have required a warrant to search plate reader data more than three days after a crime, banned most out-of-state sharing, required access logs and limited retention.
- April 29, 2026: SB26-070 died on the Senate floor after strong law enforcement opposition and a veto threat from the governor.
- October 2026: the Custer County Sheriff's Office ended its Flock contract, citing privacy concerns about how plate databases had been used nationally.
The vendor at the center of the debate has said it supports legislation that creates guardrails for how plate data is used and shared, and it has added controls since 2025. The point for a Colorado buyer is not which logo is on the camera. It is whether your own program can show its rules on paper.
Why the contract now does the work the law does not
With no comprehensive statute, almost every rule that matters lives in your written policy and your vendor agreement. These are the terms we would want in writing for any Colorado program:
- Data ownership. The customer owns every plate read, image and hit. The vendor processes it only to provide the service.
- Retention. The customer sets it. Default reads expire on a short schedule, flagged evidence is preserved on purpose, and nothing outlives the three-year statutory ceiling.
- No default sharing. Nothing is visible to any outside agency or network until the customer creates a share, scoped to a named partner, revocable at any time.
- In-state controls. Settings that make the immigration and reproductive health care limits enforceable, not just written down.
- Hotlist control. The agency imports and manages its own hotlists, so it decides what the system looks for.
- Audit logs with stated reasons. Every search logged with user, time and case number, and the logs exportable for review.
- Breach terms. A defined penalty and termination right if data is shared outside the agreement. Denver's 2025 contract extension, for example, included $100,000 in damages for improper release.
If you are a school district or campus
Schools use plate recognition at entrances, staff lots and drop-off lanes to know which vehicles are on campus. The same rules apply. Decide in policy whether police may search your reads, under what conditions, and how that is logged. Keep retention short for routine reads. Publish a plain-language notice. Our earlier post on ALPR for school campus security covers deployment.
If you are an HOA, business or property manager
Private cameras are where most public objection starts, because residents did not vote on them and often do not know who can see the data. Before you buy, ask the vendor to show you, on screen, every agency or organization that can query your reads by default. If the answer is anyone you did not choose, change the setting or change the vendor.
How we deploy plate recognition in Colorado
We deploy Genetec's cloud plate recognition platform, which we compare in detail in CloudRunner vs Flock Safety. The customer owns the data, sets retention, imports its own hotlists and shares one partner at a time, with nothing shared by default. That makes the program defensible at a council or board meeting, because you can show the retention schedule, the sharing list and the audit log instead of describing them. See the CloudRunner ALPR product page and our privacy and data ethics commitments.
Where to go next
Plate recognition also runs parking programs, which raise their own questions. See how license plate recognition parking enforcement works. For fixed and mobile deployments, see law enforcement and parking enforcement.
This post describes Colorado law for planning purposes as of October 2026. It is not legal advice. Statutes, bills and vendor policies change, so confirm current requirements with your counsel before you sign or change a program. To walk through a plate recognition policy with your counsel in the room, call 303 596 7819.
Frequently asked questions
- Does Colorado have a license plate reader law?
- Not a comprehensive one. Colorado has no statute that sets rules for ALPR use, retention and sharing in one place. General laws apply instead: a 2014 rule on retaining government surveillance records, a 2021 limit on sharing personal information for federal immigration enforcement, and the open records laws.
- How long can Colorado agencies keep license plate reader data?
- Colorado's passive surveillance statute requires government records of that kind to be destroyed after three years, with access restricted after the first year to specific evidentiary purposes. Most agencies set far shorter retention in policy or contract, commonly 30 to 180 days.
- Can Colorado police share plate data with federal immigration agents?
- Colorado law bars state and local agencies from sharing personal identifying information, which includes license plate numbers, for federal civil immigration enforcement. It also bars sharing related to reproductive health care. Agencies should make sure their vendor settings enforce that.
- What was SB26-070?
- A 2026 bipartisan bill that would have required a warrant to search plate reader data more than three days after a crime and banned most out-of-state sharing. It died on the Colorado Senate floor on April 29, 2026.
- Can an HOA or a business run plate reader cameras in Colorado?
- Yes. Private parties can operate them on their property. The rules for who sees the data, including police, come mostly from the vendor contract and the platform's sharing settings, so read both before you sign.
- Who should own the plate reads?
- The organization that collected them. A good contract states that the customer owns the data, sets retention, controls every share and can revoke it, and that nothing is shared by default.
