The American Counsel | November 3, 2026

In Mata v. Digital Recognition Network, Inc., the Fourth District Court of Appeal affirmed summary judgment against a driver whose two license plates had each been scanned at least fifteen times. By the time Digital Recognition Network (DRN) moved for judgment, there was no dispute that it had collected Mata’s plate data or that its database could be used to retrieve the locations where his vehicles had been seen. The difficulty for Mata was that the only people shown to have retrieved his records were his attorneys, whom he had authorized to do so. To bring a private action under California’s automated license plate recognition (ALPR) statute, Mata still had to show how one of the violations he alleged had harmed him. His testimony that he regarded the collection itself as an invasion of his privacy did not supply that evidence. The California Supreme Court denied review on October 28, 2026.[1]

An earlier decision of the First District illustrates why that requirement can be difficult to apply. In Bartholomew v. Parking Concepts, Inc., a driver alleged that a garage had collected his plate data without adopting or publishing the policy California requires. The absence of the policy deprived him of information he was entitled to have about the use of his own records. Mata, by contrast, challenged the adequacy of a policy DRN had published and the conspicuousness of a link he had never tried to find. Between those cases lies a question of considerable importance to a driver whose movements are recorded. If the operator omits the information the driver would need to recognize an improper use, what evidence should the driver have to produce to establish that the omission itself caused harm?[2]

California requires operators to disclose how they use plate data and to confine its use to the purposes they disclose

DRN sold cameras that could be mounted on tow trucks or installed at fixed locations. For each sighting, its system retained the original image along with the plate number, the issuing state, and the time and location of the observation. It is the ability to search those observations together that brings a system of this kind within the definition the Legislature adopted in Senate Bill 34, effective January 1, 2016. By May 2024, DRN had accumulated more than nine billion historical images. One image may establish little more than the presence of a vehicle on a public street. A search for the same plate across years of observations may disclose the address at which the vehicle regularly spends the night or the clinic it visits every Tuesday, even if no individual photograph identifies the driver.[3]

California requires a private operator to maintain reasonable security safeguards and to implement a written usage and privacy policy. The operator must make the policy available to the public and post it conspicuously on any website it maintains. Among the matters it must disclose are the purposes for which the system is used, who may use it and what training they receive, how the operator monitors access and regulates transfers, who is responsible for the system, how errors are corrected, and how long the data is retained before destruction. When the operator accesses the information or provides access to someone else, it must keep a record of that access and require that the information be used only for the purposes the policy authorizes. End-users have duties of their own. A police department purchasing access, for example, must account for the public-meeting and transfer restrictions applicable to public agencies even where its private supplier has broader authority to share its own data.[4]

Section 1798.90.54(a) separately identifies who may enforce those duties in a private action. An individual “harmed by a violation” may sue a person who “knowingly caused the harm.” Once the individual establishes the required harm, subdivision (b) permits recovery of actual damages subject to a $2,500 liquidated minimum, reasonable attorney fees and costs, and appropriate preliminary or equitable relief. Punitive damages require proof of willful or reckless disregard of the law. A person whose location was improperly disclosed may have considerable difficulty assigning a dollar value to the disclosure. The liquidated minimum addresses that difficulty. The number of times a plate was scanned, on the other hand, supplies neither the missing injury nor a basis under Mata to award $2,500 per scan.[5]

The driver in Bartholomew alleged that the garage had collected his data without making any usage policy available

California had recognized the privacy interest in accumulated plate records well before it had occasion to decide who could sue under section 1798.90.54. In a public-records case, the California Supreme Court considered what disclosure of raw police scans could tell a requester about where people lived, worked, and spent their time. The risk of exposing those movements bore directly on whether police should have to release the records. A private damages action presents a further question because the plaintiff must connect an alleged violation to an injury of his own. In Navarro v. Skidata, Inc., for example, the plaintiffs’ references to identity theft and credit monitoring did not establish that any particular defendant’s handling of shopping-mall plate data had caused those losses.[6]

In Bartholomew v. Parking Concepts, Inc., the driver saw his plate number on the ticket he received when he entered the garage and on the kiosk screen when he left. Those facts supported an inference, on demurrer, that the garage operated a searchable plate recognition system. According to the complaint, the garage collected and used his data without implementing or making public any policy governing that use. Under those circumstances, the First District concluded that the driver had alleged an injury. He could not consult the disclosures to which he was entitled to learn what uses the garage authorized or on what terms it retained his records. The court expressly reserved the case of an operator that has published a policy but omitted a required component.[7]

DRN, by contrast, had adopted a policy addressing all seven statutory subjects and linked to it at the bottom of its homepage under the words “California ALPR policy.” Its stated purposes included locating vehicles for customers with a legitimate commercial interest, law-enforcement use, and market research using aggregated data. Mata alleged that DRN maintained the policy for appearances, failed to post it conspicuously or provide reasonable security, and allowed customers to use the system to track individuals for unauthorized purposes. Even assuming that he could establish one of those violations, he had to identify its effect on him once DRN challenged his standing on summary judgment.[8]

Mata had never visited DRN’s website to look for its policy. He read it for the first time in connection with the lawsuit. He identified no unauthorized access to or disclosure of his records and no security breach involving them. He had experienced no identity theft, stalking, or monetary loss attributable to DRN. Although Mata pointed to evidence of credential sharing, which could allow someone to search under another user’s name, he offered no evidence that anyone had used a shared credential to search for one of his plates. Membership in a certified class defined in part by the number of scans established that DRN had collected qualifying records. It did not establish what happened to any particular member as a result. The trial court entered judgment on statutory standing without reaching DRN’s alternative argument that its practices complied with the law.[9]

Mata had to show how a violation harmed him even if he could not place a dollar value on the injury

The phrase “harmed by a violation” does much of the work in Justice Truc Do’s unanimous opinion. The Legislature distinguished the operator’s violation from the individual’s harm and connected the two with the word “by.” Its examples include unauthorized access, unauthorized use, and a breach of security. Although the examples are illustrative, the court understood them to describe actual injuries of the kind that could give rise to a private claim. Mata urged the court to distinguish a technical omission from a failure serious enough to compromise privacy. But the seriousness of a security defect tells a court how much risk the operator created. Even a serious defect does not establish, without more, that it caused a particular driver an injury. The court found no support in the legislative history for treating repeated collection under allegedly deficient safeguards as sufficient to bridge that gap.[10]

The Fourth District expressed skepticism about the informational injury recognized in Bartholomew. It did not have to reject that decision to affirm the judgment. Even if DRN should have placed the link more prominently, its placement could not explain why Mata failed to obtain information from a website he never consulted. Consider, however, a driver who did consult the operator’s policy to learn whether records of visits to a medical clinic remained searchable and found that the policy omitted any retention information. That driver can identify the disclosure the statute required, the effort she made to obtain it, and the question about her own records that the omission left her unable to answer. Whether that deprivation establishes actual harm remains open. Neither court made an unsuccessful website search a prerequisite to every ALPR claim.[11]

The civil liberties organizations that sought Supreme Court review identified a different point at which injury might occur. Once a company assembles enough observations to reconstruct a person’s movements, a history that previously would have required sustained surveillance becomes available in response to a single query. From the driver’s perspective, the loss of privacy may occur when that history becomes searchable, particularly if disclosure of a location would expose the driver to danger. The obstacle to Mata’s argument was the statute the Legislature enacted. It permits a private operator to collect plate information without first securing each driver’s consent. To give a driver a remedy for collection at a sensitive location or for retention beyond a specified period, the Legislature can prohibit that conduct and specify who may enforce the prohibition. The Supreme Court’s denial of review left the Fourth District’s construction in place.[12]

A claim that someone misused a driver’s records requires different proof from a claim that the operator withheld information

An insurer’s inquiry about where a vehicle is garaged may give the owner reason to investigate how the insurer obtained the address. The inquiry alone does not identify the source. A dated letter, a parking ticket bearing the plate number, and a copy of the operator’s policy as it appeared at the time can help establish the sequence of events. The owner can ask the insurer where it obtained the information and ask the operator how to dispute an inaccurate match. California requires the operator to publish its authorized uses and to keep records of access. The ALPR statute does not give every driver a right to obtain every access record on demand. Where the California Consumer Privacy Act applies to the business, the information, and the request, a consumer may also seek disclosure, correction, or deletion, subject to verification and the applicable exceptions.[13]

For plaintiffs’ counsel, the first pleading question is which defendant owed the duty the driver says was breached. A camera manufacturer may have sold equipment to a garage that operates the database, while a customer with credentials may have performed the challenged search. The ticket and exit display in Bartholomew supported an allegation about what the garage itself had done even though the driver could not inspect its software. A complaint alleging unauthorized use should likewise identify the plaintiff’s records, the facts supporting an inference about who accessed them and for what purpose, the injury attributable to that access, and the basis for alleging that the particular defendant knowingly caused the harm. Evidence that management deliberately adopted a policy may establish that management knew the policy’s terms. Standing alone, it cannot establish that management knew of a customer’s subsequent misuse.[14]

The distinction also determines what discovery to pursue. If the alleged wrong is a transfer to an insurer, the operator’s record of a query can be compared with what the insurer received, when it received it, and what it did with it. If the alleged wrong is use for an unauthorized purpose, the relevant comparison is between the user’s actual purpose and the policy in force on the day of the search. A user can enter valid credentials and still run a search for a purpose the policy forbids. An earlier complaint to a supervisor about queries by that same user may bear on what the operator knew when it allowed access to continue. An informational-injury claim calls for different proof, including the version of the policy available to the driver and the particular information its absence or omission placed beyond the driver’s reach.

The forum and the cause of action also determine which injury counsel must establish. After DRN removed the action, the federal court remanded because Mata had not adequately alleged an injury in fact under Article III. The state court then certified the class and decided a question of California statutory standing. Where a different statute authorizes recovery for noncompliance itself, importing Mata’s harm requirement would add a condition the Legislature had omitted. If the claim arises under the California Constitution, counsel must identify the legally protected privacy interest, establish a reasonable expectation of privacy under the circumstances, and show a serious invasion, taking account of competing justifications where appropriate. The same set of scans may be relevant to each inquiry for a different reason.[15]

Before relying on an access log, the defense must establish that it records the kind of search the plaintiff alleges

A policy in effect today will do little to answer an allegation that no policy existed when the plaintiff entered the garage three years ago. On demurrer, a court accepts well-pleaded facts and the reasonable inferences from them. On summary judgment, defense counsel can establish when the operative policy was posted, where it could be found, what systems it governed, and how the operator knows which users accessed the plaintiff’s plate. Before relying on an empty query result, determine whether the records cover the customer portal, automated requests, bulk exports, and affiliate access during the period in dispute. If customer exports were never logged, the absence of an export entry cannot establish that no export occurred. Where the records cover the challenged activity and the plaintiff acknowledges that the only access was authorized, Mata permits a court to resolve injury without also deciding whether every practice complied with the statute.[16]

The same distinction should inform the choice of a class representative. A scan count can identify people whose records entered the system. It cannot identify which people had records searched for an unauthorized purpose or which were deprived of information a policy should have disclosed. After the summary judgment ruling, Scott Aker sought to replace Mata based on his belief that DRN had provided his information to an insurer that twice asked where his vehicle was garaged. The trial court found the application untimely and substitution futile. Because Aker challenged only futility in his opening brief, the independent timeliness ground sustained the order on appeal. Defense counsel should be precise about what that disposition established. The Court of Appeal did not decide whether proof of an unauthorized disclosure to Aker’s insurer would have been sufficient. For class counsel, Aker’s experience is reason to examine the representative’s evidence before a dispositive motion and, if substitution becomes necessary, to preserve a challenge to each independent ground for denying it.[17]

An operator must record who accessed the plate data and restrict its use to the purposes the operator disclosed

For a business developing a plate-search service, the authorized purposes in its public policy should determine who can submit a query and what the operator can learn about that query afterward. Suppose the policy permits a customer to locate a particular vehicle in which it has a legitimate commercial interest. A contract may bind the customer to that limitation. To determine whether an employee actually observed it, the operator needs a means of identifying the employee, recording the reason for the search, and reviewing queries that fall outside the customer’s ordinary business. Individual accounts and permissions limited to the employee’s work make that inquiry possible. A credential shared across several offices may establish which customer subscribed without establishing who requested a particular location. The statute requires reasonable safeguards, purpose restrictions, and access records while leaving the choice of technology to those responsible for the system.[18]

The statutory access record includes the date and time, the plate or other query terms, the username and applicable affiliation, and the purpose of access. Because the log itself may disclose which vehicles a user is interested in locating, its own access controls warrant attention. Retention and accuracy promises can be tested before a product is released. When a test record expires, determine whether it can still be retrieved from an index or an export under the company’s control. When an employee corrects a misread plate, determine whether the original error can still trigger a match. The same review belongs in a website redesign. A policy may remain available at its original address even after the redesign has eliminated the route by which a driver could find it. DRN prevailed on Mata’s evidence of harm. It obtained no ruling that placing a link in a footer necessarily satisfies the duty of conspicuous publication.[19]

The unresolved case concerns the driver who needs the statutory disclosure precisely because the operator alone knows how her records are being used. In my view, Bartholomew should retain its force where an operator’s failure to disclose the required information deprives the driver of the means to determine whether a particular use of her data was authorized. To require her first to identify an improper search in those circumstances would allow the operator to rely on the very ignorance its omission produced. A court applying Mata can insist that the driver identify what information she was denied and how that denial affected her. Whether she can prove a later misuse is a distinct question, one that may be answerable only if the operator has kept the records California already requires.

---

[1]     Mata v. Digit. Recognition Network, Inc., No. D084781, slip op. at 2, 9–13, 25–28 (Cal. Ct. App. July 20, 2026) (affirming summary judgment on statutory standing and describing the undisputed access to Mata’s records). Mata v. Digit. Recognition Network, No. S298319 (Cal. Oct. 28, 2026) (denying the petition for review).

[2]     Bartholomew v. Parking Concepts, Inc., 118 Cal. App. 5th 438, 445–51 & 449 n.10 (2026), as modified on denial of reh’g (Feb. 27, 2026) (recognizing a pleaded informational injury from collection without the required policy and reserving the effect of an incomplete policy). Mata, slip op. at 25–27 (questioning the right-to-know rationale and distinguishing a publicly available policy).

[3]     Cal. Civ. Code § 1798.90.5(a)–(d) (defining an ALPR system, ALPR information, an operator, and an end-user). Mata, slip op. at 6–7(describing the equipment, stored data, size of the database, and authorized uses in DRN’s policy).

[4]     Cal. Civ. Code §§ 1798.90.51–.53, .55 (prescribing safeguards and public policy duties, specifying access records and purpose restrictions, and imposing additional duties on public agencies). Cal. Dep’t of Just., California Automated License Plate Reader Data Guidance, Information Bulletin No. 2023-DLE-06, at 2–3 (Oct. 27, 2023) (explaining public agencies’ duties concerning access, disclosure, and sharing).

[5]     Cal. Civ. Code § 1798.90.54(a)–(b) (identifying who may sue, who may be sued, and what remedies a court may award). Mata, slip op. at 15–20 & 20 n.16 (distinguishing the harm and causation requirements from the measurement of damages and the description of eligible defendants).

[6]     Am. C.L. Union Found. of S. Cal. v. Superior Ct., 3 Cal. 5th 1032, 1043–45 (2017) (weighing the privacy consequences of releasing raw police ALPR records under the Public Records Act). Mata, slip op. at 17–18 & 18 n.14 (discussing the evidence and causation analysis in the federal Navarro litigation).

[7]     Bartholomew, 118 Cal. App. 5th at 442, 445–51 & 449 n.10 (finding a sufficient basis to infer use of an ALPR system and permitting the no-policy claim to proceed at the pleading stage).

[8]     Mata, slip op. at 6–12 (describing DRN’s posted policy, the allegations in Mata’s complaint, and the record on summary judgment).

[9]     Mata, slip op. at 9–13 & 9–11 nn.9–11 (setting out the class definition, Mata’s testimony, the credential-sharing argument, and the limited basis of the judgment).

[10]   Mata, slip op. at 12–25 (interpreting the causal language and illustrative examples, examining legislative history, and rejecting the proposed distinction between technical and nontechnical violations).

[11]   Mata, slip op. at 25–28 (distinguishing the absence of any policy from Mata’s objections to the substance and visibility of the policy DRN provided). Bartholomew, 118 Cal. App. 5th at 449 n.10 (reserving the question of a policy missing required components).

[12]   Mata, slip op. at 13–14 & 13 n.12, 23–27 (addressing collection without individual consent and the theory that aggregation under deficient safeguards itself caused actionable harm). Letter of ACLU Affiliates & Electronic Frontier Foundation in Support of Petition for Review at 1–2, 4–10, Mata v. Digit. Recognition Network, Inc., No. S298319 (Cal. Sept. 10, 2026) (arguing that collecting and retaining historical location data itself poses a cognizable privacy harm).

[13]   Cal. Civ. Code §§ 1798.90.51(b)(2), .52(a) (distinguishing information that must be made public from records the operator must maintain). Cal. Dep’t of Just., California Consumer Privacy Act (Aug. 28, 2026) (explaining consumer requests, verification, exceptions, and the limitations on a private CCPA action).

[14]   Bartholomew, 118 Cal. App. 5th at 444–46 (permitting the operator allegation to rest on facts reasonably inferable from the parking transaction). Mata, slip op. at 6–8, 15–20 & 20 n.16 (describing the deliberate adoption of DRN’s policy and distinguishing the class of plaintiffs from the class of defendants specified in the statute).

[15]   Mata, slip op. at 9–10 n.9, 14–17 (distinguishing the earlier jurisdictional remand and comparing California statutes that use different liability triggers). Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 35–40 (1994) (describing the elements and defenses applicable to a California constitutional privacy claim).

[16]   Mata, slip op. at 9–13, 25–28 (affirming summary judgment on the undisputed record concerning harm without deciding DRN’s alternative compliance defense).

[17]   Mata, slip op. at 28–31 (affirming the denial of intervention because the opening brief left an independent timeliness ground unchallenged).

[18]   Cal. Civ. Code §§ 1798.90.51(a)–(b), .52(a)–(b), .53 (requiring reasonable security, defined authorized uses, specified access records, and role-specific policies).

[19]   Cal. Civ. Code §§ 1798.90.51(b)(1)–(2), .52(a) (specifying publication, accuracy, retention, and access-record requirements). Mata, slip op. at 25–27 (explaining why the claimed deficiencies and placement of the link did not establish injury to Mata).