Kentucky License Plate Reader Laws (2026)

Kentucky has a specific license plate reader (ALPR) statute, KRS 189.632, in effect since July 15, 2026. In one sentence: it makes any ALPR use unlawful unless the statute allows it, lists the permitted purposes, caps default retention at 90 days, limits who may receive the data, and carries a criminal penalty.

Information reviewed September 30, 2026.

For related pages, see the Kentucky entry in the state comparison, the ALPR laws hub, Are Flock cameras legal?, What are Flock cameras?, and our Kentucky surveillance camera laws guide.

When did Kentucky's ALPR law take effect?

KRS 189.632 was created by 2026 Ky. Acts ch. 71, section 1 (HB 58, "AN ACT relating to privacy protection"). The Act's Section 1 is a new section of KRS Chapter 189, so it did not amend an earlier ALPR statute. The Governor signed it April 10, 2026, and the section took effect July 15, 2026.

It is the only operative ALPR section found. We checked the tables of contents of KRS Chapters 189, 16, 17, 61, 186, 174, 431 and 367 by title. Only Chapter 189 has an ALPR section; KRS 189.2326 concerns automated speed enforcement devices in highway work zones and does not use the term ALPR, although those devices transmit plate images, as the next paragraph explains. That was a title-level scan, not a full-text keyword search.

Who is covered, and what is allowed?

Subsection (2) reads: "It is unlawful for an individual, entity, partnership, corporation, association, or this Commonwealth, its agencies, and political subdivisions to use an ALPR except as provided in this section." Individuals, businesses, associations and government agencies are all within that text.

Under subsection (3), "An ALPR may only be deployed or maintained" for purposes of:

• regulating parking;
• controlling access to secured areas; or
• promoting public safety, deterring crime, and addressing auto theft.

Public agencies and law enforcement agencies may use an ALPR solely for law enforcement and commercial-vehicle enforcement functions. The Transportation Cabinet may use one solely for toll collection, road fund revenue collection and commercial-vehicle functions.

How long can Kentucky keep plate data?

Under subsection (4)(a), captured data "[s]hall not be preserved for more than ninety (90) days unless it" fits an exception. The exceptions include data retained for a lawful purpose described in subsection (3)(b) and (c), and data a law enforcement agency retains for:

• use as evidence in a criminal or insurance claim investigation;
• training, provided dates, times and plate numbers are redacted; or
• auditing.

Data is also outside the 90-day cap if it is subject to a subpoena duces tecum or preservation notice. Data kept under the lawful-purpose exception follows the agency's records-retention policy.

Who can receive Kentucky ALPR data?

Data may be used only by the deploying entity for the permitted purposes. It "[s]hall not be sold, shared, accessed, or transferred for any other purpose, except" through listed channels, which include:

• "[t]o a law enforcement officer or agency, or a third-party entity contracted with a law enforcement officer or agency, solely for purposes of protecting public safety or conducting criminal investigations";
• under a subpoena duces tecum;
• to the National Insurance Crime Bureau;
• to an insurance carrier, its agents or a support organization, for fraud investigation, vehicle recovery and claims;
• to a financial institution or its agents, for collateral recovery, lien enforcement, recovery of defaulted funds or loan verification, where the owner has a loan agreement or application or gave written consent; and
• otherwise in furtherance of the public-agency, law enforcement and Transportation Cabinet purposes in subsection (3)(b) and (c).

The text has no warrant requirement. It has no provision addressing out-of-state or federal agencies specifically. The section borrows its definition of "law enforcement agency" from KRS 61.298, which covers any public agency employing a police officer or special law enforcement officer as defined in Kentucky statutes (KRS 15.420 and 61.900), any public agency composed of or employing other public peace officers, and any elected or appointed peace officer authorized to exercise a peace officer's powers under KRS 446.010. This page does not say whether out-of-state or federal agencies qualify as recipients.

What is the January 1, 2027 notice rule?

Owners whose insurance contracts or applications predate January 1, 2027 need no notice of potential ALPR-data use. Under subsection (4)(d)4.b., "Individuals applying for insurance on or after January 1, 2027, shall be notified by the insurance carrier of the potential use of ALPR data to enforce the contract" through the carrier's website privacy statement, the application's disclaimer section, or both. The same subsection sets a parallel notice for financing applications by a financial institution.

What must police agencies do?

Before deploying, a law enforcement agency must adopt and publicly post a written policy. It must cover the databases compared, retention and destruction rules, training, supervisory oversight, and access and security rules. It must also include "[a]n audit schedule and process to ensure that the system is used in accordance with this section and agency policy to occur every ninety (90) days."

Subsection (6) adds a rule for stops. Upon receipt of an alert and prior to a traffic stop, "a law enforcement officer or dispatcher shall visually confirm" that the scanned plate in the captured data matches the alert. The subsection also requires that the stop meet agency policy and applicable law.

Subsection (7) directs the Transportation Cabinet to establish a permit process for ALPR installations on highway rights-of-way and to promulgate administrative regulations under KRS Chapter 13A. We could not determine whether a regulation has been filed; a search of the Legislative Research Commission's regulation pages for titles 600 and 601 returned no ALPR result, which does not prove none exists.

What is the penalty?

KRS 189.990(33) provides: "Any person who violates KRS 189.632 shall be fined not less than twenty dollars ($20) nor more than two thousand dollars ($2,000), or imprisoned in the county jail for not more than one (1) year, or both."

No private right of action appears in the text of section 189.632. We did not search for one elsewhere in the code.

Can the public request Kentucky ALPR records?

KRS 189.632 has no express public-records exemption. The open-records question has come up through camera locations. In two decisions dated March 2, 2026, the Attorney General held that police departments properly withheld the locations of Flock cameras under KRS 61.878(1)(h), which was amended in 2025 to an "articulable risk of harm" standard.

• 26-ORD-067 (Bowling Green Police Department) held that release of records detailing the locations of the department's Flock cameras "could pose an articulable risk of harm," and that the department "properly invoked KRS 61.878(1)(h) to withhold the requested record and did not violate the Act."
• 26-ORD-068 (Elizabethtown Police Department) involved the same exemption and the same request for records "that detail the locations of Flock Safety license plate readers/LPR."

These decisions concern camera-location records only. They do not address plate-read data, hot lists, audit logs or contracts. They were decided before KRS 189.632 took effect. Each could be appealed to circuit court within 30 days, and this page did not check whether either was.

What is happening in Kentucky cities?

The list below is not complete, and local decisions are not statewide rules.

• Lexington: the Lexington Police Department publishes a license plate reader policy page. It says officers must document a reason before browsing detections and that "audits of the LPR detection browsing inquiries are completed at least once each quarter." The statute requires an audit schedule to occur every 90 days. We did not open the policy document or assess compliance.
• Louisville: Louisville Metro Council passed Ordinance No. 081-2026 on May 14, 2026, appropriating $26,600 in District 26 neighborhood development funds to the police department for a two-year lease and installation of four Flock cameras (Legistar matter 64928). It is a funding measure, not a rule on how plate readers may be used.

Is Kentucky considering changes?

A Legislative Research Commission release of September 3, 2026 reports that the Interim Joint Committee on Judiciary discussed further ALPR rules. The ACLU of Kentucky recommended deleting data within 48 hours instead of 90 days and independent audits, and House Majority Whip Jason Nemes advocated a warrant requirement except in exigent circumstances. The release says lawmakers cannot take action on legislation until the 2027 session begins January 5. This page does not describe any bill, and nothing discussed at the meeting is law.

How can you check your local system?

• Ask your city or county police department for its posted written ALPR policy and its 90-day audit schedule, which the statute requires before deployment.
• Ask how long data is kept and whether an exception (evidence, training, auditing, subpoena) applies.
• Check whether a business, association or parking operator running cameras fits one of the permitted purposes in subsection (3).
• If you apply for insurance or financing on or after January 1, 2027, look for the required notice.

We did not identify a Kentucky court decision interpreting KRS 189.632.

Frequently asked questions

This guide provides general legal information as reviewed on September 30, 2026. It is not legal advice. Consult a lawyer licensed in Kentucky about a particular situation.

Last updated: September 30, 2026.

Kentucky's general consumer privacy law, in force since January 1, 2026, may also reach some private operators, although it never mentions license plates. The Kentucky Consumer Data Protection Act applies to businesses that control or process personal data of at least 100,000 Kentucky consumers a year, or 25,000 consumers if they derive over half their gross revenue from selling personal data, and it "shall not apply to any" "[c]ity, state agency, or any political subdivision of the state," or to a nonprofit organization, among other exclusions. It defines personal data as information "linked or reasonably linkable to an identified or identifiable natural person," but personal data "does not include de-identified data or publicly available information," and the Act exempts personal data collected, processed, sold or disclosed in compliance with the federal Driver's Privacy Protection Act. KRS 367.3625 says nothing in the Act restricts a business's ability to "[c]ooperate with law enforcement agencies" about conduct it reasonably and in good faith believes may be unlawful. This page does not say whether any particular plate-reader operator meets those thresholds or whether plate data falls within those exclusions.

Those work-zone speed devices do capture plates: KRS 189.2326 defines their "[i]mages" as images "showing the speed and rear license plate of a motor vehicle." Subsection (4) provides: "An image transmitted by an automated speed enforcement device under this section shall not be disclosed to anyone other than the driver of the vehicle."

A separate toll law also applies to projects tolled under KRS Chapter 175B, although it never mentions license plates. KRS 175B.040(6) says "[t]oll collection customer account information shall be confidential and not subject to disclosure under KRS 61.870 to 61.884," the open-records law, and defines that information as "any information collected or received from or about any person who is assessed a toll, including contact information, payment information, trip data, and any other relevant data." It is an open-records exemption and contract requirement; it does not itself set rules for sharing with police.

Frequently Asked Questions

Does Kentucky have a license plate reader law?

Yes. KRS 189.632, created by 2026 Ky. Acts ch. 71, took effect July 15, 2026. It makes ALPR use unlawful except as the section provides.

Can a private business or homeowner group use an ALPR in Kentucky?

The statute covers individuals, entities, partnerships, corporations and associations as well as government. An ALPR may only be deployed for the listed purposes, such as regulating parking, controlling access to secured areas, or promoting public safety, deterring crime and addressing auto theft.

How long can Kentucky ALPR data be kept?

Generally no more than 90 days unless an exception applies, such as retention for a lawful permitted purpose, evidence in a criminal or insurance claim investigation, training with redactions, auditing, or a subpoena duces tecum or preservation notice.

Can Kentucky police share plate data with other agencies?

The statute allows sharing with a law enforcement officer or agency, or a contracted third party, solely for protecting public safety or conducting criminal investigations. It has no warrant requirement and no provision addressing out-of-state or federal agencies specifically.

Can insurers and lenders receive Kentucky ALPR data?

Listed channels include insurance carriers for fraud investigation, vehicle recovery and claims, and financial institutions for collateral recovery and similar purposes. Applicants on or after January 1, 2027 must be notified.

What is the penalty for violating KRS 189.632?

A fine of $20 to $2,000, imprisonment in the county jail for up to one year, or both, under KRS 189.990(33).

Can I get Flock camera locations through an open-records request in Kentucky?

In two March 2, 2026 decisions, 26-ORD-067 and 26-ORD-068, the Attorney General held police departments properly withheld camera locations under KRS 61.878(1)(h). Those decisions do not address plate-read data.

Must Kentucky officers confirm an alert before a stop?

Yes. Before a traffic stop on an alert, an officer or dispatcher must visually confirm that the scanned plate matches the alert.