We needed the Driver’s Privacy Protection Act. Technology found a way around it.

In 1989, actress Rebecca Schaeffer was murdered by a stalker who obtained her home address through California motor-vehicle records. Her death became one of the most prominent examples of the privacy and safety dangers created by the widespread availability of personal information held by state motor-vehicle departments.

Congress responded by passing the Driver’s Privacy Protection Act in 1994.

The principle was straightforward: Just because the government possesses personal information about drivers does not mean that information should be freely disclosed, sold or redistributed. The law restricts the disclosure and resale of personal information contained in state motor-vehicle records while allowing exceptions for legitimate purposes, including law enforcement and public safety.

But there is an important irony in the history of the law. Congress was responding, in part, to a technological problem. Advances in technology at the time had made state motor-vehicle records increasingly accessible, and existing laws had failed to keep pace.

More than 30 years later, technology has advanced again. Companies such as Flock Safety can collect license-plate information independently of state motor-vehicle databases. Flock’s own policies say its license-plate-reader system collects license-plate images, vehicle characteristics, dates, times and camera locations. It does not need a DMV database to observe a vehicle.

That distinction matters. The Driver’s Privacy Protection Act regulates personal information contained in state motor-vehicle records. It does not, on its face, regulate every piece of vehicle information that a private company can independently observe on a public road.

But it raises a larger question: What happens when technology allows private companies to create information that can be used for many of the same identification and tracking purposes without ever obtaining the underlying government record?

Imagine driving down a public road and passing an automated camera. The camera records your license plate, the time you passed and the camera’s location. One observation may seem insignificant. But repeated observations can create something much more revealing: a record of where a particular vehicle has been and when.

The government did not give a private company your DMV record. A company can create a different database around the same identifying marker: your license plate.

That may place the information outside the Driver’s Privacy Protection Act’s specific restrictions. But it does not eliminate the privacy concern that motivated Congress in the first place.

There is a legitimate argument for automated license-plate readers. Law enforcement can use them to locate stolen vehicles, investigate crimes and respond to public-safety threats. Those are legitimate government interests, and privacy protections should not make it impossible for police to do their jobs.

But public safety should not automatically become a blank check for surveillance.

The more important questions are what happens after a vehicle is recorded. How long is the information retained? Who can access it? With whom can it be shared? Can information collected for one purpose later be used for another?

Flock has recently taken steps to address some of these concerns. On Aug. 13, the company announced that it was reducing its recommended default retention period for license-plate-reader data from 30 days to seven days. Flock also announced additional safeguards, including mandatory misuse detection for customers and other access and accountability measures.

That change deserves recognition. Seven days is substantially less than 30 days, and Flock says the system automatically deletes data on a rolling schedule. But seven days is a recommended default, not a universal limit. The actual retention period can vary according to a customer’s contract and applicable state or local law.

That distinction illustrates why this issue should not be framed as a choice between public safety and privacy. There is a fundamental difference between an officer seeing a vehicle on a public road and a searchable database containing repeated observations of that vehicle.

One is an observation. The other can become a history.

The Driver’s Privacy Protection Act was never a declaration that Americans have an absolute right to anonymity on public roads. It was a recognition that information capable of identifying and locating people can be dangerous when it is collected, distributed and used without meaningful limits.

Today, technology has created another path to information about our movements. The government no longer has to hand over the record, because a camera can create one.

That does not mean automated license-plate readers should be banned. It means our privacy laws need to address the technology we actually have, rather than the technology we had in 1994.

Americans should not have to choose between public safety and personal privacy when reasonable rules can protect both. The Driver’s Privacy Protection Act was written for the technology of 1994. Our privacy laws need to catch up with the technology of 2026.

Shaun M. Simmons is a security professional with more than two decades of experience spanning public safety in the private, state, and federal security sectors. He is currently an independent security contractor and grassroots political organizer in Canyon County, Idaho.