The Plate Trail: Auditing ANPR Exposure on UK Roads in 2026

Automatic number plate recognition (ANPR) is no longer a niche police tool. In 2026 it is part of the ordinary furniture of UK roads: fixed cameras on gantries and bridges, mobile units in patrol cars, and privately operated readers at car parks, retail parks, fuel forecourts and drive-throughs. Each read turns a registration mark into a time-stamped location record. Individually, these records look mundane. Combined, they can reconstruct journeys, habits and associations.

Who is watching, and what they keep

Police forces use ANPR for road policing, investigations and missing persons enquiries. Local authorities and national road operators use it for traffic management and enforcement. Private car park operators use it to manage parking and pursue unpaid charges. Retailers and fuel operators use it for security and loss prevention. Each organisation should be a data controller for the records it creates, which means each should be able to explain its purpose, retention period and disclosure practices.

Retention is not uniform. Police policies often keep non-hit ANPR data for up to 12 months, subject to review and operational need. Private operators vary widely: some delete within days, others keep records for months. Do not assume that every camera feeds one national database. The trail is usually fragmented across separate systems, and that fragmentation matters when you try to audit it.

When a misread becomes your problem

ANPR is accurate but not infallible. Dirty plates, damaged characters, similar letter shapes and cloned plates can all produce a false match. If a misread leads to a penalty notice, a clamp, a parking charge or police contact, you have rights under the UK GDPR.

A subject access request is the main practical tool. It is free in most cases, and the controller should respond within one month. Identify the correct controller first: for a police record, contact the force's data protection officer; for a car park, use the operator's privacy notice. Include your registration mark, relevant dates and locations, and proof of identity. Ask for confirmation of whether your data is held, the categories of data, the recipients, the retention period and the source of the data.

If the record is inaccurate, ask for rectification. If it has been kept longer than the stated policy allows, ask for erasure and an explanation. If you are dissatisfied, you can complain to the Information Commissioner's Office. A misread alone is not necessarily a breach. Over-retention, unlawful disclosure or a failure to correct a known error is a stronger basis for complaint.

Reading the signs before you park

Private car park operators may request keeper details from the DVLA to pursue parking enforcement. That does not remove their obligations under the UK GDPR. Signage at the entrance should tell you that ANPR is in use and point you to a privacy notice. If signage is absent or vague, ask the operator for its privacy notice and retention policy before paying a charge.

Keep your V5C details up to date. A stale keeper record can send someone else's penalty to your door and create a dispute that takes longer to resolve. Pay legitimate parking charges promptly, and keep receipts or app records. If a charge arrives because of a misread, respond in writing with evidence rather than ignoring it.

Reducing exposure without breaking the law

You cannot lawfully obscure a registration plate to defeat ANPR. Practical exposure reduction is about avoiding unnecessary records, not defeating lawful systems. Consider whether a route or car park is necessary, especially where a private operator's terms are unclear. Be mindful of loyalty schemes and apps that link a plate to a named profile and purchase history. Ask operators how long they keep ANPR data and who receives it.

If you are a regular user of a site, a short written request for its retention policy is reasonable. If you receive a notice that appears to be based on a misread, keep the envelope, the notice, any photographs and your correspondence. A calm, documented challenge is more effective than a broad complaint.

A practical checklist

• Note the camera operator and any signage at the point where your plate was read.
• Identify the data controller from the privacy notice or the notice itself.
• Submit a subject access request with your plate, dates, locations and proof of identity.
• Ask specifically about retention, recipients and the source of the record.
• Request rectification if the plate or location is wrong.
• Request erasure if the record has been kept beyond the stated policy.
• Keep copies of all correspondence and reference numbers.
• Check your V5C is accurate and your parking payments are recorded.
• Complain to the ICO if the response is late, evasive or unlawful.
• Do not obscure or alter your plate; challenge the record instead.