Immigration and Customs Enforcement has been accessing an automated license plate reader database with hundreds of millions of records to track U.S. residents, putting some local law enforcement agencies in potential violation of California law, the American Civil Liberties Union said Wednesday.

More than 9,200 ICE agents have had access to Vigilant Solutions’ license-plate reader database, which pinpoints drivers’ locations by collecting data from law enforcement and private sources, such as parking garages and tow trucks, said Matt Cagle, an attorney with the ACLU of Northern California. The scans are often used to find cars subject to repossession, he added, but the same data are uploaded to a server ICE agents can access to target undocumented immigrants.

“They privately collected data for one purpose: to find a car whose owners who didn’t pay the bills and now it’s being used to target and deport immigrants,” Cagle said.

The ACLU’s release of the records comes as ICE has ramped up detentions and deportations of undocumented immigrants in the two years since President Trump took office.

ICE paid $6.1 million for access to the data collection service, owned by Thomson Reuters and Vigilant Solutions in Livermore, which contracts with more than 80 law enforcement agencies around the nation, according to documents obtained by the ACLU.

Automated license plate readers have two cameras, said Mike Katz-Lacabe, a surveillance expert and research director of the Center for Human Rights and Privacy. One camera focuses on the plate and capturing a clear image of the number. The second snaps a shot of the vehicle’s make, color, model and, sometimes, its surroundings and who’s inside the vehicle.

Agents can type a license plate number into the database and pull up years-old records of where the car has traveled, Cagle said. Civil immigration queries are allowed to access scans within the past five years, and criminal investigation queries are limited to the statute of limitations for the specified crime. The ACLU’s documents also show a step-by-step guide to request the data from individual departments.

Vigilant Solutions’ database collects an average of 150 million to 200 million license plate scans a month, according to the documents.

The ACLU and immigration activists have repeatedly called on Vigilant Solutions to end its contract with ICE, accusing the company of violating state privacy and sanctuary laws.

Local law enforcement agencies handing license plate information over to ICE are violating SB54 by sharing personal information with federal agencies for immigration enforcement, Cagle said. They may also be violating SB34, which prohibits public agencies from sharing that information with out-of-state or federal agencies without a signed agreement.

“Chances are if an agency is sharing with other agencies, it’s not a conscious choice they made,” Katz-Lacabe said.

He also noted that any agency could access the database as long as they pay the fee, but it’s unknown if other federal departments have contracts with Vigilant Solutions.

“Drivers, regardless of their immigration status, are getting caught up in this mass surveillance dragnet that gives law enforcement far too much information about people’s lives,” Vasudha Talla, an attorney with the ACLU of Northern California, said in a statement.

On Tuesday afternoon, ICE officials said they do not use the license plate data to track people outside of immigration investigations, and Vigilant’s database is just one tool authorities use before detaining an individual.

“ICE personnel check the information against other investigative information, including information from government systems, before taking any action against the individual,” ICE spokesman Matthew Bourke said in a statement.

How long Vigilant retains license plate data, combined with California’s law allowing undocumented immigrants to obtain driver’s licenses, could make it easier to track undocumented immigrants, according to privacy experts.

“You’ve basically detailed a mosaic of this person’s life,” Katz-Lacabe said.

Union City’s Police Department is the only Bay Area agency that contributed license plate information to the database, according to the ACLU. The department denied the claim Wednesday, saying it does not use automated license plate readers. But documents obtained by the ACLU state that Vigilant had “detections received” from Union City police.

Union City police Capt. Victor Derting said the department does not upload data to Vigilant Solutions. However, officers can access the database to read license plates if it’s necessary for a criminal investigation.

“We do not provide any data to ICE or any other law enforcement agency in regards to license-plate reader cameras, because we don’t have any,” Derting said.

Union City police issued a follow-up statement Wednesday saying the department “made a request to Vigilant Solutions to provide further details that may be of value to the media on how they manage their information.”

The department added that it “complies with SB54” and does not share information with ICE.

The ACLU said six other Northern California law enforcement agencies participate in the sharing of data with Vigilant: the Manteca Police Department, Merced Police Department, Tulare Police Department, Stanislaus County Sheriff’s Office, Stanislaus County Auto Theft Task Force and Sutter County Sheriff’s Office.

Vigilant Solutions did not respond to requests for comment.

Gwendolyn Wu is a San Francisco Chronicle staff writer. Email: gwendolyn.wu@sfchronicle.com Twitter: @gwendolynawu