A chain of California shopping centers appears to be sharing its license plate reader data with a well-known U.S. Immigration and Customs Enforcement (ICE) contractor, giving that agency the ability to track license plate numbers it captures in near real-time.

A report from the Electronic Frontier Foundation revealed that real estate group Irvine Company shares that data with Vigilant Solutions, a private surveillance tech company that sells automated license plate recognition (ALPR) equipment to law enforcement and government agencies. Irvine Company owns nearly 50 shopping centers across California with locations in Irvine, La Jolla, Newport Beach, Redwood City, San Jose, Santa Clara and Sunnyvale. ICE finalized its contract with Vigilant Solutions in January of this year.

A 14-year-old EFF volunteer named Zoe Wheatcroft initially discovered Irvine Company’s data-sharing activities in a page detailing its ALPR policy, a disclosure required by California law. Ironically, while Irvine Company’s ALPR usage and privacy policy does describe its own practice of deleting the license data it collects once transmitted, it admits that it does in fact transmit all of it straight to Vigilant Solutions, which has no such qualms.

As Vigilant describes, the key offering in its “advanced suite” of license reading tech is unfettered access to a massive trove of license plate data:

A hallmark of Vigilant’s solution, the ability for agencies to share real-time data nationwide amongst over 1,000 agencies and tap into our exclusive commercial LPR database of over 5 billion vehicle detections, sets our platform apart.

Irvine Company is only one example of this kind of data sharing, but it illustrates the ubiquity of the kind of privately owned modern surveillance technology at the fingertips of anyone willing to pay for it. While we’re likely to see more state-level legal challenges to license plate tracking technology, for now the powerful pairing of license plate numbers and location data is mostly fair game for anyone who wants to make money off collecting and aggregating it.

Update: In a statement to TechCrunch, Irvine Company disputes the claim that its LPR data is being shared to Vigilant’s broader database:

“Irvine Company is a customer of Vigilant Solutions. Vigilant employs LPR technology at our three Orange County regional shopping centers. Vigilant is required by contract, and have assured us, that LPR data collected at these locations is only shared with local police departments as part of their efforts to keep the local community safe.”

TechCrunch requested evidence of this contract stipulation with Vigilant and will reproduce it here if we receive it.

The company also shared a statement from the City of Irvine’s police department:

“The use of legally permissible Automated License Plate Readers is a practice that has helped enhance the safety of our community. We have made numerous arrests thanks to this technology, while respecting the privacy rights of the public. The Irvine Police Department uses this information for our own investigations and never shares the information.”

Vigilant Solutions also reached out to dispute the veracity of the EFF report, providing TechCrunch with the following statement: