: Ars erroneously originally reported that the bill had been signed into law on March 10. In fact, it only has reached the governor's desk. Gov. Terry McAuliffe (D) has until March 29 to veto it, but given the bill's unanimous passage in the House of Delegates and Senate, is likely going to sign it. We regret the error.

Virginia is set to become the first state in America to impose a very short data retention limit on the use of automated license plate readers (LPRs, or ALPRs). Under the bill, Virginia cops will now only be able to keep such data for seven days unless there is an active, ongoing criminal investigation.

New Hampshire previously banned the devices outright, while Maine has imposed a 21-day limit. However, many jurisdictions nationwide, ranging from the New York State Police to the Oakland Police Department, have no formal data retention limit. That means the location data—often resulting in millions of records collected over years—is effectively kept forever.

Governor Terry McAuliffe (D) formally received the bill on March 10, and if signed, it will take effect on July 1. His spokesman did not immediately respond to Ars' request for comment.

"It is great to see that Virginia legislators have recognized the threats to privacy posed by longer ALPR retention periods and also recognized that longer retention periods aren’t necessary to serve the main purposes of ALPRs—finding wanted and stolen vehicles," Jennifer Lynch, an attorney with the Electronic Frontier Foundation, told Ars by e-mail.

"In 2013, Virginia’s Attorney General issued a formal opinion on ALPRs where he stated that Virginia shouldn’t be keeping ALPR data on innocent citizens. However, that opinion didn’t have the force of law. If passed, this bill will, and I hope other states will follow Virginia’s lead."

The law, entitled the "Government Data Collection and Dissemination Practices Act," expands the state’s definition of "personal information" to include license plate number and "presence at any place," or location data.

As the statute explains:

The General Assembly finds that: An individual's privacy is directly affected by the extensive collection, maintenance, use and dissemination of personal information; The increasing use of computers and sophisticated information technology has greatly magnified the harm that can occur from these practices; An individual's opportunities to secure employment, insurance, credit, and his right to due process, and other legal protections are endangered by the misuse of certain of these personal information systems; and In order to preserve the rights guaranteed a citizen in a free society, legislation is necessary to establish procedures to govern information systems containing records on individuals.

The bill’s author, State Senator Chap Petersen (D-Fairfax), told Ars that this language is designed to be broad, a hedge against potential threats.

"My bill speaks broadly to any technology that is used to capture data in a passive or indiscriminate way," he said. "It could be used for facial recognition or VIN numbers. I'm not just worried about this technology, I'm worried about future technologies. "It was clear to me that the state had no business collecting this information. I wasn't a criminal suspect, so why are they taking pictures of me? Or my wife? Law enforcement only has powers that we authorize them. They shouldn't just be able to use any tech that they want or to surveil people when they're not subject to an investigation. You can't just do it because you feel like it, and that to me is very critical."

Petersen said the bill was designed with a nod toward George Mason, an 18th century Founding Father from Virginia who authored the Virginia Declaration of Rights (which later influenced the Bill of Rights). "I sent a bill in last year and had joint support with the [American Civil Liberties Union] and Tea Parties," Petersen added. "Left wing and right wing crazies working together!"

As Ars has reported for more than two years, LPRs are used in cities big and small across America. Typically, the specialized cameras scan a given plate using optical character recognition technology, checking that plate against a "hot list" of stolen or wanted vehicles. The device records the date, time, and GPS location of any plates—"hot" or not—that it sees. (There have been incidents where LPR misreads have led to dangerous confrontations.)

In many cases, nearly all collected LPR data has been shown to be useless, as one example from California illustrates.

In 2008, the Oakland Police Department (OPD) reported to the city council that after using just four LPR units for 16 months, it had read 793,273 plates, with hits on just 2,012 of them—a "hit rate" of just 0.2 percent. In other words, nearly all of the data collected is innocuous. Despite this, in that same report, then-OPD Deputy Chief Dave Kozicki (who has since retired) dubbed the LPR setup an "overwhelming success."