Americans are deeply divided on how aggressively Immigration and Customs Enforcement should pursue undocumented residents–or on whether ICE should even exist. There is less debate, though, on whether governments should follow the law. A new investigation by the ACLU of Northern California reveals extensive surveillance cooperation between police forces and ICE that may violate local or state laws–and ICE’s own guidelines.

At issue is the legally ambiguous world of automated license plate reader (ALPR) technology–using high-speed cameras to scan plates on roads and highways, in shopping centers, and at other locations. Matching those numbers to vehicle registrations, date, time, location, and a vehicle photo can provide an intimate picture of everyone’s comings and goings–not just those of criminal suspects. Absent federal law on the technology, some states have enacted their own laws and regulations to control how the information is used.

Yet a trove of ICE documents obtained by the ACLU in a Freedom of Information lawsuit may show law enforcement agencies violating the provisions by handing license plate data over to the federal government. In some cases, this might violate cities’ or states’ so-called “sanctuary” laws that prohibit law enforcement from expending any resources on immigration enforcement. In others, the actions would violate local prohibitions on sharing data about anyone–including citizens–with outside authorities, says the ACLU.

The gathering of data may also violate ICE’s own policies regarding monitoring “sensitive” locations like churches–and it may be ensnaring the detailed location data of an untold number of non-criminal, non-immigrant Americans.

Over 80 police departments handing over data

A key example of restrictive data sharing policies is California’s 2015 law requiring notification of data breaches from license plate databases. Buried deep in the mind-numbing text of the amendment (know as SB-34) is the clause: “A public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law.”

“Public agency” refers only to California agencies, not those of other states or the federal government, says Matt Cagle, technology and civil liberties attorney at the ACLU of Northern California.

California’s 2017 sanctuary law (SB-54) further closes the door, specifically prohibiting collaboration by any state or local agencies with federal immigration authorities.