The License Plate Reader That Also Tracks the Devices You Carry
Police License Plate Readers Are Being Upgraded to Track Your Phone and Wearables.
A new sensor pairs roadside plate cameras with the radio signals your phone, your earbuds, your watch, and your car itself give off, combining them into a signature that identifies the person rather than the plate and keeping it for later search. No federal law prohibits it, and New York has none of its own.
A company that sells license plate cameras to police departments illustrates its newest product with a hypothetical stretch of road. Of one hundred cars that pass a sensor, about seventy might carry an Apple phone, a fact that on its own distinguishes no one. Only one of the hundred will carry that phone in the particular company it keeps, a phone of a specific model traveling with a specific car radio, a specific pair of wireless headphones, a fitness watch, a small electronic key finder, and the plate ABC-1234. That combination is unique, the company explains, and once a roadside sensor has recorded it the same car can be recognized again by the combination alone, even after the license plate has been removed, covered, or replaced.1
The product is called SignalTrace. It is made by Leonardo, an Italian aerospace and defense company whose largest shareholder is the Italian government, and it is sold in the United States through the company’s subsidiary, Leonardo US Cyber and Security Solutions.2 SignalTrace is not itself a camera. It is a set of radio sensors designed to be mounted alongside the automatic license plate readers that already stand on utility poles, highway overpasses, and patrol cars throughout the country, and its function is to record the wireless identifiers that consumer electronics give off as they travel, then attach those identifiers to the plate and to the time and place a camera recorded it.3
An automatic license plate reader, commonly abbreviated as ALPR, is a camera that photographs the plate of each passing vehicle, converts the image into text, and stores the location and the moment of the sighting. Police use these systems to recover stolen vehicles and to trace cars linked to crimes, and civil liberties organizations have argued for years that the same systems, operated continuously across a city, accumulate a record of where ordinary people drive, when they drive there, and whom they meet.4
The argument that has kept the cameras lawful without a warrant, in most courts that have examined them, is that a camera on a public street observes only what any bystander could observe, namely a plate, and that a plate identifies a vehicle rather than the person inside it.5 SignalTrace is designed to dissolve the distinction on which that argument rests.
The method, described in the company’s product materials and in the patent it received in 2024, is correlation across time.6 Phones, earbuds, watches, laptops, key fobs, and the electronics built into vehicles all transmit brief radio messages in the course of ordinary operation, and many of those messages contain a number that identifies the individual device. What a sensor captures is that identifier, the number the device announces to anything within range, not the location the device works out for itself and not the contents of anything it sends.
The location comes from the sensor rather than the device.
The location comes from the sensor rather than the device, because a sensor sits at a known place, so reading an identifier there records where the device, and whoever is carrying it, was at that moment, without the phone computing or transmitting anything.
A single such number, captured once, reveals little. SignalTrace records which devices appear together, repeatedly, in the presence of the same vehicle, and treats that recurring set as a signature for the vehicle and, in turn, for whoever travels with it.
Where a plate camera occupies the same site as a SignalTrace sensor, the system links the signature to the plate. Where no camera is present, the company states, the signature on its own still establishes a location, a date, and a time. The information is retained on the company’s analysis platform so that it can be searched afterward, which means an agency can ask not only where a given plate has been but where a given cluster of devices has traveled, and which other devices have traveled beside it.7 The premise that a small set of identifiers can single out one person has independent support in the research literature. A widely cited study of human movement data found that four approximate locations were enough to identify almost every individual in a large anonymized set, and that the result held even as the data was made deliberately coarse.8
A widely cited study of human movement data found that four approximate locations were enough to identify almost every individual in a large anonymized set, and that the result held even as the data was made deliberately coarse.
Figure 1. The system records the set of device identifiers that recur in the presence of a vehicle and ties that recurring set to the plate and to a time and place. The identifier is the combination, not any single device.
Figure 2. Each identifier added narrows the set of possible vehicles. In a large study of location data, four points were enough to single out almost everyone, the same dynamic that makes a small device combination uniquely identifying.
The system reads passively, out of the open air, and a person nearby has no practical means of knowing that a sensor is present or of declining to be read. What such a person might otherwise rely on for protection comes down to a few assumptions about the devices they carry and the car they drive.
One assumption is that a car, unlike a phone, broadcasts nothing that singles it out, when in fact nearly every passenger vehicle on the road does. Federal safety regulations have for years required new passenger cars to carry direct tire pressure sensors, one inside each wheel, and the requirement has been in force long enough that essentially every car now on the road has them.9 Each sensor transmits a fixed identification number that is not encrypted, continuously, while the car is in motion.
The standard exists for safety, to warn a driver of an underinflated tire, and tracking was not its purpose, but the effect has been documented for years. Researchers showed more than a decade ago that the number a tire sensor broadcasts is long enough to be unique to a car and can be read from a passing vehicle at a distance of tens of meters with inexpensive equipment, and a peer-reviewed study published in 2026 tracked vehicles across a neighborhood for weeks using receivers assembled from roughly hundred-dollar parts.10 A driver cannot switch the sensors off, and they broadcast whether or not anyone in the car is carrying a phone. The car was never anonymous; the identifier was installed at the factory to satisfy a federal rule.
A second assumption is that modern phones have already addressed the problem by disguising the identifier they broadcast, and they do, though only in part. To frustrate precisely this kind of tracking, recent versions of both major phone operating systems replace the permanent hardware address a phone would otherwise broadcast over Wi-Fi with a temporary, randomized one.11 The protection is genuine but incomplete. Researchers have shown that the randomization can be defeated on the large majority of devices they tested, by exploiting the timing and sequence of the disguised messages, and that a separate flaw in one manufacturer’s Bluetooth design allows a device to be followed in spite of it.12
For SignalTrace the limitation matters less than it might, because the signature the system depends on is the combination of devices rather than any one number, and disguising a single element does not break the set when other elements, the tire sensors most of all, do not change. The attack has also been carried out beyond the laboratory. One research team identified Bluetooth devices in public by the small imperfections in their hardware, which the disguise does not conceal, and followed a willing participant in and out of a home using radios that cost less than two hundred dollars.13
Figure 3. Randomization changes the phone’s broadcast identifier from one sighting to the next, but the other identifiers in the cluster, including the federally required tire sensors, do not change. The match is made on the part of the signature that stays constant.
A third assumption is that the published list of what the system can track should be read literally, and at least one item on that list cannot be. Among the device types the company names are the radio-frequency identification tags used in workplace access cards and in pet microchips.14 A pet microchip contains no battery; it stores no charge and transmits nothing until a reader held within a few centimeters supplies it with power, which is why a veterinarian must pass a scanner directly over the animal to read one.15 A sensor on a pole reading an implanted chip through the body of a moving car is not something the underlying technology allows. The point is a narrow one, but it is worth stating directly, because it informs how the remainder of the list should be read. The marketing describes capabilities that in at least one case the physics do not permit, and a reader of the document has no straightforward way to tell which of the listed capabilities have been demonstrated and which are aspirations.
Figure 4. The protections a driver is likely to assume, set beside what the relevant hardware actually does.
None of this means the tire sensors reveal anything about the car that the plate does not. As a way to identify a vehicle the two duplicate each other, and a reader who has accepted the plate camera has already surrendered the privacy of the car’s identity on a public road. What the sensors add is not a new fact about the car but a sturdier and cheaper way of collecting the same one. A plate can be removed, covered, exchanged for another, copied onto a second car, or missed by a camera in the dark or at a bad angle, and through all of it the sensors keep sending the same fixed number that the driver cannot switch off. They also read a radio signal rather than an image, so they need no camera, no clear line of sight, and no good light, and they can be made small and cheap enough to place where a camera could not go and to read a car they never see. Whether that is a different kind of surveillance or only a great deal more of the same can be argued either way, but it removes the cost and the sightline that once kept the reach of a camera network in check.
The personal devices are a separate matter, because they do not identify the car. They identify the people in it. A plate is a registration, a record of who a vehicle belongs to rather than who is driving it, whether the owner is present, or who is riding along, and the courts that allowed plate cameras without a warrant did so on the stated ground that a camera reads the vehicle and not the people inside.
A phone, a pair of earbuds, and a watch belong to a person rather than a car, which is the part the reasoning behind the plate was built to leave out. They also make a person harder to lose rather than easier, because the signature is a set rather than a single tag, so leaving your own phone at home does not break the trail when the devices of the people you travel with still place you in the car, and the more regularly you travel with the same people the more ways there are to find you. And much of this layer works where there is no plate, no camera, and no road, on foot, in a station, or in a shopping center, in the places a plate reader cannot follow.
The company anticipates the privacy objection and answers it with a single comparison. Its materials say that the system records the signals devices emit without reading the contents of any communication, and that this is no different from the way a license plate reader records a plate rather than information about the driver. The same materials describe the product’s purpose as the ability to “identify the movements of electronic devices, individuals, and vehicles,”16 and the executive who announced the underlying patent described the aim as enriching plate data with device information in order “to find the individuals police are looking for.”17
The reassurance and the description are difficult to reconcile. A product offered to police on the strength of its ability to identify the individual is not, in the same document, a product that records vehicles rather than the people inside them. The company has not resolved the tension; asked about the privacy implications by several news organizations after the product drew public attention, it has not commented beyond its marketing materials.18
Whether any of this is lawful is, for now, unsettled, and it is unsettled because the law that governs surveillance was written around older facts. The Fourth Amendment forbids unreasonable searches, and for most of its history a search meant a physical intrusion into a place a person could expect to keep private. The Supreme Court has more recently held that the protection can extend to information a person exposes in public, once the government gathers enough of it.
In 2018, in Carpenter v. United States, the Court held that the government conducts a search when it obtains the months of cell-phone location records that trace the whole of a person’s movements, and that the older principle permitting the government to take, without a warrant, any information a person has turned over to a third party does not stretch to so complete a record.19 Earlier decisions had pointed in the same direction, one Justice noting that society does not expect the police to record and store every movement of a person’s car over a long period, and a federal appeals court concluding that a network of cameras recording almost an entire city’s daily movement amounted to placing an ankle monitor on every resident.20
License plate readers themselves, though, have largely withstood these challenges, and the reasoning that has preserved them is specific. In January 2026 a federal court in Virginia upheld the city of Norfolk’s network of automatic plate cameras against a constitutional challenge brought by two residents whose vehicles had been photographed hundreds of times within a few months, holding that fixed cameras at scattered points capture only occasional, isolated sightings rather than the continuous record condemned in the earlier cases, and that they photograph vehicles rather than identifying the people in them.21
Most courts to take up the question have arrived at the same conclusion, and a Virginia trial court that ruled the other way, suppressing plate-camera evidence as the fruit of a warrantless search, was reversed on appeal.22 Those two findings, that the cameras capture only fragments and that they track cars rather than people, are the foundation on which warrantless plate reading has been allowed to rest.
SignalTrace is engineered to remove both. Its stated purpose is to identify the person, and its method, a persistent signature assembled across many sightings, is precisely the continuous and comprehensive record the courts have treated as the boundary a plate camera does not cross. The judge in the Norfolk case acknowledged that the analysis must remain flexible as the technology advances, and that the balance he had struck held, in his phrase, “not today,” for the cameras as they currently function.23
No statute closes the space the Constitution leaves open. There is no federal law written specifically for license plate readers, and the federal laws that protect electronic privacy were built for communications carried by telephone and internet companies rather than for identifiers broadcast into the air and gathered by a government sensor. The federalwiretap statute protects the contents of a communication, which it defines as information concerning the substance, purport, or meaning of that communication, and it expressly exempts radio communications that are readily accessible to the general public.24
A system that records identifying numbers rather than the substance of any message, and that describes itself as capturing frequencies emitted into the open air, sits outside that statute by design, and the company’s assurance that it does not capture contents is, in practical terms, a statement that the law of wiretapping does not reach it.25 The companion statute that governs the dialing and routing information of telephone calls and internet traffic applies to information transmitted through a provider’s equipment and requires a court order before the government installs such a device, neither of which describes a sensor listening to the open air on its own, and the law protecting stored communications applies to records held by a communications company rather than to data an agency collects and keeps itself.26
The collection therefore falls between the established categories, and the only legal constraint that plainly applies is the Fourth Amendment, whose application to this particular combination no court has yet decided.
Figure 5. The federal privacy statutes and state plate-reader laws each cover a different category. The capture of device identifiers from the open air falls outside all of them, leaving only the Fourth Amendment, whose application is undecided.
New York has done less than the federal government rather than more. The state has no statute restricting how license plate readers may be used, what their data may be used for, how long it may be kept, or with whom it may be shared. This is not an inference but the stated premise of the legislation written to change it.
A bill introduced in the State Senate in April 2026 to create such a framework opens by observing that there is at present no state regulation of the use, transfer, storage, or sharing of plate-reader data by New York agencies or law enforcement.27 What New York has actually enacted is far narrower. A law passed in 2025 directs a state police-training body to develop a model policy on the use of plate readers, a policy that agencies are required to post but that imposes no warrant requirement and creates no enforceable limit, and the law applies, by its own definition, only to systems that convert images of license plates into data.28
The device harvesting that SignalTrace performs is not addressed by that law, nor by the older non-binding guidance the state has issued, nor even by the most far-reaching reform now pending, which would for the first time impose penalties and forbid the use of improperly collected plate data in court, but which speaks only of plates and says nothing of the radio identifiers given off by phones, watches, and cars.29 In New York, then, the part of the system that reads the plate is lightly governed, and the part that reads the person is governed by nothing at all.
The permission that has allowed plate cameras to operate without a warrant was granted on the understanding that they do two things and not two others. They record where a vehicle was at scattered moments, and they read a plate. They do not trace the whole of a person’s movements, and they do not identify the people inside the car. SignalTrace is built to do the two things that the permission was conditioned on its not doing, and it is being offered to the same agencies that already run the cameras, as an addition to equipment they have already purchased. Whether the law will treat the combination as a search has not been decided, and the sensors are being installed while the question waits. They operate passively and without notice, and there is, for the moment, nothing a driver can switch off.
End Notes
1. Leonardo US Cyber and Security Solutions, ELSAG SignalTrace product page (the one-hundred-car illustration and the identification of a vehicle by its device signature without a plate), https://www.leonardocompany-us.com/lpr/elsag-signaltrace
2. The Italian Ministry of Economy and Finance is Leonardo’s largest shareholder, holding roughly 30.2 percent of the company; see Leonardo S.p.A. corporate governance disclosures, https://www.leonardo.com/en/investors/corporate-governance/board-of-directors/composition. The United States subsidiary that markets SignalTrace is Leonardo US Cyber and Security Solutions, LLC, formerly Selex ES.
3. SignalTrace product sheet (2025), Leonardo US Cyber and Security Solutions; first reported by Joseph Cox, 404 Media, This Company Will Add Phone, AirPod, and Smartwatch Trackers to License Plate Readers, https://www.404media.co/this-company-will-add-phone-airpod-and-smartwatch-trackers-to-license-plate-readers/
4. On the longstanding concern that continuous plate reading accumulates a record of drivers’ movements, see Electronic Privacy Information Center, Vehicle Fingerprinting Through Pervasive Camera Surveillance Likely Violates Fourth Amendment, Court Finds, https://epic.org/vehicle-fingerprinting-through-pervasive-camera-surveillance-likely-violates-fourth-amendment-court-finds/
5. On the prevailing view that fixed plate cameras do not require a warrant because a plate is exposed to public view, see Schmidt v. City of Norfolk (E.D. Va. Jan. 27, 2026), reported at https://courthousenews.com/judge-holds-norfolks-license-plate-reader-use-constitutional/
6. United States Patent No. 11,941,716 B2, Systems and Methods for Electronic Signature Tracking, issued March 26, 2024; Leonardo US Cyber and Security Solutions press release, May 30, 2024, https://www.businesswire.com/news/home/20240530567391/en/Leonardo-US-Cyber-and-Security-Solutions-receives-a-patent-for-their-new-electronic-signature-tracking-system-for-law-enforcement
7. SignalTrace product page and product sheet (retention of correlation data for later query; identification of a vehicle by signature with or without a co-located camera), https://www.leonardocompany-us.com/lpr/elsag-signaltrace
8. On the principle that a small set of points uniquely identifies a person, see Yves-Alexandre de Montjoye and others, Unique in the Crowd: The Privacy Bounds of Human Mobility, Scientific Reports volume 3, article 1376 (2013), which found that four approximate time-and-place points identified 95 percent of 1.5 million people in an anonymized data set, https://www.nature.com/articles/srep01376
9. The requirement originates in the Transportation Recall Enhancement, Accountability, and Documentation (TREAD) Act of 2000 and Federal Motor Vehicle Safety Standard No. 138, with direct tire pressure monitoring systems required in new light vehicles by the 2008 model year; see the National Highway Traffic Safety Administration rulemaking, Federal Register, Sept. 7, 2005, https://www.federalregister.gov/documents/2005/09/07/05-17661/federal-motor-vehicle-safety-standards-tire-pressure-monitoring-systems
10. I. Rouf and others, Security and Privacy Vulnerabilities of In-Car Wireless Networks: A Tire Pressure Monitoring System Case Study, USENIX Security Symposium (2010), finding a 32-bit static identifier readable from a passing vehicle at roughly 40 meters, https://www.usenix.org/legacy/events/sec10/tech/full_papers/Rouf.pdf. For the 2026 demonstration tracking vehicles over several weeks with low-cost software-defined-radio receivers, see the IMDEA Networks Institute study as reported, https://www.theautopian.com/the-signals-from-your-cars-tire-pressure-sensors-could-be-used-to-monitor-when-you-leave-home-report/
11. On Wi-Fi MAC address randomization in current mobile operating systems, see https://www.cablelabs.com/blog/mac-address-randomization-how-user-privacy-impacts-wi-fi-and-internet-service-providers
12. On defeating randomization, see Jeremy Martin and others, A Study of MAC Address Randomization in Mobile Devices and When It Fails, Proceedings on Privacy Enhancing Technologies 2017, issue 4, which defeated the technique on roughly 96 percent of the Android phones tested, https://petsymposium.org/popets/2017/popets-2017-0054.php. On the Bluetooth Low Energy weakness in Apple’s Continuity protocol, see Handoff All Your Privacy, https://arxiv.org/pdf/1904.10600
13. Hadi Givehchian and others, Evaluating Physical-Layer BLE Location Tracking Attacks on Mobile Devices, IEEE Symposium on Security and Privacy (2022), which fingerprinted devices in public spaces and tracked a volunteer to a residence using equipment costing under 200 dollars, while also documenting practical limits such as sensitivity to temperature; the same group published a mitigation in 2024, https://cseweb.ucsd.edu/~schulman/docs/oakland22-bletracking.pdf
14. SignalTrace product sheet (2025), Tracked Device Types, listing radio-frequency identification tags including key cards and pet microchips; see also the product page, https://www.leonardocompany-us.com/lpr/elsag-signaltrace
15. On passive low-frequency RFID and pet microchips, which carry no power source and transmit only when energized by a scanner held within a few centimeters, see https://enviroliteracy.org/can-nfc-read-pet-microchip/
16. Leonardo, ELSAG SignalTrace materials, https://www.leonardocompany-us.com/lpr/elsag-signaltrace
17. Leonardo US Cyber and Security Solutions press release, May 30, 2024, quoting general manager Jason Laquatra, https://www.businesswire.com/news/home/20240530567391/en/Leonardo-US-Cyber-and-Security-Solutions-receives-a-patent-for-their-new-electronic-signature-tracking-system-for-law-enforcement
18. On the company declining to comment beyond its marketing, see Carscoops, June 2026, https://www.carscoops.com/2026/06/signaltrace-plate-reader-tracking/
19. Carpenter v. United States, 585 U.S. 296 (2018).
20. United States v. Jones, 565 U.S. 400 (2012) (Alito, J., concurring in the judgment); Leaders of a Beautiful Struggle v. Baltimore Police Department, 2 F.4th 330 (4th Cir. 2021) (en banc).
21. Schmidt v. City of Norfolk (E.D. Va. Jan. 27, 2026), granting summary judgment to the city; see https://valawyersweekly.com/2026/02/16/norfolk-license-plate-reader-fourth-amendment-dismissal/
22. On the prevailing result and the reversal of the contrary Virginia trial-court ruling in Commonwealth v. Bell, see the Boston Bar Association survey, Eyes on the Road: AI, Privacy, and Automated License Plate Readers, https://bostonbar.org/journal/eyes-on-the-road-ai-privacy-and-automated-license-plate-readers/
23. Schmidt v. City of Norfolk (E.D. Va. Jan. 27, 2026), as reported, https://courthousenews.com/judge-holds-norfolks-license-plate-reader-use-constitutional/
24. Wiretap Act, 18 U.S.C. § 2510 and following; the definition of contents appears at 18 U.S.C. § 2510(8), and the exemption for radio communications readily accessible to the general public at 18 U.S.C. § 2511(2)(g)(i) and § 2510(16), https://www.law.cornell.edu/uscode/text/18/2510
25. Leonardo materials describing the capture of device frequencies emitted into the air, https://www.leonardocompany-us.com/lpr/elsag-signaltrace
26. Pen register and trap and trace statute, 18 U.S.C. §§ 3121 to 3127 (definition at § 3127(3); court order required at § 3121), https://www.law.cornell.edu/uscode/text/18/3127; Stored Communications Act, 18 U.S.C. § 2701 and following.
27. New York State Senate Bill S9890 (2025-2026), sponsor’s justification stating that there is no existing state framework restricting the use, transfer, storage, or sharing of plate-reader data, https://www.nysenate.gov/legislation/bills/2025/S9890
28. Chapter 632 of the Laws of 2025, amending Executive Law § 840 to require a minimum-standards policy and defining a plate-reader system as one that converts images of license plates into computer-readable data; see Senate Bill S963 (2025-2026), https://www.nysenate.gov/legislation/bills/2025/S963
29.New York State Senate Bill S9890 (2025-2026), which would impose use restrictions, an exclusionary rule, and penalties addressed to captured plate data, https://www.nysenate.gov/legislation/bills/2025/S9890