4 ms·

“Personal information” has a legal definition and photos of you in a public street might not satisfy it, regardless of the photographer’s intent.

kstrauser 6mo ago
I think it'd be challenging to rule that a license plate number is not personally identifiable information, when the same regulations often state that an IP address is.
- uoaei 6mo ago
  "Anyone could have been driving my car, you can't positively identify me in the driver's seat with the evidence you have submitted" is routinely used to toss out cases involving traffic violations. It's not necessarily common but it does happen. By this logic a license plate does not personally identify the person driving, only the person the car is registered to.
  - lcnPylGDnU4H9OF 6mo ago
    Right, but in this context the license plate number is still personal information, just of a different person.
    - uoaei 6mo ago
      Then the key aspect of our discussion is the "identifiable" part, which you've left out.
      - lcnPylGDnU4H9OF 6mo ago
        Are you now saying that one cannot possibly "identify" the "person" who owns a vehicle, solely with the "information" on a license plate?
        ndsipa_pomu 6mo ago
        You may be confused, but the owner of a vehicle is not necessarily the same as the driver of a vehicle. Recording a vehicle's license plate does not necessarily identify the driver unless they also happen to be the owner. (c.f. vehicle hiring companies)
    - kube-system 6mo ago
      The CCPA explictly says: > “Personal information” does not include [...] Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer
      - tptacek 6mo ago
        California has an entire statute regulating ALPR information, so we don't need to derive this axiomatically.
        kube-system 6mo ago
        One generally has to follow all of the laws, so evaluating what the CCPA says here is relevant for evaluating CCPA compliance.
        uoaei 6mo ago
        Yes, all the laws, including the ond GP is referring to.
  - danudey 6mo ago
    Yet the same is true of IP addresses. You (typically) cannot know for certain whether traffic from an IP address was originated by a specific person and yet it's typically considered PII because it can be used in conjunction with other information to identify you. Even your full legal name and birth date cannot be guaranteed to refer only to you specifically (as there could be someone else with an identical name and birth date), but it's obviously still PII because it helps narrow the field immensely if you can combine it with other information - for example, your IP address. So yeah, "anyone could have been driving my car", but if you also know that the car drove from your home to your work then that narrows down the list of likely individuals immensely. Conversely, if your license plate was spotted parked near an anti-ICE rally, then they can be pretty confident that you or someone you know was near an anti-ICE rally, which means they can harass you about it, follow you around, shoot you in the street, etc.
  - tomwheeler 6mo ago
    The standard of proving someone's guilt in a crime or civil infraction is higher than the one for inferring that someone could plausibly be the person you want. This is the basis of parallel construction, wherein a government agency plays a game of "pin a crime on the suspect."
- adrr 6mo ago
  Or home address, phone number, etc
lcnPylGDnU4H9OF 6mo ago
Indeed, that definition is included in the CCPA. > (v) (1) “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following [...]: > (E) Biometric information. > (H) Audio, electronic, visual, thermal, olfactory, or similar information. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.140.&lawCode=CIV https://leginfo.legislature.ca.gov/faces/codes_displaySectio... To your point, the intent would presumably still matter for exceptions to when deletion requests must be honored (say for journalism), but a photo of someone walking down a public street would still logically be considered the subject's personal information, by the above definition.
necovek 6mo ago
Personal information usually does include photos of someone in public without their consent: exceptions usually hold for taking photos of people where it is in the public interest to be able to show them or impractical to get consent. This covers large gatherings and celebrities, but a portrait photo of a stranger might put you on the wrong side of the law. Obviously, the idea is to not disallow having someone take a photo of you as a background, passing figure as they take a front-and-center photo of their family, but not allow you to be the main subject unknowingly and especially when you object explicitly. On the other hand, a photographer still owns the copyright to a photo, so a subject (including in a portrait) cannot claim it or distribute it without permission even if they can potentially stop the photographer from distributing that photo. IANAL, but you are not by default allowed to use anyone's "likeness" for your individual profit.
- patrickmay 6mo ago
  > Personal information usually does include photos of someone in public without their consent This is not the case in the United States. There is no presumption of privacy in public. In fact, there is a whole genre known as "street photography" that involves taking pictures in public without explicit consent of the subjects.
  - necovek 6mo ago
    You seem to be right, thanks for the correction! If https://legalclarity.org/can-you-post-someones-picture-without-their-permission/ https://legalclarity.org/can-you-post-someones-picture-witho... is to be trusted though, at least you get protection from your likeness being used for commercial purposes, though that seems a bit more limited than I'd expect.
  - tadfisher 6mo ago
    This is true, and it may also be true that location tracking through surveillance networks crosses a line into violating one or more Constitutional rights. One of Flock's revenue streams is explicitly selling access to data made available by other customers. A commonly-cited example is the ability of local law enforcement to locate abortion suspects in other states using the Flock camera network [0]; one could imagine dragnet-style or geofenced queries to also cross the line. [0]: https://www.eff.org/deeplinks/2025/10/flock-safety-and-texas-sheriff-claimed-license-plate-search-was-missing-person-it https://www.eff.org/deeplinks/2025/10/flock-safety-and-texas...
tadfisher 6mo ago
Well, it matters if the photographer is the government (or contracted by the government, or subpoenaed by the government): see Chatrie v. United States [0]. The Fourth Amendment exists, and it remains to be tested whether querying massive surveillance networks is a "reasonable" search. [0]: https://www.scotusblog.com/cases/case-files/chatrie-v-united-states/ https://www.scotusblog.com/cases/case-files/chatrie-v-united...
- snowwrestler 6mo ago
  True but the Fourth Amendment doesn’t rely on the CCPA for authority!

kstrauser 6mo ago

I think it'd be challenging to rule that a license plate number is not personally identifiable information, when the same regulations often state that an IP address is.

uoaei 6mo ago
"Anyone could have been driving my car, you can't positively identify me in the driver's seat with the evidence you have submitted" is routinely used to toss out cases involving traffic violations. It's not necessarily common but it does happen. By this logic a license plate does not personally identify the person driving, only the person the car is registered to.
- lcnPylGDnU4H9OF 6mo ago
  Right, but in this context the license plate number is still personal information, just of a different person.
  - uoaei 6mo ago
    Then the key aspect of our discussion is the "identifiable" part, which you've left out.
    - lcnPylGDnU4H9OF 6mo ago
      Are you now saying that one cannot possibly "identify" the "person" who owns a vehicle, solely with the "information" on a license plate?
      - ndsipa_pomu 6mo ago
        You may be confused, but the owner of a vehicle is not necessarily the same as the driver of a vehicle. Recording a vehicle's license plate does not necessarily identify the driver unless they also happen to be the owner. (c.f. vehicle hiring companies)
  - kube-system 6mo ago
    The CCPA explictly says: > “Personal information” does not include [...] Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer
    - tptacek 6mo ago
      California has an entire statute regulating ALPR information, so we don't need to derive this axiomatically.
      - kube-system 6mo ago
        One generally has to follow all of the laws, so evaluating what the CCPA says here is relevant for evaluating CCPA compliance.
        uoaei 6mo ago
        Yes, all the laws, including the ond GP is referring to.
- danudey 6mo ago
  Yet the same is true of IP addresses. You (typically) cannot know for certain whether traffic from an IP address was originated by a specific person and yet it's typically considered PII because it can be used in conjunction with other information to identify you. Even your full legal name and birth date cannot be guaranteed to refer only to you specifically (as there could be someone else with an identical name and birth date), but it's obviously still PII because it helps narrow the field immensely if you can combine it with other information - for example, your IP address. So yeah, "anyone could have been driving my car", but if you also know that the car drove from your home to your work then that narrows down the list of likely individuals immensely. Conversely, if your license plate was spotted parked near an anti-ICE rally, then they can be pretty confident that you or someone you know was near an anti-ICE rally, which means they can harass you about it, follow you around, shoot you in the street, etc.
- tomwheeler 6mo ago
  The standard of proving someone's guilt in a crime or civil infraction is higher than the one for inferring that someone could plausibly be the person you want. This is the basis of parallel construction, wherein a government agency plays a game of "pin a crime on the suspect."
adrr 6mo ago
Or home address, phone number, etc

lcnPylGDnU4H9OF 6mo ago

Indeed, that definition is included in the CCPA. > (v) (1) “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following [...]: > (E) Biometric information. > (H) Audio, electronic, visual, thermal, olfactory, or similar information. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.140.&lawCode=CIV https://leginfo.legislature.ca.gov/faces/codes_displaySectio... To your point, the intent would presumably still matter for exceptions to when deletion requests must be honored (say for journalism), but a photo of someone walking down a public street would still logically be considered the subject's personal information, by the above definition.

necovek 6mo ago

Personal information usually does include photos of someone in public without their consent: exceptions usually hold for taking photos of people where it is in the public interest to be able to show them or impractical to get consent. This covers large gatherings and celebrities, but a portrait photo of a stranger might put you on the wrong side of the law. Obviously, the idea is to not disallow having someone take a photo of you as a background, passing figure as they take a front-and-center photo of their family, but not allow you to be the main subject unknowingly and especially when you object explicitly. On the other hand, a photographer still owns the copyright to a photo, so a subject (including in a portrait) cannot claim it or distribute it without permission even if they can potentially stop the photographer from distributing that photo. IANAL, but you are not by default allowed to use anyone's "likeness" for your individual profit.

patrickmay 6mo ago
> Personal information usually does include photos of someone in public without their consent This is not the case in the United States. There is no presumption of privacy in public. In fact, there is a whole genre known as "street photography" that involves taking pictures in public without explicit consent of the subjects.
- necovek 6mo ago
  You seem to be right, thanks for the correction! If https://legalclarity.org/can-you-post-someones-picture-without-their-permission/ https://legalclarity.org/can-you-post-someones-picture-witho... is to be trusted though, at least you get protection from your likeness being used for commercial purposes, though that seems a bit more limited than I'd expect.
- tadfisher 6mo ago
  This is true, and it may also be true that location tracking through surveillance networks crosses a line into violating one or more Constitutional rights. One of Flock's revenue streams is explicitly selling access to data made available by other customers. A commonly-cited example is the ability of local law enforcement to locate abortion suspects in other states using the Flock camera network [0]; one could imagine dragnet-style or geofenced queries to also cross the line. [0]: https://www.eff.org/deeplinks/2025/10/flock-safety-and-texas-sheriff-claimed-license-plate-search-was-missing-person-it https://www.eff.org/deeplinks/2025/10/flock-safety-and-texas...

tadfisher 6mo ago

Well, it matters if the photographer is the government (or contracted by the government, or subpoenaed by the government): see Chatrie v. United States [0]. The Fourth Amendment exists, and it remains to be tested whether querying massive surveillance networks is a "reasonable" search. [0]: https://www.scotusblog.com/cases/case-files/chatrie-v-united-states/ https://www.scotusblog.com/cases/case-files/chatrie-v-united...

snowwrestler 6mo ago
True but the Fourth Amendment doesn’t rely on the CCPA for authority!