The legal battle between Michael Katz-Lacabe and Oracle America Inc. In practice, stands as a significant landmark in the evolving landscape of digital privacy, surveillance technology, and the responsibilities of data brokers. Decided by the United States Court of Appeals for the Ninth Circuit, this case scrutinized the intersection of automated license plate reader (ALPR) technology, mass data collection, and the constitutional protections afforded to individuals against unreasonable searches. For legal scholars, privacy advocates, and technology companies alike, the ruling provides critical guidance on how the Fourth Amendment applies to pervasive tracking systems in the digital age.
Background: The Rise of Automated License Plate Readers
To understand the gravity of Katz-Lacabe v. So oracle, one must first understand the technology at its core. Automated License Plate Readers are high-speed camera systems mounted on police patrol cars, traffic lights, or fixed poles. Also, they capture images of every passing vehicle, convert the plate numbers into machine-readable text, and timestamp the location data. Unlike traditional policing methods where an officer manually records a plate number based on reasonable suspicion, ALPRs operate indiscriminately, creating a vast, searchable database of innocent drivers' movements.
Michael Katz-Lacabe, a resident of San Leandro, California, discovered through a public records request that the local police department had scanned his vehicle over one hundred times in a few years. The data revealed a detailed mosaic of his daily life: trips to his children’s schools, visits to his place of worship, and movements around his neighborhood. The San Leandro Police Department (SLPD) retained this data for years and shared it with other agencies through a regional database managed by a private vendor—ultimately leading to the involvement of Oracle America Inc., which acquired the data broker responsible for the platform.
The Legal Challenge: Fourth Amendment and Mosaic Theory
Katz-Lacabe, joined by the Asian Law Caucus and the Electronic Frontier Foundation (EFF), filed a lawsuit alleging that the SLPD’s ALPR program violated the Fourth Amendment’s protection against unreasonable searches and seizures. And the central argument relied heavily on the "mosaic theory" of surveillance, a concept gaining traction in jurisprudence following the Supreme Court’s decision in United States v. Also, jones (2012) and Carpenter v. United States (2018).
The mosaic theory posits that while a single observation of a vehicle in public may not constitute a search, the aggregation of countless data points over time creates an intimate portrait of a person’s life that the Constitution protects. The plaintiffs argued that the SLPD’s program—scanning everyone, retaining data indefinitely, and sharing it widely—constituted a general warrant prohibited by the Fourth Amendment. They sought an injunction to stop the suspicionless collection and retention of ALPR data Not complicated — just consistent..
Oracle America Inc.’s Role in the Litigation
Oracle America Inc. entered the case not as the primary law enforcement actor, but as the corporate successor to the data management platform hosting the ALPR database. Following its acquisition of the vendor (Digital Recognition Network/DataWorks Plus), Oracle inherited the infrastructure that aggregated, stored, and facilitated access to the plate data for hundreds of law enforcement agencies Easy to understand, harder to ignore. Less friction, more output..
The plaintiffs named Oracle as a defendant under a theory of state action or joint participation, arguing that the private corporation was so deeply entwined with the government’s surveillance apparatus that its actions should be treated as governmental action subject to constitutional constraints. This aspect of the case raised profound questions about the privatization of surveillance: when a tech giant provides the "brain" for a dragnet surveillance system, does it assume constitutional obligations?
The District Court Ruling
The United States District Court for the Northern District of California initially dismissed the claims against Oracle. In real terms, the court held that Oracle was a private actor providing a software platform and database services. So it found insufficient evidence that Oracle exercised the kind of coercive power or performed a function traditionally exclusively reserved to the state (like arrest or prosecution) to trigger state action doctrine. Beyond that, the district court ruled that the plaintiffs lacked standing to seek an injunction against the SLPD’s future use of ALPRs, partly because the policy had been updated during litigation to include stricter retention limits and audit requirements.
This dismissal was a setback for privacy advocates who hoped to extend Carpenter’s logic to private data brokers facilitating government surveillance Nothing fancy..
The Ninth Circuit Appeal: Affirming and Refining
The Ninth Circuit Court of Appeals reviewed the case and issued a nuanced opinion that both affirmed the dismissal against Oracle and provided vital dicta (authoritative guidance) on the constitutional limits of ALPR programs The details matter here..
1. Oracle and the State Action Doctrine
The Ninth Circuit affirmed the dismissal of claims against Oracle America Inc. The panel applied the established tests for state action: the public function test, the joint action/entanglement test, and the government compulsion test.
- Public Function: The court held that managing a database—even a massive surveillance database—is not a function "traditionally exclusively reserved to the State." Private companies have long managed data for governments.
- Entanglement/Joint Action: The court found that Oracle’s contractual relationship with the SLPD, while extensive, did not amount to the "pervasive entwinement" required to treat a private entity as the state. Oracle did not dictate how the police used the data (e.g., who to investigate); it merely provided the tool.
- Compulsion: There was no evidence the government coerced Oracle into specific surveillance actions beyond the scope of the contract.
Key Takeaway: This ruling reinforces a high bar for holding private surveillance vendors directly liable under the Fourth Amendment. It suggests that legislative action (statutory regulation) rather than constitutional litigation is the primary vehicle for regulating data brokers like Oracle Still holds up..
2. Standing and the ALPR Program (Claims against the City)
While the claims against Oracle failed, the Ninth Circuit’s discussion regarding the SLPD’s program is where the case offers lasting value. The court vacated the dismissal of the claims against the City of San Leandro and the Police Chief regarding the retention and sharing policies It's one of those things that adds up..
The court recognized that prolonged retention and widespread sharing of ALPR data significantly escalate the privacy intrusion. That said, citing Carpenter, the panel noted that the "retrospective quality" of the data—allowing police to reconstruct a person's past movements at will—implicates a reasonable expectation of privacy. The court ruled that the plaintiffs had standing to challenge the retention and dissemination policies because the ongoing retention of their historical data constituted a continuing injury Simple, but easy to overlook..
This distinction is crucial: Collection vs. Retention. The court suggested that the initial scan of a car in public might be permissible, but the archiving of that scan for years and sharing it with hundreds of agencies transforms the program into a surveillance tool requiring Fourth Amendment scrutiny Practical, not theoretical..
Implications for Privacy Law and Technology Policy
The Katz-Lacabe decision serves as a critical waypoint in the jurisprudence of digital surveillance. Its implications ripple across several domains:
The Limits of Constitutional Litigation Against Vendors
By shielding Oracle under the state action doctrine, the Ninth Circuit signaled that the Constitution is a blunt instrument for regulating the supply chain of surveillance. Plaintiffs cannot easily sue the "arms dealers" of the surveillance economy under Section 1983. This places the onus on state legislatures and Congress to pass laws like the California Consumer Privacy Act (CCPA), the Electronic Communications Privacy Act (CalECPA), or specific ALPR regulation statutes (such as California’s S.B. 34) to impose data minimization, deletion schedules, and audit requirements on vendors.
Defining "Reasonable Expectation of Privacy" in Public
The case contributes to the ongoing project of defining privacy in public spaces. The court’s willingness to entertain the argument that retention and sharing constitute a search distinct from collection aligns with the "equilibrium-adjustment" theory of the Fourth Amendment. As technology lowers the cost of surveillance to near zero, the law must adjust by regulating the lifecycle of data, not just the moment of acquisition Still holds up..
The Mosaic Theory in Practice
The Mosaic Theory in Practice
The Ninth Circuit’s articulation of a mosaic of privacy intrusions—individual scans that, when aggregated, reveal a comprehensive picture of a person’s movements—provides a concrete framework for applying the mosaic theory to modern surveillance technologies. Consider this: the court’s emphasis on prolonged retention and widespread sharing as the transformative elements aligns with the Supreme Court’s reasoning in Carpenter v. United States, where the “retrospective quality” of cell‑site location information (CSLI) was deemed a search because it allowed the government to reconstruct a defendant’s past movements with minimal effort.
And yeah — that's actually more nuanced than it sounds.
In Katz‑Lacabe, the panel extended this logic to ALPR data, holding that the archiving of vehicle‑license scans for years and the dissemination of those archives to dozens of agencies create a “mosaic” that is far more intrusive than any single scan could ever be. The decision thus clarifies that the mosaic theory is not limited to data generated by a single source; it applies whenever multiple data points—each individually innocuous—are combined, stored, and shared over time to produce a detailed portrait of an individual’s life.
Not the most exciting part, but easily the most useful Not complicated — just consistent..
Practical Implications for Litigators
- Focusing on the Data Lifecycle – Plaintiffs can now target the post‑collection stage of surveillance programs, arguing that retention periods, sharing agreements, and data‑mining practices constitute the actionable search. This shifts the litigation focus from the moment a car passes a camera to the policies governing what happens to the captured image.
- Leveraging Standing Arguments – By recognizing that ongoing retention creates a “continuing injury,” the court opened the door for plaintiffs to assert standing based on the future risk of privacy invasion, not merely on past exposure. This is especially valuable in cases where the data has already been collected but the plaintiff can demonstrate a realistic threat of future misuse.
- Using Vendor Contracts as Evidence – While the state‑action doctrine shields vendors like Oracle, the court’s discussion of the supply chain suggests that plaintiffs may still introduce vendor contracts to illustrate the scope of data sharing and retention obligations. Such evidence can help establish the joint enterprise necessary to trigger municipal liability under § 1983.
Policy Recommendations
- Statutory Data‑Minimization Requirements – Legislatures should enact clear mandates that limit the duration of ALPR data retention (e.g., 30‑day or 90‑day windows) and prohibit indiscriminate sharing with third‑party agencies unless a specific, time‑bound purpose is demonstrated.
- Audit and Transparency Provisions – State and local governments must be required to publish annual reports detailing the number of ALPR stops, the agencies receiving data, and the retention schedules employed. Independent audits can verify compliance with constitutional standards.
- Vendor Accountability Frameworks – While the Constitution does not directly regulate private actors, states can impose contractual obligations on technology vendors through procurement rules, conditioning contracts on adherence to privacy‑by‑design principles and providing a private right of action for breach.
- Judicial Oversight of Retention Policies – Courts can adopt a sliding‑scale review for retention periods, balancing law‑enforcement needs against privacy interests. A probable‑cause threshold for extending retention beyond the initial window would align with Fourth Amendment jurisprudence.
Conclusion
Katz‑Lacabe marks a important moment in the evolving dialogue between privacy rights and the realities of automated surveillance. By distinguishing between the collection of a vehicle’s license plate and the retention and sharing of that information, the Ninth Circuit has provided a nuanced roadmap for challenging the most pervasive forms of modern policing technology. The decision underscores that the Fourth Amendment’s protections are not static; they must adapt to the cumulative effect of data aggregation, retention, and dissemination.
For advocates, legislators, and technologists alike, the case offers a clear directive: privacy must be safeguarded throughout the entire data lifecycle, not merely at the point of acquisition. As surveillance tools become ever more sophisticated, Katz‑Lacabe stands as a foundational precedent that will shape future litigation, inspire solid statutory reforms, and ultimately recalibrate the balance between public safety and individual liberty in the digital age.
