[uoaei]

"Anyone could have been driving my car, you can't positively identify me in the driver's seat with the evidence you have submitted" is routinely used to toss out cases involving traffic violations. It's not necessarily common but it does happen. By this logic a license plate does not personally identify the person driving, only the person the car is registered to.

[danudey]

Yet the same is true of IP addresses. You (typically) cannot know for certain whether traffic from an IP address was originated by a specific person and yet it's typically considered PII because it can be used in conjunction with other information to identify you.

Even your full legal name and birth date cannot be guaranteed to refer only to you specifically (as there could be someone else with an identical name and birth date), but it's obviously still PII because it helps narrow the field immensely if you can combine it with other information - for example, your IP address.

So yeah, "anyone could have been driving my car", but if you also know that the car drove from your home to your work then that narrows down the list of likely individuals immensely.

Conversely, if your license plate was spotted parked near an anti-ICE rally, then they can be pretty confident that you or someone you know was near an anti-ICE rally, which means they can harass you about it, follow you around, shoot you in the street, etc.

[tomwheeler]

The standard of proving someone's guilt in a crime or civil infraction is higher than the one for inferring that someone could plausibly be the person you want. This is the basis of parallel construction, wherein a government agency plays a game of "pin a crime on the suspect."

[lcnPylGDnU4H9OF]

Right, but in this context the license plate number is still personal information, just of a different person.

[kube-system]

The CCPA explictly says:

> “Personal information” does not include [...] Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer

[tptacek]

California has an entire statute regulating ALPR information, so we don't need to derive this axiomatically.

[kube-system]

One generally has to follow all of the laws, so evaluating what the CCPA says here is relevant for evaluating CCPA compliance.

[uoaei]

Yes, all the laws, including the ond GP is referring to.

[uoaei]

Then the key aspect of our discussion is the "identifiable" part, which you've left out.

[lcnPylGDnU4H9OF]

Are you now saying that one cannot possibly "identify" the "person" who owns a vehicle, solely with the "information" on a license plate?

[ndsipa_pomu]

You may be confused, but the owner of a vehicle is not necessarily the same as the driver of a vehicle. Recording a vehicle's license plate does not necessarily identify the driver unless they also happen to be the owner. (c.f. vehicle hiring companies)