Your Phone Is About to Be Tracked Alongside Your Car

A surveillance company called Leonardo is developing an upgrade to automatic license plate reader (ALPR) infrastructure — the roadside cameras that photograph vehicle plates. The upgrade would add sensors that capture the unique identifiers broadcast by mobile phones, AirPods, smartwatches, and other Bluetooth and Wi-Fi devices passing nearby, according to a report published June 9, 2026 by 404 Media.

What this means in practical terms: a roadside camera that today records a license plate, time, and location would simultaneously record the device fingerprints of everyone inside or near the vehicle. It would create a link between your personal devices and your location at a specific moment in time.

What Leonardo Is Building

The system adds wireless sensors placed next to existing camera units. These sensors pick up the radio signals that Bluetooth and Wi-Fi devices constantly broadcast — even when your phone is not actively connecting to anything.

From those signals, the system extracts device identifiers: the unique addresses that each device broadcasts as part of normal operation. Think of this like a silent call-out that your device makes automatically, which the sensor simply listens to and records.

Modern phones from Apple, Google, and others use a defense called MAC randomization — they change the identifiers they broadcast regularly, like changing your license plate every few minutes. But research has shown that these randomized identifiers can still be linked back to the same person through several methods: by watching the sequence of signal bursts, by analyzing the specific details each device includes in its broadcasts, or by using the fact that multiple devices traveling together will be captured at the same roadside location.

ALPR networks are run by a mix of police departments and private companies. The dominant commercial operator, Vigilant, runs a nationwide camera grid that police departments subscribe to and use. Leonardo's sensor would plug into these existing networks, turning what is already the most widespread fixed surveillance camera system on American roads into something different: a system that tracks both vehicles and the people in them.

The Data Picture This Creates

Think about what happens when this system scales up. Today, each license plate photo creates a simple record: plate number, time, location. With Leonardo's upgrade, that record would also include the device identifiers of people nearby.

Imagine the same phone passing multiple ALPR cameras over weeks or months. Each capture adds another dot on a map. Over time, a movement pattern emerges — showing where that person went, when they went there, and how often they repeated routes. Unlike a license plate, which can be on a borrowed or rented car, a phone stays with the person who owns it.

This movement history can be connected to a person's actual identity in several ways: through cell phone company records, through apps that track location, through advertising systems that know who you are, or simply because most people name their Bluetooth devices something like "John's iPhone."

There is another use here too. A license plate identifies the registered owner — who might not be the person driving. But the phones captured at the same moment identify the actual people present in the vehicle. If multiple phones are captured in the same car on multiple trips, the system can start to infer who regularly travels together.

Law enforcement, private companies, and data brokers would each have reasons to want this information.

How Good Are the Defenses

Mobile devices have had protections against this kind of tracking for years. Apple added address randomization to iPhones in 2014, and Android phones followed more gradually, with stronger protections by 2019. The goal was exactly to stop the kind of tracking Leonardo is attempting.

But the defenses are incomplete. Several research teams have shown that even when addresses are randomized, other patterns in the radio signals can give away the same device: the order of the signals, the specific features included in each transmission, or the fact that a sensor can track a phone moving from one camera to the next.

Smartwatches and AirPods complicate this further. These devices pair continuously with a phone and broadcast their own signals on their own schedules. Even if a phone's randomization is strong, the watch or earbuds might broadcast something that stays consistent enough to track.

The upshot is that randomization makes tracking harder and more expensive, but does not make it impossible — especially for a company or government with access to many cameras capturing the same devices over time.

What the Law Says — and Does Not Say

The United States has no federal law that specifically prohibits collecting these radio signals in public. Courts have traditionally said that information you broadcast into the air — like a Wi-Fi or Bluetooth signal — is not protected from being collected by others.

But there is a complication. In 2018, the Supreme Court ruled in Carpenter v. United States that when the government collects detailed, long-term location data on someone, it needs a warrant. The case was about cell phone records, but the principle could apply to this kind of ALPR tracking. However, no appellate court has yet directly ruled on whether passive RF collection fits under that same principle.

There is a gap here worth considering. If a police department collected this data directly, it might face legal challenges. But if a private company like Leonardo collects it and sells it to police, the private company operates in a much less constrained space — at least until Congress or the courts change that.

We Have Seen This Before

This is not the first time the industry has attempted passive device tracking. In the early 2010s, retail analytics companies deployed sensors in stores to track where shoppers walked and how long they spent in each section. The backlash was quick: major retailers removed the systems, and the FTC issued guidance cautioning against the practice.

But those store sensors operated in controlled spaces where customers could at least see a notice that tracking was happening. A roadside camera on a public street has no such boundaries. There is no sign posted. There is no way to opt out except to leave your phone at home. Everyone who drives past is captured, regardless of whether they have any reason to expect it. And the data sits in private company databases with retention policies that only the company chooses.

What To Watch For

As of this article's publication date, Leonardo has not announced a large-scale rollout. But the 404 Media report indicates this is a planned capability.

The engineering itself is not cutting-edge. The sensor hardware is available today, connecting it to license plate readers is straightforward, and there is a clear financial incentive: a dataset linking vehicles, devices, and locations is worth much more to data brokers, police, insurance companies, and fleet operators than license plates alone.

The question now is whether state legislatures will move to explicitly ban this kind of wireless collection in public. Another question is whether major police departments will publicly say whether they plan to subscribe to this enriched data. And a third is whether Apple, Google, and chipset makers will strengthen their randomization schemes in response.

The pattern in surveillance technology is consistent: once a capability exists, the restraint that follows depends almost entirely on laws and policies that in this area have historically trailed behind the technology by years.