How Police Roadside Cameras Could Track Your Personal Devices

A surveillance company called Leonardo is developing an upgrade to automatic license plate reader (ALPR) infrastructure — the roadside cameras police use to photograph vehicle plates — that would add the ability to capture identifying signals from mobile phones, AirPods, smartwatches, and other Bluetooth and Wi-Fi devices passing nearby. According to a report published June 9, 2026 by 404 Media, the system would record these device identifiers alongside the vehicle plate, timestamp, and location.

The significance is straightforward: a camera that currently logs only "this vehicle was here at this time" would simultaneously record "these personal devices were in or near this vehicle at this time." Over many captures across different locations, that creates a movement record — not of the vehicle, but of the person carrying the device.

What Leonardo Is Building

Leonardo's upgrade adds wireless sensors placed next to existing ALPR cameras. These sensors listen passively for the radio signals that Bluetooth and Wi-Fi devices broadcast constantly — the same signals a device sends when it's searching for networks to join or advertising its presence to nearby devices, even when you're not actively using it.

From those signals, the system extracts device identifiers: MAC addresses (a unique hardware ID for Wi-Fi) and Bluetooth addresses. Both are theoretically one-of-a-kind for each device.

However, Apple and Google have deployed MAC randomization — a defensive measure that changes these identifiers periodically so devices become harder to track. Apple added this to iPhones starting in 2014; Android followed with stronger versions by 2020. The question is whether this protection actually works against a system like Leonardo's. Research teams have found ways to re-identify randomized devices by looking at timing patterns, the specific way devices advertise themselves, or by combining data from multiple camera locations. Smartwatches and AirPods add another layer: these devices often stay connected to your phone on their own schedules, potentially providing a secondary tracking anchor even if your phone's randomization works.

ALPR networks today are operated by police departments and commercial companies like Vigilant, which runs a large network of cameras across the United States. Leonardo's sensor upgrade would fit into this existing infrastructure, turning what is currently a vehicle-tracking system into a dual system that tracks both vehicles and the people in them.

The Data Picture This Creates

When an ALPR camera photographs a plate today, it records: the plate number, the time, the location, sometimes an image. With Leonardo's upgrade, it would also record the unique device identifiers of phones, watches, and earbuds detected in that moment.

Now extend this across thousands of cameras over months. The same device identifier shows up repeatedly, moving across the city over time. That's a person's movement history, anchored not to a vehicle (which could be borrowed or rented) but to a personal device. That history can be connected to a real person through many routes: phone carrier records, app data, or simply the fact that most people name their phone something containing their actual name.

The system also identifies who is actually in the vehicle. A license plate shows the registered owner — who might not be driving it. Device identifiers show whoever is physically present. Multiple devices detected together suggest occupancy: how many people are traveling together, and where they go repeatedly.

The Defense Layer and Why It's Limited

MAC randomization was designed specifically to prevent this kind of tracking. Yet research shows the protection is incomplete.

When a device randomizes its MAC address, it still leaves traces. The sequence numbers embedded in Wi-Fi signals can be tracked. Different phones include slightly different information in how they advertise themselves — details that depend on the chipset and software they use — and those fingerprints survive address rotation. Most critically, when you have sensors positioned across a network of roadside cameras, the tight timing of when they see the same device moving from one point to another creates a correlation that randomization alone cannot obscure.

Bluetooth devices have similar weaknesses under careful analysis. Smartwatches and AirPods, because they stay bonded to a phone on their own schedule, sometimes don't rotate their identifiers at the same rate. This gives a tracker a backup signal.

The upshot: randomization makes passive tracking harder to pull off, but does not prevent it — especially for an organization with access to data from multiple linked camera locations.

The Legal Gray Zone

The United States has no federal law that specifically prohibits collecting these wireless signals from public spaces. The legal traditions that might apply — like the Third-Party Doctrine, which says you have limited privacy in information you share with third parties — offer weak protection when your phone is constantly broadcasting into the air.

Some state laws touch on related issues. Illinois, California, and Washington have passed biometric and location privacy regulations, but none directly address this type of device collection.

The more important legal question is whether the Fourth Amendment — which protects against unreasonable government searches — applies. The Supreme Court's 2018 decision in Carpenter v. United States said that long-term location tracking by police requires a warrant, marking a shift away from older legal thinking. Whether roadside RF collection reaches the same constitutional bar has not been resolved by courts yet.

Here is where the private-company structure matters. If a police department collected this data directly using its own cameras, courts would likely scrutinize the practice. But if a private company like Leonardo collects it and then sells it to police, the legal constraints are much looser, at least until Congress or courts step in. Leonardo's business model fits neatly into this gap.

We Have Seen This Before

The retail industry tried this approach in the early 2010s. Companies like Euclid Analytics and RetailNext deployed Bluetooth and Wi-Fi sensors inside stores to track shopper movement and how long people spent near products — using the same passive signal-collection method Leonardo is proposing for roadside. The public reaction was sharp enough that major retailers stopped using the systems, and the FTC issued guidance.

That episode stayed contained because it happened inside private stores where operators could, in theory, post notices and offer opt-outs. A roadside deployment has none of those boundaries. There is no posted warning. There is no way to opt out except leaving your devices at home. Every driver and pedestrian is captured regardless of consent or relationship to the operator. And the data lives in commercial databases whose storage rules are set by the vendor alone.

What Comes Next

Leonardo has not yet announced when or where this system will actually go into use. The 404 Media article describes it as planned, not yet deployed at large scale.

But the technology is not complicated or particularly new. The sensor components are off-the-shelf. Integrating them with existing ALPR infrastructure is straightforward. And the economic motive is powerful: a dataset linking vehicle identity to device identity to location over time is worth significantly more to data brokers, police departments, and insurance companies than vehicle-only data.

The key signals to watch are whether state legislatures pass laws specifically regulating this kind of passive wireless collection, whether major police customers publicly commit to or reject subscribing to the enriched data, and whether Apple, Google, or chipset makers speed up their randomization defenses.

The history of surveillance technology teaches a durable lesson: once a capability exists and is deployed, whether it gets used responsibly depends almost entirely on legal rules and policy guardrails — and in this area, policy has consistently lagged behind the technology itself.