When your number plate becomes a data point in the car park

Australians park their cars more than a billion times a year, and at an increasing number of those stops a small device quietly photographs the rear of every vehicle, logs the registration, and sends the digits off to a server somewhere. Automatic Number Plate Recognition, often shortened to ANPR in this country, has moved well beyond its original role in policing stolen vehicles and unregistered drivers. It now sits at the entry boom gates of Westfield centres, in the multi-storey car parks of Brisbane's CBD, and inside the airport parking facilities of Sydney and Melbourne.

For most drivers the experience is unremarkable. You drive in, a gate lifts, you park, you shop, and on the way out a ticket machine or a tap of a credit card lets you leave. Few people stop to ask what happens to the photograph of their number plate, how long it is stored, or which third parties may eventually see it. The question matters because a vehicle registration is not just a string of characters. It is a stable identifier that follows a car, and through it the car's owner, into a growing web of commercial surveillance.

How ANPR cameras read and log vehicles

The cameras mounted at car park entrances use optical character recognition tuned to the high-contrast fonts used on Australian plates. When a vehicle passes, the camera captures a frame, the software extracts the registration number, and that number is timestamped and geotagged. The image itself may be retained for a short period, but the registration string often lives for months or years in the operator's database.

Modern systems can read plates at speeds well above the posted limit of most car park driveways, and they work in low light, in rain, and on the slightly skewed angles produced by vehicles cornering into a bay. Operators typically combine the plate data with any other signals they can collect: the time of entry, the duration of stay, the payment method used, and the loyalty card or membership number if one is presented at the same time. Stitched together, these pieces build a surprisingly detailed portrait of an individual driver.

The technical capability is not in dispute. What is far less settled is whether the data collected for the narrow purpose of letting someone exit a car park should be allowed to drift into other uses, such as marketing, debt recovery, or law enforcement intelligence.

Where these systems are showing up around Australia

A drive around any major Australian capital reveals how quickly the technology has spread. In Sydney, the large privately operated car parks near Central Station and the harbour-side precincts run plate recognition as a default. In Melbourne, the parking facilities attached to Chadstone and to the airport terminals have used the technology for several years. Brisbane's council-operated King George Square car park was an early adopter, and similar systems now appear in Perth, Adelaide and the Gold Coast.

Beyond the obvious shopping and airport locations, the same cameras have appeared in places that surprise many drivers. Drive-through fast food chains in suburban Sydney log plates to confirm loyalty discounts. Some inner-city hotels scan plates at valet bays to streamline check-in. Residential apartment buildings use them to manage visitor access, often retaining every plate that passes the gate, including those of guests, rideshare drivers, and delivery couriers who never enter the building.

The pattern matters. Each location feels small in isolation, but the same registration plate can be recorded dozens of times in a single week by operators that never share a customer relationship. For a regulator, that fragmentation makes accountability difficult, because each operator can argue it is only collecting a tiny, proportionate slice of information.

What data ends up in the database

The information gathered by a car park camera extends well beyond a simple entry and exit time. A typical record contains the plate number, the make and model read from the image, the precise time of arrival and departure, the payment card token used, and any cross-reference to a booking platform. If the driver is a member of the car park's loyalty program, their name, email address, and vehicle make are usually linked.

Less obviously, the system often pulls in ancillary signals. Car park operators in several states now integrate with toll road accounts and traffic infringement databases. A driver who uses a particular eTag provider may find that their parking record is matched to their toll history, even though they never gave explicit consent for that join.

Some operators go further and run the plate through commercial data brokers on the back end. The plate becomes a key that pulls in the registered keeper's address, the insurer on file, and any other commercial data attached to the vehicle. None of this is visible to the driver at the boom gate, which is why many Australians only discover the breadth of the data trail after reading a privacy policy they never agreed to in writing.

Who else can see the records

Privacy policies for these operators typically list a long list of permitted recipients. Local police routinely request ANPR data to investigate everything from petty theft in shopping centres to serious offences, and most operators hand the data over without requiring a warrant. State road authorities request it for unpaid toll matching. Insolvency firms and lawyers acting for clients in debt disputes use it to track down vehicles associated with debtors.

The more troubling uses sit further down the list. Several large commercial car park operators in Australia sell aggregated, anonymised movement data to retail analytics firms that advise shopping centres on which brands attract which demographics. The aggregation may strip out the plate number, but the underlying records remain in identifiable form inside the operator's systems, accessible to staff who often have only modest training in data handling.

This is where car park surveillance starts to resemble other corners of the data economy. The mechanics are remarkably similar to those seen in children's game surveillance, where free play is paid for by behavioural profiling that the player, or their parent, has never knowingly agreed to. A close look at that parallel shows how the same playbook of consent theatre and quiet data sharing plays out in a very different setting, and why a critical eye on one corner of surveillance tends to be useful in another.

The legal landscape in Australia

Australia's privacy framework offers more protection on paper than in practice. The Privacy Act 1988 and the Australian Privacy Principles apply to businesses with an annual turnover above three million dollars, which captures most large car park operators. In principle, those operators must tell people what they are collecting, why, and how long they will keep it.

In practice, the signage at a car park entrance rarely does this work. A small notice beside the boom gate might mention that vehicles are recorded, but the dense privacy policy sits on a website most drivers will never visit. The Office of the Australian Information Commissioner has issued guidance on collection notices, but enforcement is rare and tends to follow a complaint rather than proactive auditing.

State and territory laws add another layer. New South Wales and Victoria both have surveillance devices legislation that restricts where cameras can be pointed and what they can record, but the wording tends to focus on people rather than vehicles. Queensland's regulation is looser still. The result is a patchwork in which the same technology, capturing the same kind of data, is governed differently depending on which side of a state border a driver happens to park.

What drivers can practically do

None of this should be read as a counsel of despair. There are concrete steps that make a difference, starting with the choice of where to park. Council-operated facilities in most capitals publish clearer retention policies than some of the private operators, and some smaller operators simply do not invest in plate recognition at all. Reading the signage at the entrance is a small act that takes seconds and often reveals more than the website does.

Drivers who want to push back more actively can ask, in writing, for a copy of any personal data held about them under Australian Privacy Principle 12. The first request is free, and operators are required to respond within thirty days. The responses are often revealing, because they expose how much has been collected and how widely it has been shared. They are also useful evidence if a complaint to the OAIC becomes necessary.

For broader protection beyond the car park, the discussion of physical privacy measures offers a useful starting point. It collects practical habits that reduce the amount of data leaked from everyday movements, including the small choices that matter in car parks, on footpaths, and at building entrances. Combined with the formal right to request your data, those habits shift the balance back toward the driver, one car park at a time.

The most durable protection comes from paying attention to the small print at the boom gate and treating every entry as a data event. A number plate is not just a regulatory identifier. It is a stable link between a person, a vehicle, and a long trail of recorded movements, and the only one who can decide how much of that trail to leave behind is the person behind the wheel.