Did You Get a Mysterious Parking Fine in the Mail? This May Be the Nefarious Reason Why.

Spencer loves movies. He used to go to the Regal City North cinema in Chicago three times a week. But he never goes there anymore—because of the parking lot.

The parking garage, which is directly connected to the theater, once charged $2 for parking. Then it fell into disrepair sometime during the pandemic. "Someone destroyed the crossbar at the exit, and the stairwells had broken glass in them. They never replaced the glass for the stairwell," Spencer told me. For a long time after that, the theater just stopped charging for parking.

Then, in March 2023, Spencer parked his car in the lot for a movie, and left through the ungated exit, as usual. A few days later, a letter came in the mail, addressed to his wife. It contained a picture of the car and license plate number, and claimed that his wife owed $100 to ABM Industries, an outsourcing company that makes billions in revenue each year managing parking lots and other facilities like schools, hospitals, and airports all over the country. "We thought it was a total scam," he said, especially since the fine was mistakenly addressed to his wife instead of him.

But when the couple went back to the theater to ask about it, they found that there was a sign directing customers to scan a QR code to pay for parking—but only inside the theater itself. Later, they found dozens of reviews online complaining about similar incidents. It turned out that ABM—which did not respond when reached for comment—had taken over the parking lot in February 2023 and started sending out fines to customers who did not pay. Some reviewers reported that they were able to get the fees waived just by calling the company. Others weren't so lucky, and kept getting text messages and letters with escalating fines.

Spencer and the other Regal customers found themselves in the middle of a controversial business practice that utilizes A.I. surveillance technology and exploitative tactics in order to target drivers for simply parking at the garage. They aren't the only ones to have been targeted, either. Around the country and the world, more and more parking companies are quietly installing automated license plate readers—ALPRs—in their lots and using them to track clients, and, in some cases, send out fines the way ABM is doing at the Regal City North parking lot.

While the tech is annoying and even scary when used to send out unexpected parking fines, it's an indicator of a much larger problem surrounding A.I. and its increasing intrusion into our private lives—one that could even be weaponized against marginalized communities like women, trans people, people of color, and undocumented immigrants.

ABM is now one of at least six parking companies facing a class-action lawsuit for allegedly violating the 1994 Driver's Privacy Protection Act. The law was passed in response to the murder of actress Rebecca Schaeffer, whose killer hired a private investigator to track her down using her license plate number, and limits who can access vehicle registration information and use it to track people. But it's full of loopholes, and may not be sufficient to protect customers' privacy, according to experts.

All of the companies facing lawsuits used ALPRs, which harness A.I. computer vision technology to scan and track plates—the same technology is employed by face- and image-recognition softwares. Law enforcement agencies have used ALPRs for a long time to track vehicles, including for parking violations, but privacy advocates have warned that even government entities can overuse the technology to track anyone with their car's every move .

More lawsuits may emerge, as the practice of using license plate readers to issue parking fines is clearly becoming more popular. One Reddit user shared a screenshot of a fine from a private lot in Dallas that utilizes ALPR cameras, wondering whether it was legitimate. Parking management firm AirGarage advertises on its website that it uses license plate numbers to issue fines in the mail. Many other parking companies throughout the country offer ALPR enforcement services.

ABM's privacy policy states that the company does "not connect the name of the owner of the vehicle with the license plate unless specifically authorized or submitted by the owner of the vehicle," suggesting that they are getting permission from car owners to use their vehicle registration information to send them fines. This was not true of Spencer or other Regal customers, who had no idea there were ALPRs in the lot.

Private companies are increasingly using A.I. surveillance tools to try to turn a profit, and our privacy laws have yet to catch up. A 2023 preprint paper from researchers at Stanford, the University of Washington, and Trinity College found that patents for A.I. surveillance technology multiplied fivefold between the 1990s and the 2010s, and that there are now more than 23,000 patents for A.I. surveillance tools in the country. Despite this, critics say privacy laws are doing little to nothing to protect everyday people.

Lee Tien, a senior staff attorney at the digital rights organization Electronic Frontier Foundation, told me that laws like the DPPA weren't enacted with modern-day tech in mind. "It's an old law that is very, very hard to work with," he said. According to Tien, you can almost read the DPPA as two different laws—one that "tries to protect people but doesn't do a great job of it," or a law that's simply masquerading as a privacy law, but it's true intention is to create loopholes that allow the government and private companies to use private data, and make money off of it.

"There are a lot of exceptions in it. What we have seen over the years is that those exceptions get read very broadly," said Tien. For example, in a 2023 Wisconsin court decision on an insurance company that inadvertently allowed people to find strangers' license plate numbers, the judge writing the majority opinion stated, "Whether the Act applies at all is questionable. Its principal rule is directed to state ocials rather than private actors."

However, Scott Burnham, Illinois' deputy secretary of state, told me that the ABM parking lot is "clearly violating the DPPA under the federal law," as "states may only share personal information for limited purposes detailed in the DPPA, and a private entity using that personal data to collect on parking violations is definitely not one of them. "

Last fall, Burnham's office and the Illinois attorney general's office worked together to launch an investigation into ABM and its affiliates. They wanted to find out how the company obtained vehicle registration information, which connects license plate numbers to names and addresses. The Illinois DMV only provides vehicle registration information to a short list of approved companies in accordance with the DPPA, according to Burnham. ABM is not on the list.

Yet Tien says that ABM could emerge victorious from the lawsuit even if it's true that they're violating the DPPA. "It's not enough to prove that a company has violated the law," he explained. "The double sort of hurdle here is: not only does this violate the DPPA, but whether or not, say, a person was harmed enough in the first place to even get into court."

Essentially, a company like ABM can get away with violating the DPPA so long as the violation isn't severe enough to justify a lawsuit. This has happened before with the aforementioned 2023 Wisconsin decision that ruled in favor of an insurance company because the plaintiffs had not shown they suffered injury when their information was leaked.

ABM's lawyers have used this exact reasoning to try to have the case dismissed. In a memorandum arguing for dismissal, they don't outright deny violating the DPPA. Instead, they claim that the DPPA was only intended to prevent more serious stalking and violent crimes, since it was inspired by a stalking and murder case.

"Clearly, stalking, harassment, and murder are serious injuries that Congress admirably sought to limit through the DPPA. A request to pay for parking is not," ABM's lawyers write.

The Illinois Secretary of State's Office and the Illinois attorney general are both working to ensure that customer privacy no longer hinges on the strength of the DPPA. They are tightening their agreements with the companies that do have access to DMV data, so it's more difficult for them to quietly share it with companies like ABM.

Burnham is hoping to push for stronger national laws as well. "Congress needs to reform and update the DPPA law to reduce those loopholes and do a better job of safeguarding sensitive information," he said. "The DPPA passed in 1994, you know, the internet was in its infancy. But fast-forward to today, those conveniences and connections come with a price, meaning it puts our privacy and personal information at risk in a manner that would have been unthinkable three decades ago."

The fight to prevent private companies from using ALPR data to track vehicles has implications beyond parking fines. Landlords and homeowners associations have also begun using ALPRs to track who is coming and going in their buildings, which could lead to discrimination against tenants based on who they associate with, among other problems.

Also, by selling ALPR location data directly to law enforcement, private companies allow their customers to bypass the need for a search warrant. This could be especially threatening for people traveling through multiple states who face persecution from the law, like people who need abortions, or undocumented immigrants. (The Electronic Frontier Foundation and the American Civil Liberties Union have both expressed concern that state law enforcement could go after citizens who seek abortions in other states using similar techniques.)

Law enforcement agencies in jurisdictions all over the country collect ALPR data, too. While agencies like Immigration and Customs Enforcement typically need to issue warrants and get cooperation from multiple law enforcement agencies to track their suspects, they're able to circumvent this by contracting private companies to investigate the license plates, according to a report from the University of Washington.

For his part, Spencer never paid his parking fine. Unlike the plaintiffs in the lawsuit, collections never came after him. Reviews of ABM online suggest that the company was much more aggressive with some customers than others—highlighting the difference between these fines and real, state-issued parking tickets, which everyone has to either pay or argue in court. Now Spencer gets his movie fix at a different theater in downtown Chicago—a longer drive away from his home.