Backlash erupted this month after shoppers discovered Ulta Beauty using automated license plate cameras in its store parking lots. Emery | Reddy, PC is investigating whether Ulta’s Vallejo, California location is following the state law that governs this kind of surveillance, and preparing to file suit.
Ulta Beauty, the country’s largest beauty retailer with more than 1,500 stores nationwide, has confirmed it uses automated license plate reader (ALPR) technology from Flock Safety at some of its locations. According to reporting from Retail Dive published September 4, 2026, the cameras are installed in landlord-owned parking lots, and do not use facial recognition. Ulta’s director of organized retail crime has said the technology is meant to help identify repeat offenders and coordinate with law enforcement.
Emery | Reddy has heard from clients who shopped at the Ulta Beauty store at 147 Plaza Dr in Vallejo, California, and encountered this camera technology in the store’s parking lot. We are investigating whether this location is complying with California’s law governing private license plate readers, and we are preparing to file suit.
Ulta’s use of Flock cameras went viral this month after a shopper posted about discovering the technology in an Ulta parking lot, and the advocacy group UltraViolet launched a campaign calling on Ulta to cut ties with Flock. The story was picked up by Retail Dive, Yahoo News, and other national outlets, and it comes amid a broader wave of public scrutiny of Flock Safety, whose systems capture license plate scans by the billions each month. More than 50 local governments have reportedly canceled or paused their own Flock contracts over surveillance concerns, and Flock itself updated its terms and conditions in August in response to the criticism.
California regulates private ALPR use under Civil Code Sections 1798.90.51 through 1798.90.55. Any business that operates an ALPR system, including a retailer using cameras like Flock’s in its parking lot, must write a usage and privacy policy covering specific points, including:
That policy must be posted somewhere the public can actually find it, not buried behind several links or omitted entirely. A shopper does not have to prove their data was misused or shared to have a claim. Under the statute, a business that fails to meet these requirements can be liable for statutory damages.
Emery | Reddy is investigating whether the Ulta Beauty store at 147 Plaza Dr in Vallejo is operating its license plate camera in compliance with California’s ALPR Privacy Act, including whether a compliant usage and privacy policy has been written and posted where shoppers can find it. We are preparing to file suit against Ulta Beauty in connection with this location.
If you shopped at this Vallejo Ulta store and drove into its parking lot, your license plate may have been scanned and logged. You do not need to have noticed a camera or a policy, or the lack of one, to have a potential claim.
California businesses that operate license plate readers have a legal duty to write and publicly post a compliant privacy policy. If the Ulta store in Vallejo did not meet that duty, shoppers who visited the store may have a claim worth pursuing.
What is an automated license plate reader (ALPR)?
An ALPR is a camera system that reads a passing car’s license plate and turns it into searchable data. Flock Safety’s systems, which Ulta has confirmed using at some stores, also typically record the date, time, and location of each scan.
Does Ulta use these cameras at every store?
No. According to Retail Dive’s September 4, 2026 reporting, the cameras are installed at less than 1% of Ulta’s roughly 1,500 U.S. stores. Emery | Reddy has heard from clients that the Vallejo, California location at 147 Plaza Dr is one of them.
Do I have to prove my license plate data was misused to have a claim?
No. Under California’s ALPR Privacy Act, a business can be liable simply for failing to write and post a required usage and privacy policy. You do not have to prove the data was shared or misused.
How much can a violation be worth?
The statute sets a minimum of $2,500 in statutory damages per person, per violation. The exact value of a claim depends on the facts of each case.
Has a lawsuit been filed against Ulta yet?
Emery | Reddy is preparing to file suit against Ulta Beauty over its use of license plate cameras at the Vallejo, California store. This post will be updated once a complaint is filed.
Do I have a legal claim?
You may. California businesses that run license plate readers have a legal duty to write and publicly post a compliant privacy policy. If you shopped at the Ulta store in Vallejo, contact the Data Privacy Attorneys at Emery | Reddy at 916.995.5968 or www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.
Whether you’ve been injured on the job, subjected to mistreatment in the workplace, or affected by a privacy breach, our expert attorneys are here to help.
