Can License Plate Readers Track Your Phone? What SignalTrace Adds to ALPR Cameras

What is SignalTrace, and who makes it?

SignalTrace is a system from Leonardo, the company behind the ELSAG line of automatic license plate readers used by US police departments. It sits alongside plate cameras and records the wireless signals nearby devices give off, then groups the signals that keep travelling together. Leonardo describes it as a way to identify groups of consumer electronic devices that routinely travel together, even when a license plate number is not known.

That last clause is the whole story. A plate read identifies a car. A signal read identifies a bundle of devices, and devices belong to people, not vehicles. Swap the car, keep the earbuds, and the trail continues.

What signals can it pick up?

Leonardo's own description covers everyday consumer electronics: fitness trackers, smartwatches, RFID tags and mobile phones, all of which emit signals into the air as a matter of normal operation. The 404 Media reporting and the follow-up coverage list a wider set of examples drawn from the company's material.

• -Phones, tablets and laptops broadcasting Bluetooth or Wi-Fi
• -Wearables such as smartwatches, fitness trackers and wireless headphones
• -RFID items including key cards, asset tags and pet microchips
• -Vehicle systems such as infotainment units, hotspots and tire-pressure sensors

Leonardo says the system captures signals but does not decrypt or read the contents of devices or their communications. That distinction matters legally and it is worth stating fairly: this is metadata collection, not message interception. Metadata about who travelled where, with whom, and how often is still enormously revealing.

Is this tracking me right now?

Probably not yet. As of July 2026 there is no public evidence that any police department has deployed SignalTrace. What exists is a marketed product and a sales pitch to law enforcement, reported from company documents. Treat it as the direction of travel rather than a thing already watching your commute.

The reason it matters is the installed base. There are already more than 100,000 plate cameras across the United States, covered in detail in what Flock cameras track and how to check your town. Bolting a sensor onto poles that already exist is a far shorter step than building a network from scratch.

Is it legal to collect Bluetooth identifiers from the roadside?

There is no clear answer yet, which is the concern. Existing state ALPR statutes were written about plate images, and the case law that lets police read plates in public leans on the argument that a plate is openly displayed. Commentators including Techdirt and the security researcher Bruce Schneier have noted that harvesting identifiers from devices people are carrying has no equivalent precedent behind it.

So this sits in a gap: not obviously prohibited, not obviously authorised, and not covered by the rules communities wrote when they debated plate cameras. If your town negotiated an ALPR contract, that contract almost certainly says nothing about Bluetooth.

Can you stop your devices broadcasting?

You can reduce what you leak, but not to zero. Modern phones rotate the identifiers they broadcast over Bluetooth and Wi-Fi precisely to defeat this kind of correlation. The weak links are the accessories and car systems around you, which vary widely and some of which broadcast a fixed identifier for their whole life.

1. 1.Turn Bluetooth and Wi-Fi off when you are not using them, rather than leaving both on all day
2. 2.Leave Wi-Fi private address or MAC randomisation enabled, which is the default on current iOS and Android
3. 3.Unpair and power down accessories you no longer use, especially old trackers and tags
4. 4.Treat tile-style item trackers as beacons: they are designed to be seen by other devices
5. 5.Ask your city council whether its ALPR contract permits sensors beyond plate capture, and what the retention period is

What this changes about your exposure

A device fingerprint on its own is a meaningless string. It becomes dangerous when someone can attach a name to it, and names come from the other half of your exposure: the accounts, breaches, and public records that already tie your identity together. That half is not held by a camera vendor. It is scattered across brokers, old logins, and leaked databases, and unlike a roadside sensor you can actually do something about it.

You cannot opt out of a sensor on a pole, but you can see and shrink what is publicly tied to your name. Clearfront scans your digital footprint in one sweep on your own machine, no cloud, and an AI security analyst reports which accounts, breaches, and records are exposed. Install Clearfront free and run it on yourself, or get the free removal guide to start clearing what turns up.