How License Plate Readers Also Track Your Phones

Mobile cameras aren't tracking your phone

Almost none of the ALPR cameras on US roads are tracking your phone. Flock Safety's own product page says its automatic license plate recognition system "does not identify drivers or passengers, use facial recognition, record conversations, track phones," and that it "captures vehicle-related data, including plate text, time, location, and vehicle attributes."^[1] What is new is a separate class of wireless sensor add-on, sold primarily under the name ELSAG SignalTrace by Leonardo, that bolts onto existing ALPR installations and sniffs the Bluetooth, Wi-Fi, and RF signals that phones, AirPods, smartwatches, and tire pressure sensors broadcast into the air.^[2]^[3] The distinction matters: if you are reading about a "camera that reads your phone," the camera is usually fine. The sensor next to it is the actual problem.

Two separate things on the same pole

A license plate reader is an optical system. It photographs a plate at speed, runs OCR on the letters and numbers, and writes a record like "ABC1234, northbound Highway 1, 2026-09-14 13:42:07Z, blue sedan" to a database. The camera itself only knows what it can see.

SignalTrace is a wireless sensing system. Leonardo's product page describes it as "a groundbreaking software system" that detects "consumer electronic devices that routinely travel together" so investigators can develop "investigative leads."^[4] The hardware, as documented in a teardown by the security researcher Ryan O'Horo, is "a set of two antennas connected to what's colloquially known as a Field Control Unit (FCU)".^[5] It is bolted next to an ELSAG ALPR camera and uploads its captures to Leonardo's Enterprise Operations Center (EOC), the same back-end that the cameras use.^[5]^[4]

The two devices share the pole, the back-end, and the timestamp on your car's plate hit. That is the whole trick. The camera gives the plate, the sensor gives the wireless devices it picks up as the car passes, and the database glues them together.

What the sensor is actually picking up

Phones and headphones do not need to be paired or connected to anything for this to work. Apple's AirPods broadcast Bluetooth signals while they are sitting in your pocket. So does every smartwatch, every Tile-branded tracker, every laptop with Bluetooth on, and every fitness tracker. The O'Horo teardown lists what the hardware claims to receive, drawing from Leonardo's own fact sheet:^[5]

Bluetooth at 2.4 GHz. Tablets, smartphones, laptops, smartwatches, fitness trackers, AirPods, and the Bluetooth side of pet collars. Leonardo's product description lists "fitness trackers, smartwatches, RFID tags and mobile phones" as the consumer categories.^[4]
Wi-Fi at 2.4 and 5.8 GHz. Tablets, smartphones, laptops, vehicle hotspots, dashcams, and backup cameras. A phone with Wi-Fi on but not connected is still probing for networks it remembers, and each probe is a fingerprint.^[5]
RFID at 915 MHz. Asset tags, toll transponders, and certain key fobs. The teardown says SignalTrace "could struggle to capture RFID tags past 75ft using typical commercial hardware within FCC power limits."^[5]
ISM bands at 315, 433, and 915 MHz. Tire pressure monitors, security sensors, key fobs, remote start.^[5]
Vehicle Bluetooth and Wi-Fi subsystems. Infotainment, Bluetooth tire pressure monitors, and the car's own hotspot.^[5]

Many devices broadcast a hardware identifier, the MAC address, unless the device randomizes it. When the same identifier shows up next to your plate at 13:42 on Tuesday, and again at 17:18 on Wednesday, the database has a pattern of life.

How the linking actually works

Leonardo's blog post for SignalTrace puts it this way. By "passively detecting publicly broadcast Bluetooth®, Wi-Fi, RFID, and other supported wireless signals," the system "helps organizations identify recurring patterns and relationships."^[2] The product description on the company's site says SignalTrace "creates an electronic signature for groups of the signals that the system determines are frequently emitted together," and that those signatures carry "date, time, location stamps, and pattern recognition."^[4]

O'Horo notes that Leonardo claims, in marketing and patent, that it can correlate license plates and various types of wireless devices, and that the marketing hedges by talking about devices that "regularly travel together".^[5] The system does not read your texts. It does not need to. It knows that device A and device B and device C always pass the same pole at the same minute, and it knows plate ABC1234 passed the same pole at the same minute, and it joins the dots.^[5]^[4]

This is also why the marketing slide that says "respects individuals' privacy rights" is technically not a lie. The exact line is that the system "does not decrypt or read content from devices."^[4] Correct. It does not have to. Your phone's MAC address, your AirPods' MAC address, your car's TPMS MAC, and your plate are enough on their own.

Where it is deployed, and what it costs

Public deployment is thin and documented in two Maryland counties. O'Horo, working from a 2023 invoice and Google StreetView history, identified "four installations in Oxon Hill, Maryland near National Harbor on Oxon Hill Road and National Harbor Blvd, operated by Prince George's County Police Department," plus another installation in Solomons and Dunkirk served by the Calvert County Sheriff's Department.^[5] One of the National Harbor installations is "co-located with Leonardo's ELSAG PlateHunter 900 ALPRs."^[5]

Pricing, from the same Calvert County invoice, came in three line items:^[5]

EOC Plus FCU (the field unit, with RFID hardware): $16,153.85.
EOC Plus FCU without RFID hardware: $6,446.15.
Annual license: $2,769.23.

O'Horo notes that this is "more than three times the annual cost of leasing a Flock Safety Falcon ALPR," which is part of why deployment is shallow today.^[5]

There is also a 2024 Forbes report that, when the product was still named "EOC Plus," a Leonardo spokesperson said it "currently has no paying customers" and the units were "not currently being used to surveil the public."^[5] By June 2026 the product carried the SignalTrace name, when 404 Media reported on its new marketing,^[3] and a July 29, 2026 Leonardo blog post describes the product as "the next evolution of Leonardo's electronic signature detection technology."^[2]

What the technology cannot do, and where it falls down

O'Horo's critique is worth quoting at length because he worked from the patent, a county invoice and StreetView images of real installations. On MAC randomization, his read is that data collection from Wi-Fi and Bluetooth devices is significantly hampered by modern device security, and that SignalTrace can likely only collect data from Wi-Fi, Bluetooth, and certain 915MHz RFID devices.^[5] On location precision, he argues that single antennas, even directional ones, cannot pinpoint a device to a specific location, that devices only periodically transmit identifying information (for Wi-Fi or Bluetooth, anywhere from tens of milliseconds up to a minute), and that cars moving at 50 mph travel roughly 50 feet in about 600 ms, which is in and out of the detection zone in less than a second.^[5] The patent's own range claim is 50 to 200 feet.^[5]

The same teardown lists several advertised capabilities that are not real. Pet microchips at 125/134.2 kHz are below the hardware's band, so "I just don't think Leonardo has brought this to reality for collection."^[5] Credit and transit cards on the 13.56 MHz NFC band are not covered either.^[5] The teardown's bottom line: "SignalTrace as a product does not impress me. Its marketing oversells its capabilities" and "it would not measurably increase their ability to track suspects or close cases when compared to using ALPRs alone."^[5]

None of this changes what the marketing video shows or what an invoice can buy. The capability that matters in practice is the link between a Bluetooth MAC, a Wi-Fi MAC, and a plate. That capability is real, sold, and installed.

What you can do on your phone today

MAC randomization is the single biggest lever, and both major platforms ship it on by default for Wi-Fi.

iPhone. Wi-Fi probing is randomized per network by default on iOS 14 and later under "Private Wi-Fi Address." Apple's own support page describes the feature as identifying "your iPhone, iPad, iPod touch, Mac, Apple Watch, or Apple Vision Pro... to each network using a different Wi-Fi address," and the page also notes that the feature "Requires iOS 14, iPadOS 14, visionOS, or later."^[6] To confirm it is enabled, open Settings, tap Wi-Fi, tap the info button next to a saved network, and confirm Private Wi-Fi Address is on.^[6] On iOS 18 and later, the same setting offers three choices (Off, Fixed, or Rotating), and Rotating "uses a private address that rotates to a different private address every 2 weeks."^[6]

Android. Android's own developer documentation states that "on devices that run Android 10 or higher, the system transmits randomized MAC addresses by default."^[7] That default applies to Wi-Fi. For Bluetooth, O'Horo notes that address randomization has not been applied uniformly, is hard to find outside newer laptops and phones, and that Bluetooth devices often reveal their model in the device name even when they randomize.^[5]

The two settings that close the largest gaps:

Turn Wi-Fi off when you are in a moving car. A phone with Wi-Fi off is not probing for remembered networks.
Turn Bluetooth off when you are not actively using an audio device or tracker. AirPods in your pocket, and your car's Bluetooth system, keep broadcasting even when you are not using them. The TPMS in your tires will still probe on its own ISM band, which is one of the harder ones to mute from the cabin.

For the tire pressure case specifically, O'Horo notes that TPMS sensors may transmit identifying information only every 30 seconds or more, and that a car at 50 mph is in and out of the detection zone in less than a second.^[5] There is no consumer setting that turns off a TPMS, because it is part of the car's safety system.

What an ALPR camera without SignalTrace actually does

If the camera in your town is a Flock Safety Falcon, it does not have a wireless sensor attached and it is not listening to your Bluetooth or Wi-Fi. Flock's product page is explicit: the system "does not identify drivers or passengers, use facial recognition, record conversations, track phones," and the data they capture is "vehicle-related data, including plate text, time, location, and vehicle attributes."^[1] FlockOS, the back-end, also auto-deletes plate reads after a customer-configurable retention window, with 7 days as the default.^[1]

SignalTrace is the wireless add-on with the clearest public footprint. If you want to know whether the camera on your street has one of these sensors on the same pole, the StreetView images in the O'Horo write-up are the best public reference for what the antennas look like.^[5]

The Bottom Line

Standard ALPR cameras like the Flock Safety Falcon read plates and vehicle attributes and explicitly do not listen to Bluetooth or Wi-Fi. The new capability is a separate wireless sensor bolted to the same pole. Leonardo sells one under the name SignalTrace; it sniffs the Bluetooth, Wi-Fi, and RFID signals that phones, AirPods, smartwatches, and tire pressure monitors broadcast, and links those device identifiers to the plate the camera reads at the same instant. It is sold, installed in at least two Maryland police departments as of 2023, and marketed under the SignalTrace name in 2026. MAC randomization on iPhone and Android is the largest countermeasure for the Wi-Fi side. Turning Wi-Fi and Bluetooth off in the car is the next-largest countermeasure. The TPMS in your tires cannot be muted, but it transmits only intermittently.