The group released a report, "You Are Being Tracked," based on information assembled through the Freedom of Information Act. The ACLU said affiliates in 38 states and Washington contributed to the report.
Police use license plate information to identify stolen cars or drivers with outstanding arrest warrants. But the ACLU said most of the drivers subjected to scanning are completely innocent.
The resulting data bases can be used to track individuals with everything from where they worship to how often they visit the doctor, who their friends are or how frequently they buy liquor.
"The government doesn't have a great track record of using this kind of information responsibly," the ACLU said. "As our report details, the data can be abused for official purposes, like spying on protesters merely because they are exercising their constitutionally protected right to petition the government, or unofficial ones, like tracking an ex-spouse."
While the Minnesota State Patrol deletes information after 48 hours, some departments, including the Delaware Department of Homeland Security and the state of New Jersey hold it for five years. A few police departments keep data indefinitely.
The ACLU said the retention time should be measured in days or weeks, rather than months and years.
Couple mistakenly served bag of cash at McDonald's drive-thru
Jordana Brewster on Paul Walker: 'He was an enormous presence in my life'