Maybe you’ve seen them attached to the trunks of police cruisers: cameras, mounted in twos or threes, pointed down at an odd angle as if at the feet of passersby. But they’re not checking out your shoes—when switched on, they’re reading the license plates of every vehicle, parked or moving, that the cruiser passes.

License-plate readers are an increasingly popular way for the police to find stolen cars and catch up with people with expired licenses or active warrants. And when they’re not piggybacking on police cruisers, plate readers are often affixed to utility poles or freeway overpasses, scanning the passing traffic below.

Police say the readers allow them to automate the important but cumbersome process of taking down license plates and checking them against law-enforcement databases. The website of a leading license-plate reader system claims its cameras can capture up to 1,800 license plates a minute during day or night, across four lanes of traffic and at speeds up to 150 miles per hour, alerting officers “within milliseconds” if a plate is suspect.

Those scans are stored in databases and can be searched by license plate number, turning up photos every sighting of a particular vehicle—including the time and location of each sighting. (The utility of such searches is limited by the number of times any one vehicle shows up in a dataset.)

But it’s not just police who use automatic license-plate reading technology. Cameras like these, which usually cost between 20 and 30 thousand dollars, are used to process fees on toll roads across the country, keep track of customers in parking lots and garages, and trawl city streets for cars whose owners are behind on payments and flag the vehicles for repossession.

The systems have proved useful to their public and private buyers, and the technology is proliferating. Recent statistics about their use are hard to come by, but a survey of police agencies conducted in 2011 showed that 71 percent of departments used license-plate readers, and that 85 percent of departments planned to increase their use over the next five years.

But police don’t have to do all the work themselves. A company called Vigilant Solutions claimed in a 2015 press release to maintain “the largest commercially gathered LPR dataset available to U.S. law enforcement.” That dataset allows police to access private license-plate scans, but does not allow law enforcement to share their data with companies.

In 2015, Vigilant said its dataset contained more than 3 billion scans, and was growing at a rate of more than 100 million scans a month. Since then, the dataset has grown dramatically: A Vigilant spokesperson said Friday that the dataset now includes 4.2 billion sightings, and is growing at a rate of 120 million data points a month.

As more vehicles and utility poles are outfitted with plate readers, and databases like Vigilant’s swell at increasing rates, some groups might feel the effects of the increased scrutiny more than others.

Data about the actual use of of license-plate readers is thin, but two examples stand out. In a 2014 investigation into automatic plate readers for The Boston Globe, Shawn Musgrave found at least ten repossession companies in Massachusetts that used license-plate readers to do their job. (Todd Hodnett, the director of government affairs for Vigilant Solutions, says he estimates about one in four repo companies nationally operate license-plate readers.)

And with 200 to 400-dollar bounties for locating cars that were stolen or are in default, some of those companies focused their search on the most lucrative neighborhoods. Two Massachusetts companies told Musgrave that they expressly targeted low-income housing developments, since it’s likely that a disproportionate number of residents in those areas are behind on auto payments, their cars ripe for repossession.

Police, too, have used license-plate readers heavily in low-income areas. The Electronic Frontier Foundation submitted a request in 2014 for information about the Oakland Police Department’s use of license-plate readers. When the advocacy organization analyzed the data it got back, it found that the readers were deployed disproportionately often in low-income areas and in neighborhoods with high concentrations of African-American and Latino residents.

The Oakland Police Department was not available to comment on its policies for using license-plate readers. This story will be updated with the department’s comments when it responds.

Unlike private companies, some police departments have limits on how long they can retain the data they capture from their license-plate readers. Those limits are important for protecting innocent drivers, because a large majority of plate scans draw a blank: According to a 2013 report from the American Civil Liberties Union, just 2,000 in every million license-plate scans in Maryland actually raise a red flag. And most of those hits have to do with registration issues or emissions violations—just 47 in a million are connected to a serious crime.

But data-retention limits for law enforcement vary widely, and in many cases they don’t exist. Hodnett says that police agencies that want to read Vigilant’s commercially-generated license-plate data set their own access policies and retention limits. If an agency is bound by law—or elects on its own—to access only the last two years of license-plate scans, for example, Vigilant will only serve up two years’ worth of commercial data. (Vigilant’s systems also allow law-enforcement agencies to store and access their own license-plate data, and share it with with sister agencies, if they want.)

Sharing platforms for license-plate data mean that police departments that can’t afford their own license-plate readers, or that don’t want to deploy them, can still access data gathered by others. Hodnett says many of Vigilant’s law-enforcement clients don’t operate readers themselves.

That means that even police departments that spread their use of license-plate readers evenly across income lines in the cities they serve—or those that don’t use them at all—can still benefit from the more idiosyncratic data-gathering of private organizations like repossession agencies, which may have an incentive to focus their time and efforts on low-income neighborhoods, and fewer restrictions against doing so.

Hodnett says the Vigilant platform is neutral, and doesn’t police the data it helps distribute for issues like income or race disparities. He also emphasized that the repossession business, where he himself used to work, hasn’t been materially changed by the introduction of license-plate readers. He says that the repo industry’s “spotter cars” do the same thing they used to do: checking up on vehicle owners’ last-known addresses. Now, they just have a more efficient way of scanning for other potentially repossessable cars along the way.

(Musgrave, on the other hand, reported that “spotter cars” are often sent to locations like commercial parking lots, looking for cars in default.)

While this public-private partnership has often helped police solve crimes and lenders repossess many vehicles, there’s a lack of consistent state laws to prevent local police from accessing billions of commercially-gathered license-plate scans, spanning back years. This can have a particularly harmful effect on low-income communities. “It always raises questions when you blend private companies with inherently public police functions,” said Jay Stanley, a senior policy analyst at ACLU. “At the end of the day, private companies are governed by a fiduciary responsibility to their shareholders, which is often incompatible with criminal justice.”