Does it then proceed to track each license plate and their movements once outside the parking lot, keeping a note of every single place where the license plate goes and parks in order to build a profile on that license plate so that you can sell that info off and shove ads down their throats?
That’s not how most people use cookies, just google & co. I’m using an in-house analytics app platform that uses cookies to track how often visitors use the app but we do no tracking at all outside of our website, we just want to know how often people use our site
Only for the purpose of tracking how much time each vehicle was parked so you can charge them for that time. Absolutely nothing else. You should also be legally required to delete that information immediately after the transaction is done.
You're more likely going to be required to keep that information for a period of time for audit purposes, or to be able to justify a credit card charge in case there is a claim of fraud, etc.
Cool, as long as you’re not tracking them everywhere else out in the world, shouldn’t be an issue.
I could easily build you a system that has no dependency on license plates.
For most of my life, it's been done with tickets you buy at a booth and put in your dash, then you use the ticket to exit
I think this is an actual example of 'legitimate interest' under GDPR (unlike most of the websites that claim it). There would still be an expectation that you didn't use that data for anything else and got rid of it as soon as it was no longer needed.
Arguing 'legitimate interest' in front of a non-tech judge in one of the many EU countries where a local agency implements GDPR would be... not fun.
I bet that kind of use of license plates is older than any judge still alive. The hard part is convincing the judge that you can't implement it without sharing the data with two dozen web services.
Do you retain the license plate information after they exit the business?
You don’t need consent for that under any data regulation I know of. So long as you don’t keep it any longer than you need to, don’t sell the info or use it to target people with ads etc then you are fine. What you are referring to here isn’t a problem.