The bill, introduced by Democrat Rebecca White, would allow drivers to add one of six emoji to their license plates. The pictographs would be in addition to whatever combination of letters and numbers the state’s Commissioner of Motor Vehicles assigns to a car or a driver picks for themselves. So you won’t have to worry about saying something like “thinking face, smiling face with heart-eyes and face with tears of joy” the next time you need to report a Vermont driver to police.

If the bill passes, Vermont would be the first state in the US to allow emoji on license plates — but not the first place in the world. According to NBC 5, that distinction goes to Queensland, Australia. As of last year, people in the country’s second-largest state have been able to add one of five emoji to their plates for about $336. Notably, Vermont hasn’t said how much it would charge for the plates, nor which six emoji drivers will be able to pick from. Just as importantly, it hasn’t decided if it will create its own take on the designs or use an existing repository. We would love to see the blob emoji make more of a comeback.

It costs just $20 to look up a license plate in the data base, and $70 to receive a “live alert” that flags when a plate shows up.

As you might have already suspected, this automatic data gathering creates many issues. For one, most of the vehicles in the database are of completely innocent people who have no way of knowing if they’re even included in the data set. And while a spokesperson for DRN said the company “takes data security seriously” and doesn’t allow access without its approval, there have been instances where unauthorized people have obtained that access. It’s feasible that users (approved and otherwise) could exploit this for stalking or gaining the upper hand in court without revealing sources.

Law enforcement can also use the system, and DRN’s sibling brand Vigilant Solutions sells the tech to government agencies. That raises the potential of rogue officers using the plate tracking to intimidate protesters or witnesses of police abuses.

It may be difficult to challenge the practice. DRN has argued that it’s taking photos of license plates in public spaces, where there allegedly isn’t an expectation of privacy. As a private organization, DRN also isn’t obligated to respond to requests for information or accept external oversight. Much like with facial recognition, you’ll just have to hope that companies either mend their ways or limit the potential for abuse — at least, for now.

A representative didn’t tell TechCrunch how much data had been taken, or how many American citizens were caught up in the breach. The agency said alerted Congress and said it was “closely monitoring” the subcontractor’s associated work.

CBP said that none of the info had been spotted on either the dark web or the public internet, although the company in question might have had at least one leak. Officials inadvertently mentioned the border crossing tech company Perceptics in their document title, and a Register report in late May indicated that data from the firm was available for free on the dark web. It’s not certain if that info is associated with the CBP’s breach.

The incident underscores a common problem with database security: it’s only as safe as the weakest link in the chain. If a contractor leaves data vulnerable, it doesn’t matter how airtight the government’s own practices are. And that raises concerns about plans for facial recognition at airports. Officials have vowed to limit access to image data, but it could only take a momentary lapse in security to compromise a vast library of sensitive images.