San Francisco tightens rules on automated license plate reader cameras, use of private data

San Francisco on Tuesday unveiled new privacy protections for automated license plate reader cameras, limiting access to data and requiring strict documentation for data searches, Mayor Daniel Lurie's office announced.

Under the new policy, the San Francisco Police Department can access license plate reader data for 30 days after the data is captured, down from 12 months. After 30 days, the data will be removed from the vendor Flock Safety's platform, giving police exclusive control of the data and preventing external access, the mayor's office said.  

The policy also requires that every data search must be tied to a computer-aided dispatch or incident number. 

The new policy on Flock cameras comes months after the San Francisco Police Department disclosed that an internal audit of its ALPR camera network showed it was improperly accessed by outside agencies over the past year. 

Police said an audit of its automated license plate reader camera network shows it was improperly accessed by out-of-state and federal agencies. State law prohibits law enforcement agencies from sharing ALPR data with out-of-state or federal agencies without a court order or warrant from a California court. 

Mayor Daniel Lurie said in a press release that as the new policy goes into effect, he would partner with Assemblymember Matt Haney (D-San Francisco) and District Attorney Brooke Jenkins in seeking stiffer penalties under state law for the misuse of public safety data.

"San Franciscans expect us to keep them safe and protect their privacy. Today, we are putting tighter limits on the data collected by public safety cameras—strengthening the trust between law enforcement and communities that has been critical to our city's public safety progress," Lurie said in a prepared statement. "This technology helps us keep workers, small business owners, and families safe, because we will not go back to a time when people could break into cars, rob businesses, or commit serious crime without consequences."

The SFPD says its ALPR network has led to a historic drop in both violent and property crime since 2024 amid staffing shortages. More than 300 California law enforcement agencies use ALPR systems from Flock Safety and other manufacturers.

Critics have argued that much of the data collected is from people who are not suspected of any wrongdoing, amounting to unwarranted surveillance of lawful activities. Civil liberties groups argue that people may avoid attending protests, participating in political activities, or seeking reproductive health services if they think their movements are being tracked.

A spokesperson for the ACLU of Northern California said Lurie's policy changes "will not meaningfully improve driver privacy."

"The proposal for internal supervision would do little to stop law enforcement from running searches of our locations," said Nick Hidalgo, ACLU of Northern California senior staff attorney in an email to CBS News Bay Area. "As we've seen around the country, internal agency oversight is insufficient. We've seen police officers fail to include case numbers or offering nonsense like "LMAO," "IDK," or even "lalala" as justifications for running license plate searches, while their supervisors do nothing to stop them."

Hidalgo added that California's constitution requires that law enforcement obtain a warrant prior to violating reasonable expectations of privacy with a search. 

"Requiring anything less than a warrant is insufficient, both practically and legally," Hidalgo said.  

Other civil rights groups have sued the City of San Jose, arguing it violated California law limiting how police use and share license plate data, as well as infringing on constitutional privacy rights.  

In April, a San Jose police officer was fired after he had searched the department's ALPR system for a domestic violence victim's vehicle and shared its location with the suspect, who is the officer's relative. Multiple law enforcement agencies in California have tightened ALPR rules, paused their use or shut down their ALPR systems over concerns about warrantless data collection, data retention, and the sharing of data with other entities.

"It should be a crime to share sensitive information without a clear and lawful purpose. Period. It's unacceptable and dangerous that it isn't already," Haney said in a prepared statement. "If you're a public safety officer with access to sensitive information about where people go and when they go there, that access comes with an enormous responsibility and a very limited purpose. You don't get to use that information to track someone for personal reasons, share it with a friend or family member, or use it for anything unrelated to your job. If you abuse that access, there should be criminal consequences, and you should be prosecuted."

There have also been multiple cases of ALPR errors leading to wrongful police stops or instances of the technology being abused, according to a recent CBS News investigation.

The SFPD already prohibits the use of license plate readers for civil immigration enforcement, for investigating people seeking reproductive or gender-affirming health care, or for monitoring activity protected by the First Amendment.