Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
JoinJoin
REGULATORY WATCH BRIEF Low 36 🧭 Regulatory Guidance announced

San Francisco announces new ALPR policy with limited safeguards, no warrant requirement, 30‑day data transfer deadline

The policy's weak safeguards raise significant privacy concerns over citywide location tracking.

ADTP Regulatory Watch · September 29, 2026 · San Francisco Police Department
ImpactLow 36
Type🧭 Regulatory Guidance
Statusannounced not law
JurisdictionUS-CA

What happened

San Francisco released a policy that retains Automated License Plate Reader (ALPR) surveillance but provides only limited safeguards. The policy does not require a warrant to search stored ALPR data and sets a 30‑day deadline to move data from vendor servers to city servers, with no deletion deadline. Critics argue the measures are insufficient to protect privacy and prevent abuse.

Why it matters for trust and compliance

  • Its status is announced. It is not law yet. Track it, but do not treat it as an obligation.
  • The policy's weak safeguards raise significant privacy concerns over citywide location tracking.

Who is affected

government technology controller processor Flock Safety Motorola Axon Immigration and Customs Enforcement (ICE)

Recommended actions

  1. Review consent, cookie and tracking practices against the requirement.
  2. Check that privacy notices describe the practices this addresses.
  3. Confirm access, correction, deletion and opt-out requests are handled within the required time.
  4. Revisit retention schedules and data minimisation for the data involved.
  5. Identify affected vendors and update due-diligence and contract terms.