San Francisco announces new ALPR policy with limited safeguards, no warrant requirement, 30‑day data transfer deadline

What happened

San Francisco released a policy that retains Automated License Plate Reader (ALPR) surveillance but provides only limited safeguards. The policy does not require a warrant to search stored ALPR data and sets a 30‑day deadline to move data from vendor servers to city servers, with no deletion deadline. Critics argue the measures are insufficient to protect privacy and prevent abuse.

Why it matters for trust and compliance

• Its status is announced. It is not law yet. Track it, but do not treat it as an obligation.
• The policy's weak safeguards raise significant privacy concerns over citywide location tracking.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Check that privacy notices describe the practices this addresses.
3. Confirm access, correction, deletion and opt-out requests are handled within the required time.
4. Revisit retention schedules and data minimisation for the data involved.
5. Identify affected vendors and update due-diligence and contract terms.