San Francisco to Tighten Access to License-Plate Reader Data, Critics Say Changes Don’t Go Far Enough

San Francisco will keep its automated license plate reader program in place but says it is tightening privacy rules after disclosures that outside agencies accessed the system. Civil-liberties groups say the changes do not address the core concerns: warrantless searches of stored data and how long the city keeps records of where cars have traveled.

Mayor Daniel Lurie’s office announced the changes Tuesday, according to local reporting by CBS Bay Area, the San Francisco Chronicle and Mission Local. Under the new approach, license plate reader data will remain accessible on vendor Flock Safety’s platform for 30 days after capture. After that, the city said, the data will be removed from the vendor platform and stored on city servers. The administration also said every search must be tied to a computer-aided dispatch number or incident number, with stricter documentation of each query.

The move follows months of scrutiny over how San Francisco police data was being searched by agencies outside the city. A mid-June compliance audit by the San Francisco Police Department found that the Northern California Regional Intelligence Center had allowed the Sacramento-based Western States Information Network to run about 299 searches of San Francisco’s Flock network over roughly a year on behalf of out-of-state and federal agencies.

After that disclosure, Police Chief Derrick Lew said SFPD had disabled access for the regional center and the network, known as NCRIC and WSIN, pending review.

The June audit came after earlier reporting by The San Francisco Standard, published Sept. 8, 2025, found that out-of-state agencies had run about 1.6 million searches of San Francisco’s Flock data between August 2024 and February 2025. Some of those searches were flagged as ICE-related, according to that reporting, helping trigger broader public scrutiny of the system.

A key unresolved issue is that the city’s new announcement does not match the surveillance policy San Francisco police still have posted publicly. That SFPD automated license plate reader policy says records are retained for 12 months from capture, with a five-year retention period if the data is tied to a criminal investigation. It also says the data may be hosted by the vendor and by the Northern California Regional Intelligence Center. By contrast, the mayor’s Sept. 29 announcement describes a 30-day vendor-access window followed by storage on city servers.

“San Franciscans expect us to keep them safe and protect their privacy. Today, we are putting tighter limits on the data collected by public safety cameras — strengthening the trust between law enforcement and communities that has been critical to our city's public safety progress,” Lurie told CBS Bay Area.

The mayor’s office also said it would work with Assemblymember Matt Haney, a San Francisco Democrat in the state Legislature, and San Francisco District Attorney Brooke Jenkins to seek stronger state penalties for misuse of the data. “It should be a crime to share sensitive information without a clear and lawful purpose. Period. It’s unacceptable and dangerous that it isn’t already. ... If you abuse that access, there should be criminal consequences, and you should be prosecuted,” Haney told CBS Bay Area.

Privacy advocates said the package focuses on internal controls without addressing whether police should need court approval to search historical location data. Nick Hidalgo of the ACLU of Northern California told CBS Bay Area that “the proposal for internal supervision would do little to stop law enforcement from running searches of our locations... Requiring anything less than a warrant is insufficient, both practically and legally.”

The Electronic Frontier Foundation, another digital-rights group, similarly criticized the changes, arguing that they do not require a warrant for searches of stored plate-reader data and do not set a firm deletion deadline. The group said moving data from Flock’s servers to city servers is not the same as deleting it.

Automated license plate readers capture plate numbers and create searchable records of where vehicles have been seen. California’s SB 34, a 2015 law governing the systems, sets privacy and security rules for operators and limits how ALPR information can be shared or transferred. State Justice Department guidance says “public agency” under the law does not include federal or out-of-state agencies.

For San Francisco, the immediate questions are how quickly officials will formally update the city’s written policy to match the mayor’s announcement, and whether the city will go further by limiting searches or shortening retention beyond the new 30-day vendor window.