US cities tighten rules on license-plate reader surveillance amid privacy concerns

The maker of automated license-plate readers (ALPR) has revised its policies to limit data retention to seven days by default and to disable data sharing unless customers opt in. The changes also require audit logs for all searches and allow agencies to set their own retention periods within legal limits. The company said it does not sell customer data or use it for advertising.

Utah Governor Spencer Cox said he is "deeply concerned" about instances of law-enforcement misuse of ALPR technology and noted that state law caps footage retention at nine months, restricts officer access, and bars use for civil immigration enforcement. He directed the state Privacy Commission to review camera rules after a study found that 10 cameras in a single county were queried 5.1 million times by agencies in 45 states.

Proponents of the technology pointed to recent law-enforcement successes, such as the disruption of an alleged ISIS-inspired plot at the New York state Capitol, which a U.S. attorney said would have been harder to detect without ALPR cameras.

Since the policy shift, the company has lost several municipal contracts, and some cities are considering alternative vendors. Founder Garrett Langley emphasized that the new safeguards aim to balance "safety and privacy" and called for industry-wide standards.

"The privacy changes, the security changes, the accountability systems, come down to one idea: Tools this powerful must come with guardrails this strong," Langley said.

Critics remain wary, noting past reports of officers using ALPR data for personal purposes and questioning whether the revised policies are sufficient to prevent abuse.