EFF called San Francisco’s new ALPR policy “woefully inadequate” on September 29, 2026 — the strongest structural critique from any civil-society organization responding to a US city’s surveillance policy this year. [1]

Rindala Alajaji, Adam Schwartz, and Sarah Hamid published the critique the same day Mayor Daniel Lurie announced his 30-day policy. EFF’s argument is structural, not political — and a Mexican, Brazilian, or Argentine procurement officer can now lift it verbatim into their next enterprise CCTV/ALPR contract. [1]

Defect #1 — No warrant requirement. An incident or CAD number is not judicial authorization. [1] Without a court order, an officer can search stored location data without showing probable cause to a judge — and will. [1] Lurie’s new plan only requires that every search be tied to a CAD or incident number, not to a judicial warrant. [2]

Defect #2 — No deletion-not-move. Lurie’s plan reduces retention from 12 months to 30 days, but those 30 days are to move the data from the vendor’s servers to the city’s servers, not to delete it. [1] Moving data is not deleting it. EFF’s explicit benchmark: “New Hampshire requires deletion in three minutes, and Flock itself has reduced the default retention time to seven days.” [1]

Defect #3 — No audit-prevention. Better audit logs “expose abuse only after a search has occurred.” [1] They cannot undo the disclosure of someone’s movements, nor justify collecting everyone’s location in the first place. [1]

The numbers Lurie’s plan is built on: more than 1.6 million improper accesses by federal and out-of-state agencies to San Francisco’s Flock database, per the SFPD internal audit published by Mission Local in June 2026. [5] More than 400 ALPR cameras in SF, all contracted through Flock Safety. [3] More than 300 California law enforcement agencies run ALPR systems from Flock and other manufacturers. [4]

On Tuesday, September 29, Mayor Lurie announced the new policy with CAD-number search requirement + 30-day move-off + monthly audits. [2] Assemblymember Matt Haney said that day: “It should be a crime to share sensitive information without a clear and lawful purpose.” [2] Haney and District Attorney Brooke Jenkins are preparing a California state bill for December to criminalize misuse. [3]

EFF + ACLU have now published a three-point structural checklist that any LATAM ALPR RFP can copy into contract language: (a) warrant requirement (or equivalent judicial authorization) to access stored location data; (b) deletion-not-move clause with a maximum retention of seven days (Flock’s own default), or three minutes as in New Hampshire for data without an active investigation link; (c) audit-prevention architecture that prevents abuse instead of only documenting it after the fact. [1]

Every time I review an enterprise CCTV/ALPR RFP for tv4agent, the question is no longer whether your vendor has ALPR. [3] It is whether your contract demands the three structural clauses EFF just demanded in writing from a mayor’s office. [1] Moving data from one server to another is not protection; EFF was explicit: “city officials must understand that moving data is not deleting it.” [1] Automatic deletion by default, judicial authorization to access, and architectural prevention of abuse — that is what a private enterprise RFP now needs to require, before the next LATAM abuse case lands on the front page.

P.D. Does your current RFP demand the three EFF clauses (warrant, deletion-not-move, audit-prevention) in writing — or does it just reference “compliance with applicable law” the way most do? That line separates a contract that documents incidents from one that prevents them architecturally.

📰 Sources verified in grounded-citations: EFF Deeplinks Sep 29 [1]; sf.gov Sep 29 [2]; Mission Local Sep 29 [3]. Additional quantitative data: CBS SF Sep 29 [4]; Mission Local audit Jun 2026 [5].

Sources

[1] EFF Deeplinks — “While the Country Rejects ALPR Mass Surveillance, SF Settles for Weak Safeguards” (Alajaji, Schwartz, Hamid). https://www.eff.org/deeplinks/2026/09/while-country-rejects-alpr-mass-surveillance-sf-settles-weak-safeguards [2] SF.gov — Mayor Daniel Lurie Unveils Strong Privacy Protections for Public Safety Cameras. https://www.sf.gov/news-mayor-daniel-lurie-unveils-strong-privacy-protections-for-public-safety-cameras-building-on-work-to-drive-down-crime-in-san-francisco [3] Mission Local — SFPD will now have to delete Flock data after 30 days. https://missionlocal.org/2026/09/san-francisco-flock-cameras-daniel-lurie-guidelines/ [4] CBS News SF — San Francisco tightens rules on ALPR cameras. https://www.cbsnews.com/sanfrancisco/news/san-francisco-alpr-flock-cameras-automated-license-plate-reader-privacy/ [5] Mission Local — Federal agencies accessed SF Flock data improperly (Jun 2026). https://missionlocal.org/2026/06/federal-agencies-sf-surveillance-flock-data-audit/