Mayor Daniel Lurie’s office on Tuesday announced a slew of new privacy policies to tighten police access to Flock surveillance cameras, and said the mayor would work with state lawmakers to pass a bill cracking down on officers who improperly use or share data from the cameras.
The city-wide changes will shorten the length of time that police can hold Flock data from one year to 30 days, require that police officers list which investigation is linked to their search of a surveillance database and establish more regular audits.
Lurie’s new policies will apply to the over 400 automated license plate readers throughout the city, all of which are currently contracted through the technology company Flock Safety.
Flock cameras, which are designed to scan license plates and track cars for officers, have been the subject of national controversy. The Atlanta-based tech company was recently the subject of a critical Senate hearing, and has been denounced for how officers use it to collaborate with Immigration and Customs Enforcement.
The Washington Post and others have also reported that police officers have used the cameras to stalk former partners. In San Francisco, out-of-state agencies, including federal agencies, have improperly accessed Flock’s database of footage more than 1.6 million times, and the system has been criticized for poor data security.
San Francisco politicians have debated how to approach the cameras: supporters say it helps reduce crime, while critics say they can be misused. Earlier this year, SFPD investigated an officer who inappropriately used Flock to search for his wife’s stolen car.
The San Francisco Democratic Party voted last week to reaffirm its support for existing guidelines. The policies put forward Tuesday will change several of those, and will “protect people’s privacy while keeping San Franciscans and visitors safe,” Lurie’s office wrote.
The first change will bring San Francisco largely in-line with nearby cities by requiring the San Francisco Police Department to delete data from its Flock portal 30 days after it is captured.
This is already the case in Oakland and San Jose, but until now, San Francisco police have retained all footage for up to 12 months. Flock Safety recommends that police departments only hold ALPR data for seven days.
Under the new policy, if an officer believes footage should be held longer than 30 days, the officer must demonstrate the footage is needed for an active investigation and get a supervisor’s sign-off.
In another change, all Flock searches must now include an incident report. Without one, officers cannot access data associated with the surveilled vehicle.
The final change will require SFPD to review its Flock logs every month while requesting that the Department of Police Accountability do annual audits.
The new policies come the day after the San Francisco Human Rights Commission released a report in response to the 1.6 million improper Flock searches made public in 2025. The commission found that SFPD had not violated sanctuary city laws, but recommended several new guardrails for police.
Several, including the wiping of license plate data after 30 days and clear reasoning for searches, are addressed in the new policies. Others are not.
It is unclear when the changes announced Tuesday will be rolled out.
The mayor’s office also announced it is working with Assemblymember Matt Haney and District Attorney Brooke Jenkins to put forward legislation to punish people who improperly use or share license plate data.
The move comes three weeks after news that an off-duty San Jose police officer used Flock to track a woman who had accused his cousin of domestic abuse, and then shared the data with the accused. San Jose officials then issued a disappointing update: There is no state law penalizing officers who improperly share such data.
The proposed state law, which was initiated by Jenkins, will ensure that punishment for “misuse of data” is “consistent with how we already protect other confidential law-enforcement information,” the DA’s office wrote. “San Francisco needs to catch up with the technology.
“It should be a crime to share sensitive information without a clear and lawful purpose,” said Haney. “It’s unacceptable and dangerous that it isn’t already.”
The law could be introduced in December at the earliest, and potentially passed next year.
“These new measures will improve public trust and accountability as we continue to use technology to reduce crime across the city,” wrote SFPD chief Derrick Lew. “If anyone commits violations with our technology, we will have stronger policies and laws to hold them accountable.”
Lurie and other city officials will release more information about the changing policies at a press conference at 10 a.m. Tuesday.
