Data retention laws by state
AI Laws USA tracks 43 U.S. AI rules on data retention across federal, state, county, and city government. Each entry links to its official source.
Federal data retention rules (4)
-
In effect
COPPA + 2025 Rule (childrens data)
United States · Effective June 23, 2025 · 15 U.S.C. §§ 6501–6506; 16 C.F.R. Part 312
COPPA requires online services aimed at children under 13 to get verifiable parental consent before collecting kids' personal data. The 2025 rule update — fully in effect since April 22, 2026 — adds biometric identifiers (like face templates and voiceprints, which matter for AI tools), requires separate parental consent before sharing children's data for targeted advertising, and tightens data retention limits.
-
In effect
FTC HBNR Rule (AI health apps)
United States · Effective July 29, 2024 · 16 C.F.R. Part 318; 89 Fed. Reg. 47028
Health apps and connected devices — including AI-powered mental health and fitness tools — must notify users, the FTC, and (in some cases) the media within 60 days of a breach of identifiable health information. The 2024 amendments confirm that AI-generated inferences about health are covered.
-
Proposed / pending
Stop Flock Abuse Act (Hawley, 2026)
United States · Stop Flock Abuse Act (Sen. Hawley, announced Sept. 30, 2026; bill number pending)
Sen. Josh Hawley announced a federal bill, the Stop Flock Abuse Act, to set safeguards for AI-powered cameras such as Flock automated license plate readers (ALPRs). It would bar local governments from selling or sharing vehicle location data with non-government third parties, require a written approval and audit log for every search, require deletion of driver data after ten days except for active criminal investigations, require encryption and keep data inside the United States, ban hardware or software from foreign adversaries, and prohibit ALPR networks from using facial recognition. It follows a Senate Judiciary subcommittee hearing on Flock that Hawley chaired.
-
Blocked / in litigation
Krupke v. Walmart BIPA voiceprint class action (2026)
United States · Krupke v. Walmart Inc., No. 1:26-cv-09305 (N.D. Ill. filed Aug. 6, 2026) (Pacold, J.)
Carol J. Krupke and Jeanne Thomas filed a class action against Walmart in the U.S. District Court for the Northern District of Illinois on August 6, 2026, under the Illinois Biometric Information Privacy Act. The case is No. 1:26-cv-09305, before Judge Martha M. Pacold. The allegation is that when Walmart records customer service calls it extracts vocal characteristics and builds mathematical templates — creating, in the plaintiffs' words, 'a voice print or biometric identifier which can be used to identify them in the future' — and that it analyzes speech patterns for EMOTIONAL TRACKING, all without the written consent BIPA requires. The consent point is the heart of it. Walmart's automated message tells callers that calls 'may be recorded for business purposes, including fraud prevention.' The plaintiffs say that disclosure does not mention voiceprint creation at all, nor retention periods, nor sharing with third parties — so a caller who hears it and stays on the line has not consented to anything like what is alleged to happen. This matters beyond Walmart because almost every large company records customer service calls and many now run AI analysis over them. If a routine recording disclosure is insufficient consent for biometric voiceprint extraction under BIPA, a very large number of existing call-center practices are exposed. The plaintiffs seek class certification, an injunction requiring BIPA compliance, destruction or return of improperly retained information, attorneys' fees, and BIPA's statutory damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation. The proposed class is described as hundreds of people with more than $5 million in controversy. No ruling has issued.
State data retention rules (23)
-
In effect
Connecticut PA 26-14 ALPR limits and 21-day retention (2026)
Connecticut · Effective October 1, 2026 · Conn. Public Act 26-14 (2026), Sec. 13-15 (ALPR); Sec. 1 (civil action for deprivation of constitutional rights)
Connecticut's Public Act 26-14, signed May 4, 2026, puts the state's first detailed limits on automated license plate readers. From October 1, 2026, public agencies and their vendors may run plate readers only for listed purposes (for police: checking plates against hotlists and crime databases, or searching for a plate tied to a specific criminal investigation, warrant, missing person or stolen car, with a logged reason). Plate data must be deleted after 21 days unless held under a warrant or as evidence. Police may not use plate data to enforce immigration law, to investigate people who seek or provide abortion or gender-affirming care that is legal in Connecticut, or to target people for First Amendment activity, and may share data out of state only with New York, Rhode Island and Massachusetts agencies that sign a written promise to follow those rules. Vendor contracts must bar selling or freely sharing the data. The Attorney General can sue vendors (up to $2,500 per violation) and residents can sue agencies for injunctive relief. The same act also creates a state-law civil rights claim against federal or state officers who violate constitutional rights.
-
In effect
Florida FDOT statewide ALPR permit revocation (2026)
Florida · Effective August 31, 2026 · Florida Department of Transportation — statewide revocation of ALPR right-of-way permits (issued August 31, 2026; 30-day removal deadline)
On August 31, 2026 the Florida Department of Transportation revoked every active permit for an automated license plate reader on a state highway right-of-way, and gave agencies thirty days — until roughly September 30, 2026 — to physically remove the hardware. This covers Flock Safety cameras and any other ALPR installed on state roads. The FDOT memo gives the reasons plainly: an exponential increase in deployments, together with concerning reports of misuse, data privacy concerns and surveillance schemes. The misuse is not hypothetical. In the Tampa Bay area at least two police officers, one in Haines City and one in Sarasota, were fired and arrested for allegedly using the cameras to stalk romantic interests. Governor Ron DeSantis had already called the technology and its misuse by police out of control and said legislative action was needed to protect Floridians' privacy. What makes this measure powerful is the mechanism rather than the rhetoric: Florida did not pass a law restricting how police may use license plate data. It used its property rights as the owner of the state highway right-of-way to revoke the permits that let the cameras be there at all. A city that wants to keep its ALPR program has to find somewhere other than a state road to put it. Gainesville turned all of its cameras off on September 3, 2026.
-
In effect
Oregon SB 1516 — ALPR limits and vendor liability (2026)
Oregon · Effective March 31, 2026 · Or. Laws 2026, ch. 77 (SB 1516), §§ 3-9
Oregon's SB 1516, signed March 31, 2026 and effective at once, limits how police can use automated license plate reader (ALPR) cameras. Police may use them only for listed purposes, such as finding vehicles linked to crimes, arrest warrants or missing people, uninsured or unregistered vehicles, parking or controlling secured areas. Plate data must be deleted after 30 days unless it relates to a criminal investigation or court case. ALPR vendors may not access, sell or share the data, and a person whose data a vendor misuses on purpose or through gross negligence can sue for damages. Lawmakers have said they may push for a full ban on Flock-style cameras in 2027.
-
In effect
CCPA/CPRA + ADMT Regulations
California · Effective January 1, 2026 · Cal. Civ. Code § 1798.100 et seq.; Cal. Code Regs. tit. 11, div. 6
California's main privacy law gives consumers rights to know, delete, correct, and opt out of the sale or sharing of their personal information. New regulations finalized in 2025 add rights around automated decision-making technology (ADMT): businesses using ADMT for significant decisions (jobs, housing, credit, healthcare) must give pre-use notice, let people opt out, and provide access to how decisions were made.
-
In effect
BIPA
Illinois · Effective October 3, 2008 · 740 ILCS 14/1 et seq.
The strongest US biometric privacy law: companies must get written consent before collecting fingerprints, face scans, voiceprints, or other biometrics, publish retention/destruction policies, and cannot sell biometric data. Individuals can sue directly and recover $1,000–$5,000 per violation, which has produced major settlements against facial recognition and AI companies.
-
In effect
Rhode Island ALPR installation pause and 60-day review (2026)
Rhode Island · Effective August 18, 2026 · Rhode Island — Governor's order pausing new ALPR installation and commissioning a 60-day statewide review (issued August 18, 2026)
Governor Dan McKee ordered a statewide pause on installing or activating any new automated license plate reader cameras on August 18, 2026, together with a sixty-day review to establish uniform standards governing the technology and the data it collects. The order binds the Rhode Island State Police directly: they may keep using the cameras they already have, but they may not install or activate any new ones. For cities and towns the order is a request rather than a command — McKee urged them to follow suit, which is the limit of what a governor can do to independent municipal police departments. He directed State Police Colonel Darnel Weaver to run the review in consultation with the Rhode Island Police Chiefs' Association, the Rhode Island League of Cities and Towns and other stakeholders. The stated endpoint is legislation: McKee said that when the review is done he will work with lawmakers on a bill codifying the protections and establishing clear, consistent statewide standards for ALPR use. The order came as municipalities across Rhode Island were already resisting Flock cameras on their own, and it is one of four state-level actions in August 2026 — with Florida, Texas and Connecticut — that marked a national turn against license plate surveillance.
-
In effect
Kentucky HB 58 ALPR limits and 90-day retention (2026)
Kentucky · Effective July 15, 2026 · 2026 Ky. Acts Ch. 71 (HB 58)
Kentucky's new license plate reader law limits who can use plate-reader cameras and for what, restricts selling the data, and generally requires deleting captured plate data after 90 days unless it is needed for an investigation or a preservation request. Police agencies must adopt written policies and publish where their cameras are.
-
In effect
Kentucky Consumer Data Protection Act
Kentucky · Effective January 1, 2026 · 2024 Ky. Acts (HB 15); KRS ch. 367
Kentucky's privacy law took effect January 1, 2026, giving residents rights to access, correct, delete, and copy their personal data, and to opt out of data sales and targeted advertising. Businesses need opt-in consent for sensitive data including biometrics.
-
In effect
RI Privacy Law (RIDTPPA)
Rhode Island · Effective January 1, 2026 · R.I. Gen. Laws § 6-48.1 (2024)
Rhode Island residents can access, correct, delete, and port their data, and opt out of targeted advertising, data sales, and profiling. The Attorney General enforces with fines up to $10,000 per violation and — unusually — no cure period.
-
In effect
Indiana Consumer Data Protection Act
Indiana · Effective January 1, 2026 · 2023 Ind. Acts P.L. 94-2023 (SB 5); I.C. 24-15-1 et seq.
Indiana's privacy law, effective January 1, 2026, gives residents rights to access, correct, delete, and port personal data, and to opt out of targeted advertising, data sales, and profiling. Enforced exclusively by the Attorney General with a permanent 30-day cure period.
-
In effect
Montana MCDPA
Montana · Effective October 1, 2025 · Mont. Code Ann. §§ 30-14-2901 et seq. (SB 384, 2023; as amended by SB 297, 2025, eff. Oct. 1, 2025)
Montana's comprehensive consumer privacy law, strengthened by 2025 amendments, gives residents rights to access, correct, delete, and opt out of data processing. The SB 297 amendment removed the 'solely automated' qualifier for profiling opt-out, meaning consumers can now opt out of any automated decision-making that involves profiling with significant effects — not just fully automated decisions.
-
In effect
Maryland Online Data Privacy Act
Maryland · Effective October 1, 2025 · 2024 Md. Laws ch. 440 (SB 541); Md. Code Ann., Com. Law §§ 14-4601–14-4626
Maryland's privacy law is stricter than most: it prohibits processing sensitive personal data unless strictly necessary for the requested service. Consumers can access, correct, delete, and port their data, and opt out of automated profiling and targeted advertising. AG enforcement began April 2026.
-
In effect
Minnesota Consumer Data Privacy Act
Minnesota · Effective July 31, 2025 · 2024 Minn. Laws ch. 123 (HF 4757); Minn. Stat. §§ 325M.01–.21
Minnesota's privacy law gives residents data rights plus something unique: the right to question automated profiling decisions with significant effects — including the right to know why the decision was made and what would change the outcome. Full AG enforcement began February 2026.
-
In effect
New Jersey Data Protection Act
New Jersey · Effective January 15, 2025 · P.L.2024, c.9 (N.J. SB 332)
New Jersey's comprehensive privacy law grants residents rights to access, correct, delete, and port personal data and to opt out of data sales and targeted advertising. Controllers must get opt-in consent for sensitive data (health, biometric, precise location) and honor universal opt-out signals since July 2025.
-
In effect
Iowa Consumer Data Protection Act
Iowa · Effective January 1, 2025 · Iowa SF 262 (2023), Iowa Code ch. 715D
Iowa's privacy law gives consumers rights to access, delete, copy, and opt out of the sale of their personal data and targeted advertising. Notably it does NOT include a profiling opt-out, making it one of the more business-friendly state privacy laws.
-
In effect
Nebraska NDPA
Nebraska · Effective January 1, 2025 · Neb. Rev. Stat. §§ 87-901 et seq. (LB 1074, 108th Leg., 2024), eff. Jan. 1, 2025
Nebraska's comprehensive consumer privacy law gives residents the right to access, correct, delete, and port their personal data and to opt out of targeted advertising, data sales, and automated profiling used in decisions with significant legal or financial effects. The Attorney General enforces with fines up to $7,500 per violation with no private right of action.
-
In effect
NH Consumer Privacy Act
New Hampshire · Effective January 1, 2025 · RSA 507-H (2024 NH SB 255)
New Hampshire residents can access, correct, delete, and port their personal data, and opt out of targeted advertising, data sales, and profiling used in solely automated decisions. Applies at low thresholds (35,000 residents), so it covers many businesses.
-
In effect
Delaware Privacy Law (DPDPA)
Delaware · Effective January 1, 2025 · 6 Del. C. § 12D-101 et seq. (2023 DE HB 154)
Delaware residents can access, correct, delete, and port their personal data, and opt out of targeted advertising, data sales, and profiling used in solely automated decisions with legal effects. Applies at low thresholds (35,000 consumers).
-
In effect
TDPSA
Texas · Effective July 1, 2024 · Tex. Bus. & Com. Code ch. 541 (HB 4, 2023)
Texans can access, correct, delete, and obtain copies of personal data held by covered businesses, and can opt out of targeted advertising, data sales, and profiling used for decisions with significant effects (like jobs, housing, or credit). Businesses must get consent for sensitive data, including biometrics.
-
In effect
My Health My Data Act
Washington · Effective March 31, 2024 · RCW ch. 19.373
A sweeping health-data privacy law covering 'consumer health data' far beyond HIPAA — including biometric data, health inferences drawn by algorithms, and reproductive health information. Companies need consent to collect or share such data, must honor deletion requests, and cannot geofence health facilities. Consumers can sue under Washington's Consumer Protection Act.
-
In effect
Guam EDPA (5 GCA Ch. 14)
Guam · Effective January 1, 2012 · 5 G.C.A. ch. 14
Guam's baseline statute on government use of personal data — predates the AI wave but is the foundation any AI system using citizen data must comply with. Governs collection, use, and protection of personal data by Guam executive-branch agencies.
-
In effect
Guam Breach Notification (9 GCA Ch. 48)
Guam · Effective January 1, 2009 · 9 G.C.A. ch. 48
Guam's data breach notification statute. Requires entities holding personal information to notify affected residents of breaches. Relevant to AI systems processing personal data because any compromise must trigger notice.
-
Proposed / pending
NJ A5607 chatbot privacy bill
New Jersey · N.J. A5607 (2026-2027)
A New Jersey Assembly bill would limit what chatbot companies can do with users' data. Providers could not use chat histories for targeted advertising, train on minors' data without parental consent, or keep conversations longer than two years unless the law requires it, and users could download their chat histories. The bill would also treat chatbots as products for liability purposes and set $5,000 penalties per violation, with a private right to sue.
County data retention rules (7)
-
In effect
Knox County TN Flock camera ban and removal order (2026)
Knox County, TN · Effective August 31, 2026 · Knox County, Tenn. — emergency ordinance banning license plate readers and requiring removal of all 143 Flock cameras within 30 days (adopted August 31, 2026)
Knox County Commission unanimously passed an emergency ordinance on August 31, 2026 banning license plate readers in the county and ordering all 143 Flock cameras removed within thirty days. Because it was adopted as an emergency measure it required only a single vote and took effect immediately. Commissioner Adam Thompson brought the ordinance after sustained public opposition. Two details from the run-up are worth recording because they explain why the reaction was so complete. In late 2025 the Commission had approved a $1.5 million grant to the Knox County Sheriff's Office under the Tennessee Violent Crime Intervention Fund to advance crime-solving technology. And the Sheriff's Office had spent years buying Flock cameras in batches priced just ten dollars under the $25,000 threshold that would have required mayoral review — a procurement pattern that kept a 143-camera surveillance network out of the approval process that was supposed to catch it. Knox County is not simply declining to renew a contract, which is what most jurisdictions in this dataset have done. It banned the technology and ordered the existing hardware physically removed on a deadline.
-
In effect
Riverside County CA Sheriff ALPR Policy & Retention
Riverside County, CA · Effective July 22, 2025 · RCSD ALPR Policy (2025) (2025-07-22)
Riverside County Sheriff's Department adopted ALPR policy aligning with California Civil Code §1798.90.5 et seq.: 90-day retention cap, documented investigative purpose for queries, audit logging, and quarterly reporting to the Board of Supervisors.
-
In effect
Orange County CA Sheriff ALPR Use & Retention Policy
Orange County, CA · Effective April 15, 2025 · OCSD ALPR Policy (2025) (2025-04-15)
Orange County (CA) Sheriff's Department adopted ALPR governance policy with 90-day retention cap, documented investigative purpose requirement, audit logging, and quarterly reporting to the Board of Supervisors per California Civil Code §1798.90.5 et seq.
-
In effect
Loudoun County Sheriff's Office ALPR General Order 401.8
Loudoun County, VA · Effective March 24, 2025 · LCSO General Order 401
Loudoun County Sheriff's Office General Order 401.8 (Operations) governs Automated License Plate Recognition (ALPR / Flock Safety) use by LCSO personnel. Last reviewed March 24, 2025 with the next review scheduled for November 1, 2027. The order requires data-sharing among other agencies to be governed by MOUs, states that ALPR data is owned by LCSO and is not sold to third parties, and is updated to reflect VA legislative changes effective July 1, 2025.
-
In effect
Arlington County VA ACPD Automated License Plate Reader
Arlington County, VA · Effective April 1, 2024 · ACPD General Order 605 (ALPR policy) (2024-04-01)
Arlington County Police Department adopted formal ALPR governance policy with 30-day data retention limit, restricted access, audit trails, and required reasonable-suspicion or investigative purpose for queries; aligns with Virginia Code §15.2-1723.1.
-
In effect
Santa Clara County Surveillance Ordinance
Santa Clara County, CA · Santa Clara County, Cal., Ordinance Code div. A40 (NS-300.897, 2016)
Santa Clara County passed the nation's first county-level surveillance oversight law in 2016. County departments must get Board of Supervisors approval, publish a surveillance use policy, and file an impact report before acquiring surveillance technology, plus annual reports afterward. Still actively administered by the County Privacy Office.
-
Enacted (not yet in effect)
LA County ALPR immigration-data safeguards motion (Sept. 2025)
Los Angeles County, CA · LA County Board of Supervisors, Statement of Proceedings, Sept. 16, 2025, item 25-5022 (4-1); LASD Report Back, Dec. 11, 2025
On September 16, 2025, the Los Angeles County Board of Supervisors voted 4-1 to ask the Sheriff's Department to tighten its rules on license plate reader data. The board asked that the data never be shared for civil immigration enforcement unless state or county law requires it or a judge issues a warrant. It also asked for written sign-off on any disclosure, reports twice a year on who accessed the data, yearly privacy training, and annual compliance reviews by the Inspector General. The Sheriff runs independently, so the motion is a request. In December 2025 the Sheriff reported that a revised policy had been drafted, but it was not yet in force.
City / local data retention rules (9)
-
In effect
Sanibel FL ALPR data-sharing ban and search restrictions (2026)
Sanibel, FL · Effective September 14, 2026 · Sanibel, Fla. — city council decision ending interagency ALPR data sharing and tightening database search requirements, September 14, 2026
The Sanibel Police Department can no longer SHARE data collected by automated license plate readers with other agencies, and can no longer RECEIVE information from cameras in other jurisdictions. City leaders made the decision at a council meeting on Monday, September 14, 2026, after an hour-long discussion in which members raised concerns about the use and sharing of camera data. Both halves of that matter. Most ALPR controversy concerns collection, but the practical privacy harm usually comes from AGGREGATION — a three-camera island system is a narrow net, while a three-camera system plugged into a statewide or national network is a query interface to everyone else's cameras. Sanibel cut both directions at once. The city has used automated license plate readers since 2008 and currently operates THREE FLOCK FALCON cameras. Residents had previously raised questions about who can access the data, how it is retained, and whether it can be shared. Councilmember Holly Smith framed the proportionality question directly: with three cameras here but multiple cameras everywhere else throughout the state, is this something the city really needs right now? Alongside the sharing decision, Sanibel police UPDATED THEIR OWN POLICIES for accessing and using license plate reader information. Officers are NOW REQUIRED to provide an OFFENSE TYPE, a CASE NUMBER and a WRITTEN EXPLANATION before searching the database. PREVIOUSLY ONLY AN OFFENSE TYPE WAS REQUIRED. And TRAFFIC INFRACTIONS HAVE BEEN REMOVED from the list of offense types eligible for searches. A case number ties a query to an actual investigation and a written explanation creates an auditable record, which together convert an essentially unlogged capability into one that can be reviewed after the fact. Police Chief William Dalton defended the technology's value: around 80% of the people arrested each year are from somewhere other than Sanibel, so people come onto the island, commit crimes and leave. Separately, a PROPOSED ORDINANCE would require council involvement in future surveillance technology decisions — a city representative said that if a new technology is going to be adopted by the city, that would be brought before the council. THAT ORDINANCE IS NOT YET ADOPTED. The council was not being asked to approve a new surveillance system, but to decide whether these rules should apply before any future systems or capabilities are added.
-
In effect
Elma WA temporary ALPR moratorium (2026)
Elma, WA · Effective September 8, 2026 · City of Elma, Wash. — temporary moratorium on Automated License Plate Reader systems (approved September 8, 2026)
The City of Elma placed a temporary moratorium on automated license plate reader systems at its council meeting on September 8, 2026. A city official summed it up plainly: this is basically the city saying that in the meantime it will not be using automated license plate readers in Elma until it can gather more information and develop a policy at a later date. The moratorium defers to state law on law enforcement's use of ALPRs — specifically RCW 10.130, which the Washington Legislature enacted in 2026 to establish a framework for ALPR systems and the data they collect, and under which the Washington Attorney General must develop and publish statewide model policies no later than July 1, 2027. Elma is a small city in Grays Harbor County and this is a modest measure, but it is a useful example of a pattern: rather than write its own rules from scratch, a small municipality paused deployment and tied its own timeline to the state's, so its eventual policy can be built on the Attorney General's model rather than guessed at. The moratorium was one of six public hearings Elma scheduled for September 2026.
-
In effect
Indianola IA police suspend Flock ALPR cameras (Aug. 2026)
Indianola, IA · Effective August 17, 2026 · Indianola (IA) Police Department suspension of Flock Safety ALPR program (announced Aug. 17, 2026)
Indianola police switched off all eight of their Flock license plate reader cameras after residents raised privacy concerns and filed records requests about data sharing with third parties. The department also blocked outside agencies from the data and said it would delete stored data not tied to an active case within 30 days. This is a suspension, not a cancellation. The department says it will revisit the program, taking account of expected state legislative discussion of the technology.
-
In effect
Ralston NE school board staff AI use policy (2026)
Ralston Public Schools, NE · Effective July 27, 2026 · Ralston Public Schools, Neb. — board policy governing staff use of artificial intelligence tools (July 2026)
Ralston's school board approved a new policy governing STAFF USE of artificial intelligence tools, adopted alongside the 2026-27 staff handbook, annual teacher training requirements and other revisions. The STAFF focus is what distinguishes it. Most school-district AI policies in this dataset are framed around STUDENTS — academic integrity, which tools pupils may use, whether AI-assisted work counts as their own. A policy aimed at STAFF use addresses a different and in some respects more consequential set of risks: a teacher pasting student work, disciplinary records or IEP content into a consumer chatbot is disclosing protected education records to a third party, which implicates FERPA rather than any honour code. Adopting it in the same motion as the staff handbook and teacher training requirements suggests it is being treated as an employment and professional-practice matter rather than a curriculum one, which is probably the right frame. What the policy actually requires is not established here.
-
Enacted (not yet in effect)
San Francisco ALPR privacy protections (Sept 2026)
San Francisco, CA · Office of the Mayor, City and County of San Francisco, press release on public safety camera privacy protections (Sept. 29, 2026)
On September 29, 2026, Mayor Daniel Lurie announced tighter rules for how San Francisco police use license plate reader data. Officers can now search plate-reader data for investigations only during the first 30 days after it is captured, down from 12 months, and each search must be tied to a dispatch or incident number. SFPD's data is to be removed from the vendor's platform after 30 days, federal agencies get no direct access, and use for civil immigration enforcement, tracking reproductive or gender-affirming care, or monitoring First Amendment activity is prohibited. SFPD will review system-use logs monthly and will ask the Department of Police Accountability to conduct regular independent audits; personnel who violate the rules face discipline up to termination. The Electronic Frontier Foundation criticized the package as weak because it does not require a warrant or set a deletion deadline.
-
In effect
New Orleans Surveillance/FR Rules
New Orleans, LA · New Orleans, La., Code ch. 147, as amended July 21, 2022
New Orleans banned facial recognition, predictive policing, and cell-site simulators in December 2020, but the council partially repealed the ban in July 2022, letting police use facial recognition (with human review and reporting) for serious violent crimes. In 2025 it emerged NOPD had received real-time facial recognition alerts from a private camera network in violation of these rules; alerts were paused in April 2025 and a proposal to authorize real-time FR was withdrawn, leaving the 2022 rules in place.
-
Proposed / pending
SFPD proposed DGO 10.12 drone policy (2026)
San Francisco, CA · San Francisco Police Department, proposed Department General Order 10.12, Unmanned Aircraft Systems (UAS) Operations (Police Commission, Sept. 2, 2026; hearing set Oct. 14, 2026)
The San Francisco Police Department has proposed a new general order, DGO 10.12, setting rules for its drones. The draft would let officers use drones in any situation where an officer may be sent for a public safety response, while banning uses such as monitoring protests solely for that purpose, targeting protected classes, use as a force option and 'general surveillance'. Footage with no evidentiary value would be kept no more than 30 days and evidence footage at least two years. The Police Commission delayed a vote on September 2, 2026 to take more public comment and is scheduled to hear it again on October 14, 2026.
-
Proposed / pending
Atlanta proposed surveillance technology ordinance (2026)
Atlanta, GA · City of Atlanta, proposed surveillance technology ordinance (Mayor Dickens, introduced Sept. 2026)
Atlanta Mayor Andre Dickens introduced legislation at the City Council on September 21, 2026 to set citywide rules for surveillance technology such as Flock license plate reader cameras. It would require written policies on authorized and prohibited uses, access and training; rules for collecting, protecting, retaining, deleting and sharing data; monthly internal audits and quarterly public reporting for high-risk police systems; and an annual independent compliance review. It would also create a seven-member review panel, set procedures for misuse allegations and bar vendors from selling the data. The proposal followed an audit in which police flagged 79 of 115,578 Flock searches for further review.
-
Proposed / pending
Anchorage AO 2026-108 surveillance technology / ALPR ordinance
Anchorage, AK · Anchorage Assembly Ordinance AO 2026-108 (2026)
Anchorage Assembly members have proposed an ordinance to replace the city's surveillance technology rules. It would add limits on automated license plate readers, real-time crime center operations and live camera monitoring, limit how long surveillance data is kept, bar joining outside surveillance data networks, and require Assembly approval before the city acquires surveillance technology. A vote, alongside a competing proposal from the mayor's administration, is expected Oct. 20, 2026.