Utah panel outlines compromises in proposed ALPR law, vows to refile HB 468 after session deadline missed

SALT LAKE CITY — A panel of state officials, a technology vendor and lawmakers on Saturday described a package of privacy and operational rules for automatic license plate reader systems (ALPRs) that Representative Kristen Chevrier said will be refiled after it failed to clear the end of this year’s legislative session.

"HB 468 strikes the right balance between public safety and privacy," Rep. Kristen Chevrier said, describing language that would narrow permitted uses, shorten data-retention limits and require verification and auditing before law-enforcement action.

The bill’s sponsor and government and industry panelists said the effort aimed to preserve ALPR capabilities used for Amber Alerts, homicide investigations and locating stolen vehicles while adding strict guardrails to prevent misuse. Key provisions described during the summit include a reduction in government retention of ALPR data from nine months to 90 days unless tied to an active investigation; a two-step verification requirement before acting on hot-list alerts (visual confirmation and system confirmation); mandatory case numbers for searches; reporting and auditing duties; and explicit vendor responsibilities for security and access.

Why it matters: ALPR systems capture vehicle images and timestamps at scale, creating a detailed location record of motor-vehicle movements that civil-liberties advocates say can be abused and that law enforcement says is critical to solving crimes. The panel’s discussion reflected the tension between those positions and the push in Utah to codify statewide standards rather than leave practices to disparate local policies.

Representative Kristen Chevrier, the bill’s sponsor, told the audience she and stakeholders "worked hard and fast" in the legislative session and won committee approvals but that the measure ultimately failed because the "clock ran out" at the end of the session. "The bill file has already been opened," she said, and she expects the measure to be reintroduced early in the next session.

From law enforcement, Tanner Jensen, director at the Statewide Information Analysis Center at the Utah Department of Public Safety, said officers supported the compromise because it clarifies when ALPRs may be used and adds transparency. "Great power requires great responsibility," Jensen said, summarizing the law-enforcement perspective that the technology can prevent serious harms but must be tightly governed. Jensen noted Utah law requires permits through the Utah Department of Transportation before agencies place cameras on highways and described operational differences between mobile ALPRs mounted on patrol cars and fixed roadside systems.

Andrea Korb, director of policy at Flock Safety, the vendor participating on the panel, described system features that vendors say support those safeguards: role-based access, end-to-end encryption, required search reasons and an optionally public transparency portal. Korb said Flock’s default data-retention setting is 30 days and that the company does not sell customer data. "Flock Safety doesn't take that data or sell it to private third parties ever," she said.

State Chief Privacy Officer Chris Bramwell called the summit part of a broader effort in Utah to apply privacy principles to new technologies. "If we do it in this manner transparently with all the stakeholders, we're gonna build a lot of trust with the public," Bramwell said, adding the state expects iterative improvements over time.

Panelists described provisions intended to limit false hits and wrongful stops. The proposed law mirrors best practice described in federal cases: officers must visually confirm a plate and confirm the system match before stopping a vehicle. The bill would also codify reporting and auditing requirements and require agencies that share ALPR data to use memoranda of understanding that document permitted uses and follow statewide guardrails.

On private-sector data, the panel acknowledged a legal and policy gap. Utah law currently requires a warrant for government access to ALPR data held by non-governmental entities, but speakers said commercial networks collect large volumes of location data outside those rules. Representative Chevrier and others said lawmakers will need to consider whether and how to regulate private ALPR networks if the data are used by government.

The Aurora, Colorado, wrongful-detention settlement and other national examples drove several sponsors to insist on the two-step verification and auditing language. "That was a factor in wanting to make sure the 2-step verification got into the bill," Chevrier said.

Next steps: Chevrier said HB 468 will return to the legislature next session with possible technical edits. Panelists urged continued stakeholder engagement and the collection of standardized audit data to let lawmakers evaluate the law’s effects over time.

Votes at a glance: No formal floor vote on final passage was recorded in the panel discussion; Chevrier said the bill passed two house committee stages and the house floor and passed a senate committee before the session ended and the bill did not receive final enactment. The bill file has been opened for the next session.

(Reporting based on a public panel discussion at the Utah Department of Data Privacy summit; quotes and details derived from remarks by Representative Kristen Chevrier, Tanner Jensen, Andrea Korb and Chris Bramwell.)