A policy paper published September 9, 2026, by the Utah Civic Compact suggests that Utah's current laws governing automatic license plate readers (ALPR) may not fully describe the systems agencies are actually purchasing. The report, authored by Jarom Gillins, Director of Policy, focuses on a contract between the Weber County Sheriff's Office and Flock Safety to determine if the technology fits existing statutory definitions.
According to the report, ten cameras in Weber County feed into the Flock system, which has seen 5.1 million network queries over four years. The analysis notes that approximately 97 percent of these queries originated outside of Utah. The paper argues that while Utah has strong laws regarding government use of ALP
Rs, the current statutes lack definitions for persistent identifying systems or the specific data such systems produce regardless of who holds it.
The analysis highlights a divergence between Utah's ALPR System Act and the Weber County order form executed December 19, 2025. While the statute defines the device as cameras used with algorithms to convert images into readable data, the vendor describes the product as a license plate recognition camera featuring proprietary machine learning software. The report notes that the contract defines Customer Data as what is visible via a web interface, while raw footage and Flock IP—which includes algorithms, models, and derivative works—remain with the vendor.
Under the current contract, Flock retains ownership of the hardware and the rights to use Flock IP for any purpose at its sole discretion. The report observes that because the law's protections often attach only to data maintained by a governmental entity, the raw outputs and derivative works held by a private vendor may fall outside the reach of existing statutory protections and destruction requirements.
The Utah Civic Compact suggests that to address these gaps, future legislation should define a persistent identifying system and a broader category for identifying data. The report concludes that without these definitions, future laws may only address the specific layer of data a government agency touches, potentially leaving other identifiable data exposed.
