Los Angeles City Council mandates unified privacy rules for municipal AI

The Los Angeles City Council has approved a motion directing municipal agencies to establish a unified data privacy framework governing artificial intelligence and automated surveillance technologies.

The measure instructs the Information Technology Agency, alongside the Chief Legislative Analyst and the City Administrative Officer, to audit current deployments across all city departments. Municipal staff must draft recommendations for a single, binding policy that covers data collection thresholds, retention limits, third-party access, and public disclosure requirements.

The council’s vote addresses an increasingly fragmented regulatory landscape across the city. Individual entities, including the Los Angeles Police Department and the Department of Transportation, currently maintain disparate operating procedures for automated tracking infrastructure. These systems encompass automated licence plate readers (ALPR), computer vision deployments, and algorithmic workflow platforms.

Council members noted that such departmental silos leave significant gaps in accountability. Without centralised standards, data gathered by one agency can circulate to external organisations or federal databases without adequate council oversight. The motion specifically emphasises risks surrounding ALPR networks, which capture millions of geolocation records every month, potentially exposing sensitive travel patterns and community movements.

Under the forthcoming policy, departments will need to justify new acquisitions of algorithmic tools through formal impact assessments. These assessments must evaluate technical error rates, potential demographic bias, and cybersecurity safeguards. The policy will also target proprietary vendor agreements, aiming to restrict third-party software providers from retaining, monetising, or analysing city-gathered data for external commercial purposes.

Civil liberties groups had petitioned council members for stringent retention limits, arguing that indefinitely stored location and sensor data creates perpetual surveillance risks. The council instructed analysts to examine fixed expiry windows, requiring automated deletion of non-evidentiary records across municipal servers.

City agencies are scheduled to deliver their consolidated assessment and policy proposals within the coming months. Yet with operational software deeply embedded across dozens of autonomous departments, how effectively can a centralised municipal policy bring existing surveillance systems into compliance?