Boulder, Colorado, is weighing a long-term contract for automated license plate readers (ALPRs), and according to a recent opinion piece from Olivia Mendoza published in the Boulder Reporting Lab, the city is moving forward without the safeguards, public oversight, or vendor accountability that should come before any surveillance technology gets locked into a multi-year deal. The concerns raised in Boulder are not unique to one Colorado city. They reflect a pattern playing out in municipalities across the country, where automated license plate readers privacy protections often arrive after the cameras are already installed, not before.
What Boulder's ALPR Proposal Actually Tracks
Automated license plate readers are cameras, often mounted on poles, patrol vehicles, or fixed infrastructure, that photograph every passing license plate and log the time, date, and GPS location of that vehicle. Unlike a traffic camera that captures a single violation, ALPRs create a continuous record of where a car has been, when, and how often. Strung together over weeks or months, that data can reveal where someone works, worships, seeks medical care, or spends their evenings, regardless of whether that person has ever been suspected of a crime.
Mendoza's piece frames Boulder's pending decision as consequential precisely because the city is considering a long-term contract, meaning whatever vendor is selected, and whatever data practices that vendor follows, could be locked in for years. That is a significant commitment to make without first settling how long data is retained, who can access it, and under what circumstances it can be shared with outside agencies.
Why Weak Vendor Accountability Puts Commuter Data at Risk
The core of the opinion piece is not that ALPR technology is inherently illegitimate. It is that Boulder appears poised to select a vendor before establishing the guardrails that should govern how that vendor operates. Without clear, enforceable contract terms, cities can end up ceding control over sensitive location data to private companies whose business incentives do not necessarily align with residents' privacy interests.
This matters because ALPR data does not stay static. Vendors may retain records far longer than a city intends, pool data across multiple jurisdictions, or make it accessible to other law enforcement agencies through data-sharing networks that residents never voted on and may not even know exist. Once a long-term contract is signed, renegotiating those terms becomes far harder than getting them right from the start.
How This Fits a National Pattern of Municipal Surveillance Expansion
Boulder's situation is a local example of a much broader trend. Cities and states across the country have been expanding surveillance infrastructure, often through vendor contracts that receive far less public scrutiny than a police budget line item or a new ordinance would. It echoes concerns seen in other statehouses, such as Utah's SB 73, where lawmakers advanced legislation that critics warned would erode digital rights with insufficient public debate.
The push and pull between surveillance capability and civil liberties oversight is not confined to license plates, either. Debates over scanning obligations in Europe, including ongoing fights over Chat Control 2.0's threat to encryption, show that governments at every level are grappling with how much monitoring infrastructure to build and how much transparency should accompany it. Boulder's ALPR contract is a local chapter in that same story: technology capable of mass data collection moving faster than the policy frameworks meant to constrain it.
What Residents and Privacy Advocates Can Push For Before Contracts Are Signed
There is a template for what stronger oversight can look like. At the federal level, lawmakers have introduced legislation that would bar federal agencies from using ALPR systems without clear limits, an approach that underscores how seriously some policymakers now take unchecked license plate surveillance. Boulder residents and privacy advocates can point to that federal effort as evidence that meaningful guardrails, not blanket bans, are achievable and increasingly expected.
Before any contract is finalized, advocates can push the city to define strict data retention limits, require public reporting on how ALPR data is used and shared, prohibit sharing with agencies outside Boulder's jurisdiction without judicial authorization, and build in regular public review periods rather than locking terms in for years at a time.
What This Means For You
Even if you do not live in Boulder, this story is a useful case study in how local surveillance decisions get made, often with far less public input than residents assume. If your city or town is considering ALPR technology, red light cameras, or similar tools, the questions Mendoza raises are worth asking locally: How long will data be kept? Who can access it? What happens if the vendor is acquired or changes its policies? These are not abstract concerns. They determine whether a routine drive to work becomes part of a permanent, searchable record.
Automated license plate readers privacy protections should never be an afterthought bolted onto a contract after the fact. Boulder still has a chance to build those protections in before signing anything long-term, and residents who want a say should make their voices heard while the terms are still being written, not after the ink is dry.
