Surveillance technology ordinances: what they require of staff

Reference article · 5 min read

Many cities and counties, and a small number of states, have adopted ordinances requiring approval by the elected governing body before an agency acquires or uses surveillance technology. They are often called CCOPS ordinances, short for Community Control Over Police Surveillance, though most reach well beyond police departments. Where one is in force, it sits on top of normal procurement rules and adds steps a purchase order alone will not satisfy.

The question staff need answered is narrow: does this purchase trigger the ordinance, and how much time does it add. The answer depends on local text, which varies more than the shared label suggests. Confirm the specifics against your own municipal code and with your city attorney or county counsel.

What the ordinances typically cover

Most define surveillance technology by function rather than by naming products. A common formulation covers equipment, software, or services whose purpose or effect includes collecting, retaining, processing, or sharing information about individuals or groups.

• Not only cameras. License plate readers, drones, body-worn and in-car video, gunshot detection, cell site simulators, face recognition, social media monitoring, and predictive analytics are commonly enumerated.
• Software counts. An analytics platform or records module can be covered when it aggregates personally identifiable information from multiple sources.
• Free things count. Pilots, trials, donated equipment, and access through a regional partner are usually in scope. The obligation attaches to acquisition or use, not to spending.
• Departments beyond police. Public works, transit, parks, code enforcement, and libraries often fall under the same rules.

Ordinances also carry exclusions, often for general office IT, building access control, parking equipment, and cameras used strictly for traffic operations. Exclusions tend to be narrow, so read yours closely.

The inventory, and systems already in place

An ordinance usually requires a one-time inventory of surveillance technology already in use, with a deadline and a process for the body to approve, modify, or discontinue each item. Existing systems are rarely grandfathered outright. More often they get a defined period to keep operating while a use policy is prepared and heard.

The inventory is often the first complete list anyone has assembled, and things surface that were never tracked centrally: a grant-funded camera array, a lapsed trial, a data sharing arrangement with a neighbor. What the body approves then becomes the baseline. Adding a data source, extending retention, or sharing data with a new outside agency generally means going back for approval.

The approval cycle and your project schedule

The core requirement is a surveillance use policy, often paired with an impact report, published in advance, heard in public, and voted on. It typically covers purpose, data collected, retention and deletion, access, training, oversight, third party sharing, and an assessment of civil liberties and disparate impact.

Plan the calendar backward from a regular meeting of the governing body:

1. Draft the policy and impact report with the department, IT, legal, and privacy staff.
2. Internal review, including any privacy or technology advisory commission.
3. Public posting for the notice period the ordinance requires.
4. Committee hearing, then the vote.
5. Contract execution and deployment.

Even when nothing goes wrong, this tends to add months rather than weeks, and a continuance moves you to the next cycle. Build it into the project plan and funding timeline, especially for grant-funded work with a spending deadline.

Deciding whether a specific purchase is covered

Start by reading the approved inventory and recent annual reports, since an existing approval may already cover what you have in mind. Then work through it in order, and write down your reasoning.

• Does the system collect, retain, or process information about identifiable individuals, or can it readily be used that way?
• Is it named in your ordinance's enumerated list, or does it match the general definition?
• Does it fall squarely inside a stated exclusion, rather than merely near one?
• Is this a new acquisition, or a new use, new data source, or longer retention on something already approved?
• Is anything arriving at no cost, on trial, by donation, or through a shared regional system?

When the answer is unclear, ask counsel in writing before the solicitation goes out. A determination made after award is the expensive kind.

The annual report back

Most ordinances require a public annual report for each approved technology, covering how it was used, what data was shared and with whom, complaints, audit results, effectiveness against the stated purpose, and cost. Some let the governing body suspend or rescind approval when a report is not filed.

Reporting is easier when the system itself produces the numbers. Decide during procurement what the report must say, then confirm the product logs it and can export it without vendor help.

What to ask vendors and what to put in the contract

• Ask for a written list of data elements collected, default and configurable retention periods, and whether deletion is enforced technically or by policy alone.
• Ask what audit logging exists for searches, exports, and administrative changes, and whether those logs are exportable.
• Ask whether the vendor or any subprocessor accesses, retains, or reuses agency data, including for product improvement or model training, and which third party integrations are on by default.
• In the contract, address data ownership, no secondary use, no sharing without written consent, notice of third party requests, deletion on termination, audit rights, and cooperation in producing the annual report.
• Make award and continued performance contingent on governing body approval.

Watch for confidentiality terms that would keep you from publishing a use policy or answering records requests. These ordinances assume disclosure, so resolve the conflict before award.

HQT builds and integrates software for state and local government agencies, including work on data retention, access logging, and public reporting.

Frequently asked questions