P5 Regulatory and compliance
Regulatory that hits enterprise deployments: biometrics, ALPR, retention, cross-border data flow.
The regulatory that hits real deployments in LATAM and US: LFPDPPP (Mexico), LGPD (Brazil), GDPR (Europe), EU AI Act, NDAA Section 889, FCC Covered List, ALPR Fourth Amendment case law. Each post cites primary sources (statute, regulation, court ruling).
If you are new to this pillar, read these 2 first.
Editor pick — the posts that best explain the state of the topic in 2026.
- ★ EDITOR PICK
British Transport Police spent £320K on live facial recognition. It made zero arrests.
BTP scanned 500,000 faces in 18 deployments, generated 1 alert, it was a false positive, cost £320K + 100 officer-hours, 0 direct arrests. The five-clause matrix your facial recognition RFP needs in Q4 2026.
- ★ EDITOR PICK
Two federal rulings in 72 hours just told Flock 'this is a warrantless search.' Your LATAM CCTV/ALPR RFP now has a seven-clause matrix to add.
A federal magistrate judge and a federal jury in Texas said within 72 hours that a single Flock query + the downstream ALPR traffic-stop pipeline are unconstitutional. The seven-clause matrix your LATAM RFP now needs.
Compliance matrix by jurisdiction (CCTV)
Canonical comparison of the 5 jurisdictions that most impact LATAM deployments. If your team operates cross-border, this is the reference.
| Jurisdiction | Law | Max footage retention | Biometric consent | Maximum penalty | CCTV-specific detail |
|---|---|---|---|---|---|
| 🇲🇽 Mexico | LFPDPPP + Reglamento | 30 days recommended (no hard legal deadline) | Yes — express privacy notice | ~$32M MXN + moral damages | INAI can order immediate suspension of processing |
| 🇧🇷 Brazil | LGPD (Law 13.709/2018) | Justified and proportionate (no hard deadline) | Yes — specific consent (art. 11) | 2% revenue or R$50M per incident | ANPD has the power of precautionary blocking |
| 🇪🇺 European Union | GDPR + LED 680/2019 | Necessary for purpose (≤72h LPR in some cases) | Yes — specific legal basis (consent or public interest) | €20M or 4% global revenue | AI Act 2024 adds obligations for biometrics (high risk) |
| 🇺🇸 California (USA) | CCPA + CPRA | Necessary for stated purpose | Yes — opt-out + notice at collection (state BIPA statutes) | $7,500 per intentional incident (CCPA); $1,000-5,000/person (Illinois BIPA) | Illinois BIPA is the most aggressive: every biometric recording without consent = violation |
| 🇨🇦 Canada | PIPEDA + provincial (Quebec Law 25) | Necessary for purpose (no hard deadline) | Yes — express consent (stricter in Quebec) | C$10M or 3% global revenue (Quebec Law 25) | Quebec Law 25 (2024) is the most recent reform — entered into force in phases |
> Primary sources: official texts of each law. This table is updated when there is a relevant reform. Last editorial review: 2026-10-06.
Articles in this pillar (51)
-
Five cities canceled Flock. Not one of them took the cameras down.
Reno, Fairfield, Caldwell, Asheville, Apex and Durango all switched from Flock to Axon without shutting anything down. What got negotiated: retention, audits, and who owns the data. Three clauses for your RFP.
-
A state committee wrote 19 questions to its video analytics vendor. It never answered them.
The West Virginia House Government Organization Committee wrote 19 written questions to Flock Safety, its video analytics vendor, and published them verbatim. Flock answered with eight pages, and the committee wrote back: 'Your letters have made no attempt whatsoever to answer this question'. The sworn testimony hearing is November 9, 2026. The 19 questions are, literally, an enterprise RFP.
-
A New York county published what turning cameras off actually costs. The number: 727,493 plates a month.
Dutchess County NY published two official 30-day Flock usage windows: 727,493 plates and 188 searches before the shutdown, 435,928 plates and 87 searches after. The first before/after dataset in the ALPR debate — and the three RFP clauses to measure what your own network actually costs.
-
14 Cameras, No Permits, No Owner. The County Put Bags Over Them.
St. Lucie County found 14 Flock cameras without permits while pulling 52 authorized ones. Eleven ended up with no identified owner and the county had no authority to switch them off, so it covered the lenses with bags. The first asset-inventory failure in the ALPR debate — and the three RFP clauses that keep you from inheriting one.
-
A Good Reason Is Not a Permission: The Clause Your RFP Is Missing
On October 20, 2026 a federal court ruled by summary judgment: a good reason does not justify handing PII to someone who does not need it. Three RFP clauses for your analytics and camera contract.
-
One Airbnb interior photo. LAPD gets the exact address.
404 Media documented that LAPD and Miami-Dade bought Raven, formerly GeoSpy: a tool that returns an exact address from a single interior photo, trained on Zillow, Airbnb and Vrbo listings. Three RFP clauses for your CV system.
-
DHS Kicked DeepSeek Off Every Federal Civilian Agency. Including the AI Gateways Routing It Without Telling You.
The DHS order of October 20, 2026 bans DeepSeek across all US federal civilian agencies and reaches AI gateways like OpenRouter and Vercel that route models without the user knowing. Three enterprise RFP clauses.
-
An OpenAI engineer hid a $20 ESP32-S3 behind a TV. DOJ's Counterintelligence Section prosecuted him.
An OpenAI engineer was prosecuted by DOJ's Counterintelligence Section for hiding a $20 ESP32-S3 behind a TV. Three insider-risk clauses your enterprise AI RFP needs.
-
Opening an app took no click. The spyware rode in on an ad.
On October 15, Citizen Lab confirmed the first public technical evidence of a zero-click mercenary spyware attack delivered via targeted advertising. 4 billion bidding records analyzed, nearly 200,000 websites and apps, 45 Al Jazeera devices. Google and IAB Europe revoked approved-vendor status. The partner-inventory clause your RFP needs.
-
A New York county executive just vetoed her own legislature's ‘cover the Flock cameras’ measure. The three dual-deadline clauses your LATAM RFP needs.
On Oct 16, the Dutchess County (NY, ~295k residents) executive returned unsigned a unanimous legislative resolution ordering Flock cameras to be covered. The legal grounds: the county already has an active 30-day removal-track executed by the County Attorney. The three dual-deadline clauses your LATAM RFP needs to anticipate this architecture.
-
A California judge just dismissed EFF's ALPR lawsuit. A federal judge had called ALPR searches unconstitutional the day before. The three dual-track clauses your LATAM RFP needs.
On Oct 14 a California trial court dismissed SIREN v. San Jose; on Oct 1 a federal judge called ALPR searches 'indiscriminate mass surveillance.' Three dual-track constitutional clauses your LATAM ALPR CCTV RFP needs.
-
Three Senate letters, one date: Oct 16. The three clauses your LATAM ALPR RFP needs when the vendor is a US federal-investigation target.
On October 5, Schumer joined Hawley and Wyden as the third US federal senator with a pending letter to Flock's CEO. Tomorrow, October 16, three US senators simultaneously have deadlines expiring on the ALPR cluster. The three clauses your LATAM CCTV/ALPR RFP needs before signing with any US-anchored vendor.
-
There is now a bill in Congress to get Flock out of every community. Your LATAM RFP already has the first 'bills cluster' matrix to import.
Rep. Tlaib introduced H.R. 10807 on Oct 13: the first bill in the U.S. Congress designed to completely ban automated mass surveillance technology. Three clauses your LATAM RFP must import before signing any contract.
-
A California sheriff's own audit log documented 254,131 ALPR shares. EFF just made it public.
EFF + ACLU sent a demand letter to the Marin County Sheriff citing the agency's own Nov 2024 audit logs. The three clauses your LATAM RFP needs before any U.S.-anchored ALPR vendor signs.
-
An Oklahoma federal judge just called a Flock search 'indiscriminate mass surveillance.' The three clauses your LATAM ALPR RFP needs before any U.S.-anchored vendor signs.
On October 1, 2026, U.S. District Judge Sara Hill (N.D. Okla., 4:26-cr-00189-SEH, Doc. 62) ruled a Flock search unconstitutional. Three procurement-defense clauses your LATAM ALPR RFP needs.
-
Sen. Wyden just told the White House to publish a 2-year-suppressed privacy review of the federal ALPR program
Wyden asked ONDCP to publish the MITRE 2024 HIDTA privacy review — the first time a federal senator has named Flock + Axon + other vendors as federal aggregators. Three clauses your LATAM RFP needs before any U.S.-anchored vendor signs.
-
A single Harris County precinct commissioner just killed 61 Flock cameras without a county-board vote. The sub-entity authority clause your LATAM ALPR RFP needs.
On October 8, Harris County Precinct 4 Commissioner Lesley Briones unilaterally deactivated 61 Flock cameras (48 security + 13 ALPRs across 9 parks) after consultation with the County Attorney. The 4-issue procurement-defense matrix any multi-entity LATAM ALPR RFP needs to give your sub-entity termination authority.
-
Six federal ALPR bills are now in Congress. The three clauses your LATAM CCTV/ALPR RFP needs before any US-anchored vendor signs.
On October 2, Sanders + Ocasio-Cortez + Merkley filed the Ban Flock Act. It is the first federal ALPR-prohibition bill of the 119th Congress, and it includes a private right of action for any American to sue the federal government. If your preferred ALPR vendor has just been named in one of six pending federal bills, which three clauses does your enterprise RFP require before you sign a 3-year contract?
-
Flock Safety just cut 18% of its staff. The three clauses your LATAM CCTV/ALPR RFP needs before you sign a 3-year contract.
On October 8, Reuters reported that Flock Safety is cutting ~270 employees (18% of staff) following a voluntary buyout. It is the first time a US ALPR vendor has acknowledged structural-decline pressure with internal corporate action rather than a press release. The question for a Mexican, Brazilian, or Argentine procurement signing an enterprise CCTV/ALPR contract in Q4 2026: if your preferred vendor can lose 1 in 5 employees in a single quarter, what three continuity clauses does your RFP demand before signing?
-
Henrico, Virginia just terminated 128 Flock cameras without paying a penalty. The preventative, not reactive language your LATAM ALPR RFP now needs — before Hawley's October 16 deadline.
On October 6, Henrico County, Virginia (~330k residents, the second-largest jurisdiction in Virginia) terminated its four-year contract with Flock Safety citing 'privacy concerns' — with no financial penalty to taxpayers, within a 7-day window, while reviewing alternative options in parallel. Five preventative vendor-risk pre-emption clauses that any LATAM ALPR RFP signed in Q4 2026 needs before Hawley's October 16 deadline.
-
Italy published Legislative Decree 160 on September 9. Your LATAM facial-recognition RFP now carries the risk of Italy's Garante, AI Act Article 26(10), and an October 10 Council of Ministers vote. Five targeted-search compliance clauses your procurement must sign before the deadline.
Italy's Decreto Legislativo 160 (Gazzetta Ufficiale 15-Sep-2026) closed the Italian AI Act transposition with two concessions to the Garante plus three residual risks for LATAM. Five targeted-search compliance clauses your facial-recognition RFP needs before the Italian Council of Ministers' October 10 deadline.
-
LA's city council just asserted jurisdiction over a $235M Axon ALPR contract. The five legislative pre-emption clauses your LATAM ALPR RFP needs before Oct 23.
On Oct 6, the Los Angeles City Council voted 10-4 to defer a three-month pilot program of automatic license plate readers (ALPRs) on streetlights, asserting legislative jurisdiction over a recent Board of Police Commissioners decision that approved a 10-year, $235 million contract with Axon Enterprise. The five-clause legislative pre-emption matrix a Q4 2026 LATAM ALPR RFP needs.
-
Hawley just put Motorola, Verkada, and Axon on notice alongside Flock. Your Q4 2026 LATAM CCTV RFP now has a four-vendor Senate-record matrix to import.
Sep 3-4 Hawley letters to Motorola Solutions, Verkada, Axon with Sep 16 deadline. Sep 28 subcommittee hearing. Four AI-camera vendors now in the public Senate record — a new procurement-defense dataset for any LATAM CCTV RFP.
-
The 1980s anti-drug program that now moves your plate reads to a federal database. The architectural question your LATAM CCTV RFP needs to ask.
On Sep 30, Sam Biddle at 404 Media documented that HIDTA, an 80s-era anti-drug program, now functions as a federal ALPR data pipeline. Cities installing Flock or Axon cameras on state right-of-way must sign an MOU with HIDTA and share plate reads with regional intelligence centers. The load-bearing disclosure: signing a city ALPR contract no longer guarantees control over the data. Five clauses any LATAM enterprise CCTV RFP now needs to demand.
-
The FCC component-part rule takes effect October 13. Three procurement clauses your LATAM enterprise CCTV RFP now needs to add.
The FCC's final rule closing the component-part loophole takes effect October 13, 2026. It is the third regulatory front in three years of the NDAA 889 + FCC stack. Three procurement clauses that a private enterprise CCTV RFP in LATAM now requires.
-
EFF just told San Francisco its ALPR plan is weak. Here are the three clauses your enterprise RFP needs in writing.
EFF published three structural defects in San Francisco's ALPR policy on September 29: no warrant, no deletion-not-move, no audit-prevention. The checklist translates verbatim to private enterprise CCTV/ALPR RFP clauses.
-
EFF just told the FAA that the rule that criminalized filming officers with drones was unconstitutional. Here's why your next aerial CCTV audit in Mexico or Brazil needs to read the amicus before you sign the RFP.
EFF + ACLU + NPPA + PPA asked the DC Circuit on September 4 to vacate the FAA rule that criminalized drone recording of immigration officers. The case is still live. The question for your next enterprise CCTV contract in LATAM is whether your jurisdiction can issue an equivalent NOTAM that suppresses aerial auditing of your public deployment.
-
Mexico runs 58,000 C5 cameras with zero federal facial recognition law. Brazil just filed PL 649/2026.
Mexico operates 58,000+ C5 cameras with no federal facial recognition law. Brazil just filed PL 649/2026 mandating BNMP-only integration. What this means for your next LATAM CCTV/ALPR RFP.
-
Springfield arrested Mylie Hyder for reading 3 sentences against Flock cameras. The ticket reads 'Middle Finger to Mayor'.
On September 22, Mylie Hyder — first time at a public meeting — walked to the podium to read 3 sentences against Springfield's 41 Flock cameras. Before she finished the first sentence, her microphone was cut and she was arrested. The citation reads 'Disturbance of City Council MTG — Middle Finger to Mayor.' It is the first time a US city council has used arrest to suppress public comment on a Flock contract review.
-
Mexico runs 58,000 C5 cameras with zero federal FR law. Brazil already has one. Your LATAM RFP crosses both.
Mexico operates more than 58,000 C5 cameras across CDMX without a single specific federal law on facial recognition. Brazil already has CNDH Resolution 17/2025 and PL 1828/2023 (in Senate). Any procurement office signing an enterprise CCTV contract in Q4 2026 crosses both regimes.
-
On September 22, they arrested Mylie Hyder for 5 seconds of testimony against 41 Flock cameras. Your next LATAM RFP has to survive this.
Mia Hyder / Mylie Hyder: arrested Sept 22 in Springfield for 5s of testimony against 41 Flock cameras. 7 RFP clauses that protect LATAM CCTV ops.
-
Flock wrote 7 commitments to the Senate. Your next CCTV RFP should require all 7 in writing — before you sign.
On September 8, Flock's chief legal officer (Dan Haley) sent a letter to Hawley committing to 7 operational changes to the platform. Hawley read it aloud on September 23. These are the 7 clauses any LATAM CCTV/ALPR RFP should require from any vendor — in writing, before the signature.
-
Flock is weighing selling itself. Your 5-year ALPR contract needs a change-of-control clause today.
Semafor reported September 23 that Flock Safety is weighing selling itself; Axon and Motorola are the most likely buyers. What your LATAM ALPR RFP must require in writing before signing.
-
200 cities cancelled Flock in 18 months. Today they testified in front of the U.S. Senate.
Chad Marlow of the ACLU confirmed to Hawley's Subcommittee that 200 localities cancelled Flock in 18 months — 3 per day in August alone. Five witnesses testified, zero CEOs showed. What the September 23 hearing means for your next LATAM CCTV RFP.
-
Verkada left a sentence in its decline that fits in your RFP. Three of the four vendors invited to testify on September 23 couldn't sign it.
Verkada declined Hawley's invitation and left an exact sentence in its statement — 'none of our customers can search a national Verkada network – because none exists' — that fits verbatim in your LATAM RFP. Flock, Axon and Motorola had not published an equivalent public response in the 96 hours before the Sep 23 hearing.
-
Your ALPR vendor ran 9 searches against your citizens using First Amendment criteria. The moderation layer is theirs, not yours.
On September 17, 404 Media published audit logs from 'Flock City PD' — internal vendor accounts that ran real (not simulated) searches — 'Star of David', 'coexist bumper sticker', 'vehicle a pretty girl would drive' — against cameras in Dunwoody GA and Bryan TX during sales demos. The moderation layer that decides what goes through and what doesn't is operated by the vendor, not your police department and not your municipality.
-
Hawley is asking the questions on Sept. 23. Here are the four your LATAM procurement officer should put in writing — before Wednesday.
On Sept. 23 the U.S. Senate Judiciary Subcommittee on Crime and Counterterrorism convenes with the four CEOs of Flock, Axon, Motorola, and Verkada. A LATAM procurement officer evaluating any of the four has 48 hours to put the architectural questions in writing — before signing.
-
The EU built the world's largest biometric border system. It hasn't worked since April 10.
The EU's Entry/Exit System (EES) was declared operational on April 10, 2026. The grace period expired Sep 6; on Sep 14, the Commission informally allowed 9 countries to suspend biometric collection — with no new deadline. What that pattern means for any biometric procurement at scale.
-
4 CEOs, 1 date, 0 subpoenas: Wednesday they sit — or they don't
On Wednesday Sep 23, the U.S. Senate Subcommittee on Crime and Counterterrorism will hear — by invitation, not subpoena — the CEOs of Flock Safety, Axon, Motorola Solutions, and Verkada. What's on the public record so far, and what isn't.
-
6,300 plate searches with 'TBD' as the reason. Flock's response: hide the field.
EFF and 404 Media published parallel audits of Flock Safety ALPR logs. 30+ agencies, 17 states, 6,300+ searches with 'TBD' as the reason. A Goshen Indiana officer queried 82,413 cameras in one search with the reason 'idk.' Another in Lake County wrote 'LMAO.' Flock's response was to replace the free-text reason field with a dropdown of generic offense categories — exactly what kills the paper trail FOIA requests needed.
-
Seattle just shifted $250,000 away from CCTV expansion. The question no LATAM mayor has asked yet.
Seattle's Public Safety Committee voted to shift $250,000 away from CCTV expansion toward community-based crime prevention. The first time a major US city council has cut camera procurement itself mid-budget — not the policy, not the analytics.
-
On September 11, 2026, the EU Cyber Resilience Act's 24-hour clock started. Your next camera RFP just changed.
As of September 11, 2026, every manufacturer placing an IP camera, NVR, or VMS on the EU market is legally bound to report to ENISA any actively exploited vulnerability within 24 hours. The fine: €15M or 2.5% of global annual turnover. Your next RFP question is no longer NDAA — it is the vendor's vulnerability-reporting SLA, in writing.
-
Twice this summer, a Flock Safety employee called 911 on someone who was filming a camera in public. The company's policy is now in the record.
On August 19, a Flock Safety technician in Milton, Georgia called 911 because an InvestigateTV reporter with a press vest was filming a camera on a public street. Three units pulled Keefe over; he was held 17 minutes and released without charge. On June 5, another Flock employee in Smyrna, Georgia called 911 on YouTubers filming the company's distribution center and told the dispatcher three times that they might be armed, without having seen weapons. Flock's official policy is now on the record — and it breaks the symmetry with the policy the company teaches its customers about deploying the cameras.
-
Sinclair, the Manhattan Institute, and CASE: the week a vendor under federal investigation assembled its media defense
Between Sep 8 and 9, a Sinclair news package ran on 40+ local TV markets, two op-eds appeared in the Manhattan Institute and The Atlantic, and a lobbying group with undisclosed funding published a report with a foreword by the former NSA director of cybersecurity — and no trade outlet is reporting the coordination.
-
Your ALPR camera isn't yours anymore. It's an endpoint on a federal pipeline that hides why it stopped you.
On Sep 2, 2026, Sen. Hawley expanded his federal investigation to Verkada, Axon and Motorola Solutions. Document production deadline: Sep 16. What started as a Flock audit now touches every ALPR camera deployed in the US.
-
Your camera records faces. The moment it reads them to identify, it stops being a camera — it becomes a regulated biometric system.
A camera that detects a face isn't the same as one that identifies it. Mexico, the EU, Illinois, Texas, Washington, Colorado and Brazil already impose fines and rules on facial recognition without express written consent. What looked like future-tense is now on your general counsel's desk.
-
Your business has security cameras. Mexican law says the footage is personal data.
In Mexico, every video frame where a face or any identifying trait is visible is personal data under LFPDPPP. INAI was extinguished on March 21, 2025 — authority moved to Secretaría Anticorrupción y Buen Gobierno. Fines range from 100 to 160,000 UMA. What you don't document today fines you tomorrow.
-
There is no OSHA camera standard. And that is exactly what puts your plant at risk.
There is no single OSHA rule called 'video surveillance.' What applies is a mosaic: General Duty Clause, NLRA, NOM-035 in Mexico, IEC 60529/62262 for hardware, and LFPDPPP for data. What you don't document today is what fines you tomorrow.
Explore the other pillars
- // P1 · REVIEWS CCTV camera reviews
Honest comparisons with datasheet specs and real cases.
- // P2 · OPERATIONS Operational best practices
Install, cabling, PoE, storage, maintenance.
- // P3 · INDUSTRY Industry use cases
Retail, QSR, gas stations, casinos, transit, cities.
- // P4 · COMPUTER VISION Computer Vision education
What AI on video is, how it works, what is next.
- // P6 · AI IN ACTION AI in action (real cases)
What you can actually measure today with AI on existing cameras.
Got more questions than answers on your next deployment?
Tell us what you are trying to measure. We respond within 48 business hours with an honest analysis of what works in 2026, what is marketing, and where the regulatory constraint actually sits.
Tell us your case →