The Texas Public Surveillance Technology Privacy, Security, and Accountability Act

Executive Summary

Automated license plate readers, networked cameras, facial-recognition systems, cell-site simulators, and other surveillance technologies can help police locate stolen vehicles, identify wanted suspects, find missing people, and respond more quickly to dangerous situations. They can process information at a speed and scale that no individual officer could match.

But that same scale creates a serious risk. A camera that helps find one stolen car may also record thousands of innocent drivers. A system designed to generate a narrowly targeted alert can become a searchable history of where people traveled, worshiped, sought medical care, attended political meetings, met with attorneys, or associated with others. A database intended for legitimate investigations can also be searched by an employee for personal reasons, exposed through a security failure, shared with distant agencies, or repurposed for a use that the public never approved.

These are not merely theoretical concerns.

In Kansas, the state commission responsible for police-certification standards found that a police chief used Flock Safety’s license-plate system to search for a former girlfriend’s vehicle 164 times and her boyfriend’s vehicle 64 times. He entered purported law-enforcement reasons such as “drug investigation” and “missing child,” but ultimately admitted that jealousy influenced his conduct. The commission revoked his law-enforcement certification (Kansas Commission on Peace Officers’ Standards and Training, 2024).

In Frisco, Texas, an officer mistakenly entered an Arkansas license plate as an Arizona plate. The incorrect return caused officers to believe that a family’s vehicle might be stolen and led to a high-risk traffic stop. A supervising sergeant identified the error and ended the stop, and the department publicly acknowledged the mistake and initiated a review (Frisco Police Department, 2023).

That Frisco incident was caused by erroneous human entry rather than an automated Flock match, but it demonstrates the danger of treating a database result as conclusive. A single incorrect state code was enough to transform an innocent family’s trip into a high-risk stolen-vehicle response. The proper lesson is not that officers should stop using vehicle information; it is that every automated or database-generated result must be verified before coercive action is taken.

Facial recognition presents the same problem at a different level. The National Institute of Standards and Technology found substantial variation among facial-recognition algorithms and documented demographic differences in false-positive rates across many systems. NIST also found that better-performing algorithms can reduce those differences, which means that accuracy depends heavily on the system, operating conditions, comparison process, and human review—not merely on whether a product is labeled “artificial intelligence” (National Institute of Standards and Technology, 2020).

The proposed Texas Public Surveillance Technology Privacy, Security, and Accountability Act responds to these risks without banning useful technology. It establishes a lawful-use framework built around several principles:

Government surveillance must serve a specific and documented public-safety purpose.
Real-time alerts may continue for stolen vehicles, valid arrest warrants, missing or endangered people, crimes in progress, emergencies, and active pursuits.
Historical searches must be narrow, documented, connected to an identified investigation, and supported by reasonable suspicion.
Broad or repeated movement tracking requires a warrant.
Facial recognition, biometric identification, and cell-site simulators generally require judicial authorization.
An automated alert or algorithmic match is an investigative lead—not proof of identity, probable cause, or guilt.
Searches must be assigned to individual users, connected to a case or authorized purpose, and preserved in tamper-evident audit records.
Innocent people’s data generally must be deleted within 30 days.
Government surveillance data may not be sold, commercially exploited, used for social scoring, or used to monitor lawful political, religious, journalistic, or associational activity.
Surveillance near houses of worship, polling places, medical facilities, schools, shelters, news organizations, and legal-service locations receives heightened protection.
Government bodies must publicly disclose the technologies they use, the companies involved, the data collected, retention periods, sharing arrangements, costs, security requirements, and material misuse findings.
Vendors do not acquire ownership or commercialization rights in data collected under a government contract.
Surveillance data must be protected with encryption, multifactor authentication, unique credentials, access controls, continuous logging, security testing, and incident reporting.
Officers and first responders acting in good-faith reliance on valid policies, warrants, court orders, or supervisory directions receive express protection.
Individuals, agencies, vendors, and contractors that knowingly misuse the systems face meaningful discipline, civil liability, contract consequences, and—in serious cases— criminal penalties.

The bill’s central distinction is simple: detecting a known stolen vehicle in real time is not the same as reconstructing an innocent person’s movements for weeks or months. Searching for an abducted child is not the same as searching for a former romantic partner. Using a warrant to locate a known violent suspect is not the same as scanning every face in a crowd. The law should recognize those differences.

Available evidence supports this balanced approach. A randomized experiment conducted with the Mesa Police Department found that license-plate readers allowed officers to check eight to ten times as many plates, produced nearly three times as many stolen-vehicle hits, and resulted in approximately twice as many vehicle recoveries as manual checking and ordinary patrol. However, the study did not establish that the ALPR deployment itself produced a broader reduction in auto theft during the tested period (Office of Justice Programs, 2011).

A later analysis of two randomized experiments similarly found that license-plate readers increased the likelihood of detections, arrests, and recoveries, but the outcomes were generally rare and only the increase in detections was statistically significant. That evidence supports describing ALPRs as useful investigative tools, not as a proven universal solution to crime (National Institute of Justice, 2018).

The goal of this legislation is therefore neither unrestricted surveillance nor a technology ban. It is to preserve legitimate public-safety capabilities while establishing enforceable boundaries that protect innocent Texans, honest peace officers, local governments, criminal investigations, and the integrity of evidence.

Video

Protecting Your Rights While Giving Law Enforcement Real Tools to Reduce Crime

Will Campbell - Candidate for Texas House, HD109

The Technology Has Two Sides

An automated license plate reader uses a camera and optical-character-recognition software to capture a vehicle image, interpret the plate, record the date and location, and compare the result with lists of vehicles connected to an authorized purpose. Depending on the product, a system may also record vehicle color, make, model, direction of travel, distinguishing features, and related metadata.

That information can be valuable when police have a legitimate reason to identify a particular vehicle. A real-time alert may tell officers that a verified stolen vehicle just passed a camera. Historical records may help investigators identify a vehicle described by the victim of a robbery. Similar tools may help locate a missing senior citizen, an abducted child, a wanted violent offender, or a vehicle connected to an active criminal investigation.

The Frisco Police Department’s published policy illustrates several rights-respecting safeguards already being used by a Texas agency. Frisco states that its scans are kept for 30 days unless preserved for a case, that users must document a legitimate law-enforcement purpose for each query, that searches are audited, and that the agency owns the data and does not sell it to third parties (Frisco Police Department, n.d.).

Frisco’s report for the first half of 2025 recorded 38,644 alerts, 14,154 searches, 54 arrests, and four warrants issued. Importantly, the report warns that its alert total includes unconfirmed alerts caused by misread or obscured plates. That qualification matters because an alert count is not an arrest count, a crime count, or proof that every alert correctly identified a vehicle (Frisco Police Department, 2025a).

The same agency has documented a concrete success. In December 2025, Frisco reported that an ALPR alert identified a stolen vehicle. Officers located it, attempted a stop, and later arrested the alleged driver after a pursuit and barricade response. The suspect was taken into custody without incident after deployment of officers, negotiators, a police canine unit, a drone unit, and state air support (Frisco Police Department, 2025b).

That is the kind of targeted use the bill preserves: a particular vehicle had been reported stolen, the alert occurred in real time, officers corroborated the vehicle’s presence, and the technology supported an active operation.

The concern arises when the same collection system stores the movements of every vehicle that passes—not merely vehicles tied to criminal activity. Those records can then be searched later, combined across jurisdictions, analyzed for patterns, or used for purposes that were never presented to the public.

The Congressional Research Service reports that courts have often treated license plates visible in public differently from long-term cellular-location information, and several courts have concluded that the ALPR searches before them did not constitute Fourth Amendment searches. That means constitutional doctrine alone may not establish detailed rules for retention, access, auditing, data sharing, or vendor conduct. State legislation can provide those operational safeguards without waiting for every question to be resolved through years of litigation (Congressional Research Service, 2025).

Why Statewide Rules Are Needed

Personal misuse is documented

The Kansas certification case shows how a powerful government system can be redirected toward a personal obsession. The official order found that the police chief searched his former girlfriend’s plate 164 times and her boyfriend’s plate 64 times over several months. The search reasons entered into the system included law-enforcement terms, but the chief later admitted that jealousy influenced his actions (Kansas Commission on Peace Officers’ Standards and Training, 2024).

That case establishes several important points.

First, requiring users to type a justification is helpful, but it is not sufficient. A user intent on abusing a system can enter a false reason.

Second, an audit log is useful only if someone reviews it. Repeated searches for the same people, unusually frequent after-hours activity, or searches unrelated to assigned duties should generate an automatic warning and a supervisory response.

Third, rules need consequences. A policy that says “authorized use only” has limited deterrent value if knowing abuse produces no mandatory investigation, access revocation, referral, or penalty.

Sections 424.054, 424.101, 424.107, 424.155, and 424.202 of the proposed act address these failures directly. They prohibit stalking, harassment, retaliation, personal-interest searches, and other unauthorized purposes; require an identified case or lawful objective; prohibit shared or anonymous accounts; require detailed query records; direct systems to flag repeated or unusual searches; and mandate investigation and proportionate discipline.

Database errors can escalate quickly

The Frisco mistaken-stop incident demonstrates how rapidly incorrect information can change an officer’s response. Because the officer entered the Arkansas plate as an Arizona plate, the returned information suggested that the vehicle might be stolen. Officers then conducted the kind of high-risk stop normally associated with a stolen vehicle before a supervisor caught the mistake (Frisco Police Department, 2023).

Technology cannot eliminate human error, and adding automation can create additional failure points: an obscured plate, a stale hotlist entry, a duplicate plate number, a system configuration error, or an incorrect association between a vehicle and a person. Frisco’s own usage report expressly notes that its alert totals include misreads and obscured plates (Frisco Police Department, 2025a).

Section 1.02 of the bill therefore provides that an automated match, alert, classification, or inference may not by itself establish identity, probable cause, guilt, or the basis for adverse action. Sections 424.104 and 424.153 impose the same principle on biometric and artificial-intelligence outputs: trained human review and independent corroboration are required.

This protects citizens, but it also protects officers. When the law clearly instructs an officer to verify a plate and corroborate an alert, the officer has a defined professional procedure rather than being left to determine independently how much confidence to place in a vendor’s algorithm.

Network sharing can outgrow local control

Flock describes several types of interagency sharing, including one-to-one arrangements and an optional National Lookup function. The company states that agencies select their own sharing settings and that each search is preserved in an audit record. Flock also acknowledges that such auditing is not legally required in most jurisdictions (Flock Safety, 2025).

Interagency cooperation can be necessary. A kidnapped child, stolen vehicle, trafficking suspect, or violent offender may cross city or state lines. A system that stops working at a municipal boundary would lose some of its most important public-safety value.

But interagency access also needs limits. Public-record research by the University of Washington Center for Human Rights found that local Washington ALPR networks were accessed by federal and out-of-state agencies through several sharing pathways during 2025. The researchers reported thousands of Border Patrol searches across multiple local networks and identified instances in which local agencies searched on behalf of federal immigration authorities (University of Washington Center for Human Rights, 2025).

The same report and related public-record findings identified a Johnson County, Texas, search whose recorded reason concerned a woman believed to have self-administered an abortion. The accessible records demonstrate the search and stated reason, but the materials reviewed for this article do not independently establish every underlying fact, the full investigative context, or a final legal determination that the search violated a particular person’s rights. It is therefore best understood as a warning about how a nationwide query can move far beyond the local stolen-vehicle and violent-crime scenarios commonly presented when these systems are adopted (University of Washington Center for Human Rights, 2025).

Sections 424.108 and 424.107 address this problem without ending interagency cooperation. Another governmental body may receive data only for an authorized purpose, must agree to comply with the act, and must be identified in the audit log. Each disclosure must state its recipient and legal basis. Routine bulk access to a private database requires a warrant, court order, or publicly approved government contract.

Surveillance can reveal protected activity

A vehicle’s location can reveal more than transportation. Repeated observations may indicate attendance at a church, mosque, synagogue, campaign office, political meeting, medical clinic, domestic-violence shelter, attorney’s office, newsroom, polling place, or addiction-treatment program.

The International Association of Chiefs of Police recognized this problem in an early privacy assessment, observing that mobile readers may collect plates at sensitive locations such as doctors’ offices, clinics, churches, and addiction-counseling meetings. That concern was quoted in litigation seeking federal ALPR records (American Civil Liberties Union, 2012).

The risk of surveillance being directed toward protected religious activity is historically documented. Records obtained by the Associated Press showed that the New York Police Department photographed mosques, recorded license plates of people arriving to worship, mapped Muslim institutions, and compiled reports concerning lawful religious and political discussions (Associated Press, 2012).

The proposed act does not prohibit legitimate investigation merely because a suspect travels near a sensitive location. Instead, Section 424.106 requires a probable-cause warrant identifying the known suspect, explaining the active investigation, showing why the surveillance is necessary, limiting its geographic scope and duration, and describing how officers will minimize the collection of information about non-targets.

That rule protects both constitutional activity and legitimate investigations. If police have probable cause to believe that a known violent suspect will appear at a sensitive location, they can seek judicial authorization. What government may not do is treat everyone entering a church, clinic, campaign office, shelter, or attorney’s office as a potential investigative subject.

What the Act Covers

The act is deliberately technology-neutral. A law limited to one brand or one type of camera could become obsolete as soon as vendors add new sensors, analytical features, or software.

The proposed Chapter 424 covers:

Automated license plate readers and vehicle-recognition systems.
Vehicle “fingerprinting” based on color, model, damage, decals, cargo, racks, or other characteristics.
Persistent public-space video networks.
Cross-camera tracking and person re-identification.
Facial recognition and other biometric recognition.
Gait, voice, behavioral, and body-based identification.
Cell-site simulators and wireless-device identification.
Systems collecting Wi-Fi, Bluetooth, IMSI, IMEI, MAC-address, or similar identifiers.
Thermal, infrared, radar, lidar, acoustic, and sensor-fusion systems when their output is associated with a person, vehicle, residence, device, location, or activity.
Artificial-intelligence systems that classify, infer, associate, score, predict, or track people, vehicles, or devices.
Successor systems that perform substantially similar functions.

The act also covers derived information. That is important because deleting a source image does little good if a vendor retains the travel history, association map, face template, prediction, alert, profile, or search index produced from it.

What the Act Does Not Cover

The legislation does not convert every doorbell camera or business-security camera into a regulated public-surveillance system.

A homeowner remains free to use an ordinary residential camera. A business may use cameras for security, access control, parking management, safety, loss prevention, and documentation of a specific incident. A resident or business may voluntarily give police a recording of a burglary, assault, vehicle theft, or other incident.

The act applies additional obligations when a private system is transformed into part of a searchable government or commercial surveillance network. The dividing line is not whether a camera incidentally sees a sidewalk or street. The dividing line is whether the system provides automatic, routine, bulk, real-time, or searchable access; aggregates observations for identification or persistent tracking; commercializes the data; or operates as an agent of government.

Enrollment in a government-connected or neighborhood surveillance program must be voluntary, informed, affirmative, and documented. A city may not use prechecked consent, condition an unrelated public benefit on participation, or claim that enrollment automatically eliminates constitutional and statutory limits on government searches.

Public Approval Before Deployment

Surveillance systems are often acquired through ordinary purchasing processes even though their long-term effects extend beyond the purchase of equipment. A contract may determine which company stores the data, how long it is kept, which agencies can search it, whether new analytical features may be activated, and whether the vendor can use the information for other purposes.

Section 424.051 requires public approval before a governmental body acquires, deploys, materially expands, materially renews, or activates a significant new capability. The agency must publish:

The proposed use and public-safety purpose.
The vendor and proposed contract.
The kinds of data collected or generated.
The retention period.
Data-sharing and government-access arrangements.
Hosting and storage locations.
Security requirements.
Expected cost and funding source.
Reasonably available alternatives.
Effects on privacy, speech, association, religion, voting, journalism, and legal representation. Measures protecting non-targets and sensitive locations.
The reason less intrusive means are inadequate.

The governing body must then accept public comment at an open meeting and approve the deployment by an affirmative vote. Approval expires with the contract or after five years, whichever occurs first, requiring elected officials to reconsider whether the system remains justified.

Emergency deployment remains available when immediate action is necessary to prevent imminent death or serious bodily injury. But emergency authority cannot become permanent procurement by inertia: continued use beyond 90 days requires the regular approval process.

A Public Registry

Section 424.052 requires each governmental body to maintain an updated public registry describing its surveillance systems. The registry must identify the technology, vendor, general deployment area, owner, operator, authorized purpose, capabilities, data categories, retention period, sharing arrangements, hosting providers, contract terms, approval documents, audits, substantiated misuse findings, security incidents, and corrective actions.

The registry allows narrow redactions when necessary to protect an active investigation, a specific security vulnerability, or information made confidential by law. It does not require the public release of tactical details that would tell a criminal how to evade detection.

The purpose is democratic accountability. Residents should not need specialized technical knowledge, repeated public-information requests, or investigative reporting to learn whether their city has activated facial recognition, joined a nationwide plate-search network, granted a vendor remote access, or extended data retention from 30 days to one year.

Three Use Tiers

The act assigns surveillance technologies to three tiers according to their capability and intrusiveness.

Tier 1: Defined-site video

Tier 1 includes ordinary fixed video protecting a defined public facility or government property when the system is not configured for biometric identification, wireless-device collection, cross-camera tracking, or persistent location tracking.

These systems remain subject to approval, security, retention, audit, no-sale, and accountability requirements, but they are not treated as though an ordinary courthouse security camera were equivalent to a cell-site simulator.

Tier 2: Identification and tracking

Tier 2 includes ALPRs, vehicle fingerprinting, persistent public-space video, object recognition, cross-camera tracking, person re-identification, and location-history analysis.

Tier 2 tools may be used only for a documented case, incident, alert, or authorized purpose. Searches require query-level documentation, audit records, and supervision.

Tier 3: Highly sensitive identification

Tier 3 includes facial recognition, other biometric recognition, cell-site simulators, wireless-device collection, communications-content capture, device-content capture, and comparable technologies.

These tools may be used only under the specific authorization established for them—generally a judicial warrant, with narrow emergency or active-pursuit exceptions.

This tiered approach avoids two extremes. It does not pretend that every camera presents the same risk, and it does not exempt an intrusive system merely because a vendor calls it a camera.

Authorized Purposes

Section 424.101 limits access to identifiable public-safety purposes:

A specific investigation supported by reasonable suspicion.
Execution of a warrant, court order, subpoena, or other lawful process.
A missing-person, endangered-person, or abduction investigation.
Recovery of a stolen vehicle or other stolen property.
An emergency involving imminent death, serious injury, abduction, or a dangerous escape.
Location of a person subject to a valid arrest warrant.
Another purpose expressly authorized by law and consistent with the act.

The bill expressly rejects generalized law-enforcement interest, curiosity, and personal interest as authorized purposes.

This would have provided a clear statutory answer in the Kansas misuse case. Searching repeatedly for an ex-partner out of jealousy is not transformed into a legitimate investigation by selecting “drugs” or “missing child” from a menu. The search must correspond to an actual documented matter, and the audit system must be capable of testing that connection.

Historical Searches

Historical data can be valuable. Suppose a victim reports that a dark pickup with a damaged rear bumper fled a robbery scene. A narrowly tailored search of nearby cameras for the relevant place and time may identify a lead even when the victim did not see the plate.

Section 424.102 allows such searches without a warrant when they are:

Supported by reasonable suspicion.
Connected to an identified offense, missing person, stolen vehicle, stolen property, or documented active investigation.
Limited to the target, location, and period reasonably necessary.
Recorded and approved by a supervisor.

A warrant is required when a search becomes broad, extended, or repeated enough to reconstruct movements beyond the needs of the investigation; when it concerns a sensitive location; or when another law already requires a warrant.

This draws a workable line between investigation and mass tracking. A search for a robbery suspect’s vehicle during a defined two-hour period near the crime scene is materially different from assembling months of travel history for a person who has not been connected to a crime.

The courts have not supplied a single nationwide rule governing every possible ALPR search. The Congressional Research Service notes that federal courts have often distinguished ALPR records from the long-term cellular-location information addressed in other privacy cases (Congressional Research Service, 2025). That legal uncertainty makes a clear Texas statute more— not less—important. (Congressional Research Service, 2025)

Real-Time Alerts

Section 424.103 preserves real-time alerts when an officer could lawfully act on the same facts if personally observed in public. Permitted alerts include:

A verified stolen vehicle.
A crime in progress.
A valid arrest warrant.
A missing, abducted, endangered, or vulnerable person.
An immediate and articulable threat.
An active pursuit or documented operation.

The alert must identify a known vehicle, person, or device; operate only as long as reasonably necessary; and be disabled when its factual basis ends.

The Mesa randomized experiment supports this focused use. ALPR-equipped officers checked eight to ten times as many plates, obtained nearly three times as many stolen-vehicle hits, and recovered about twice as many vehicles as officers relying on manual checks and ordinary patrol (Office of Justice Programs, 2011).

But the experiment did not show that ALPR deployment alone reduced auto theft across the tested area. A later randomized analysis found that detections improved significantly, while arrests and recoveries remained comparatively rare and their estimated differences were not statistically significant (National Institute of Justice, 2018).

The evidence therefore supports targeted operational use more strongly than sweeping claims that more cameras automatically produce less crime.

Facial Recognition

Facial recognition can produce candidate matches far more quickly than traditional manual comparison. It can also produce false matches, particularly when images are poor, the reference database is unsuitable, or investigators treat the output as proof.

NIST’s testing found wide performance differences among algorithms. It also found demographic differentials in many systems, including higher false-positive rates for several demographic groups, while noting that some higher-performing algorithms produced smaller differentials (National Institute of Standards and Technology, 2020).

Robert Williams’s wrongful arrest in Detroit became a prominent example of the consequences of overreliance on a false match. A subsequent settlement required safeguards including independent evidence and prohibited lineups based solely on facial-recognition leads (American Civil Liberties Union of Michigan, 2025).

Section 424.104 adopts comparable principles:

Facial and biometric recognition must remain disabled unless authorized by a judicial warrant.
The warrant must concern a known suspect and an active investigation or operation.
Generalized scanning, continuous crowd identification, and reverse-image searching of the public are prohibited.
A match is only an investigative lead.
Human review and independent corroboration are mandatory.
Nonresponsive images, templates, embeddings, candidate lists, and search outputs must be deleted promptly.

This does not prohibit police from using facial recognition to locate a known dangerous suspect when a judge finds probable cause. It prevents government from continuously identifying everyone who passes a camera and prevents an algorithm from becoming the sole basis for arrest.

Wireless Devices and Cell-Site Simulators

A cell-site simulator impersonates a cellular tower and causes nearby phones to connect or reveal identifying information. Because the technology interacts with devices in an area rather than only with a target, it can also collect information associated with non-target phones.

The U.S. Department of Justice adopted a policy requiring federal agents to obtain a probable-cause warrant before using a cell-site simulator, subject to limited exigent or exceptional circumstances. The policy also requires applications to identify the technology being used and imposes minimization and deletion requirements (U.S. Department of Justice, 2015).

Section 424.105 establishes a comparable Texas rule. Wireless-device collection and cell-site simulators generally require a warrant. A narrow exception applies during an active pursuit of a known violent offender or fugitive when immediate apprehension is necessary to prevent death or serious injury. Continued use must be brought before a judge as soon as practicable.

Communications content, phone-screen content, and stored device content require a warrant. Non-target data must be minimized, segregated, and promptly deleted, and the warrant return must disclose what was collected and what was deleted.

Data Retention and Deletion

A system designed to alert on stolen vehicles does not need to preserve every innocent driver’s movements forever.

Section 424.151 establishes a general 30-day retention ceiling. Data may be kept longer only when associated with a documented investigation, prosecution, warrant, court order, missing-person case, stolen-property investigation, emergency, litigation hold, preservation obligation, or suspected violation of the act. The data must be deleted when that basis ends.

Frisco already reports using a 30-day period for ordinary scans, with preservation for specific cases (Frisco Police Department, n.d.). The bill turns that kind of local safeguard into a statewide baseline. (Frisco Police Department, n.d.)

Deletion must also be meaningful. If immediate removal from a backup is technically impossible, the information must be isolated from ordinary restoration or use and deleted during the first feasible backup rotation. Completion must be documented.

No Sale or Commercial Exploitation

Section 424.152 prohibits the sale, licensing, rental, exchange, subscription access, monetization, or independent commercial use of covered surveillance data. The prohibition applies whether compensation is monetary, reciprocal, in-kind, contingent, or otherwise valuable.

A vendor hired to operate government cameras is a service provider, not the owner of Texans’ movement histories. Sections 424.003 and 424.152 make the governmental body the controlling party and deny the vendor any independent right to use the data for advertising, product development, unrelated analytics, or commercial resale.

This restriction survives the end of the contract. A company may not wait until its public contract expires and then claim an independent right to reuse the accumulated data.

Artificial Intelligence

The act does not pretend that all machine learning is inherently harmful. Product-specific testing can improve plate-reading accuracy, detect errors, strengthen security, and reduce false matches.

Section 424.153 permits limited use of covered data to improve the specific surveillance product when:

The model belongs to the operator of that product.
The use is necessary for accuracy, reliability, error detection, bias testing, security, or lawful functionality.
The data is not transferred to a third-party AI developer.
The information is not used for a generalized commercial model, advertising model, consumer profile, or unrelated product.
The governmental body gives written approval.
Security, residency, logging, deletion, and access restrictions remain in force.
Data is minimized and de-identified where practicable.

AI outputs remain investigative leads. They cannot independently establish identity, guilt, probable cause, culpability, or another adverse consequence.

American Data Control

Section 424.154 requires covered data to be stored, processed, backed up, indexed, administered, and remotely accessed within the United States. The requirement extends beyond the main database to backups, caches, exports, test environments, support systems, telemetry, logs, and model-training datasets.

Government contracts must be made with qualifying United States business entities, and vendors, hosts, subcontractors, affiliates, and remote-support providers with access to covered data may not have prohibited foreign ownership or control. Exceptions are limited to circumstances required by controlling federal law or comparable federal obligations and must be documented publicly.

This provision recognizes that data residency is not merely the address of the primary server. A database can be stored in Texas while being backed up, analyzed, or remotely administered from another country. The act requires agencies to account for the entire data chain.

Cybersecurity

Surveillance databases are valuable targets because they may contain plate numbers, locations, images, identifiers, hotlists, account credentials, exports, and investigative records.

In 2024, the U.S. Cybersecurity and Infrastructure Security Agency published an advisory concerning Motorola Vigilant fixed license-plate-reader equipment. CISA identified vulnerabilities involving authentication bypass, cleartext storage, hard-coded or insufficiently protected credentials, missing encryption, and replay attacks. CISA stated that successful exploitation could permit access to sensitive information or enable device tampering, although it reported no known public exploitation targeting the identified vulnerabilities at that time (Cybersecurity and Infrastructure Security Agency, 2024).

Section 424.155 therefore requires:

Encryption in transit and at rest.
Encryption for backups, exports, logs, removable media, and edge devices.
Multifactor authentication.
Unique credentials and role-based access.
Least-privilege permissions.
Separation of administration and auditing functions.
Network segmentation.
Tamper-evident logs kept for at least five years.
Automated detection of bulk, repeated, geographic, after-hours, and unusual searches.
Vulnerability management and timely patching.
Annual independent security assessments and penetration testing.
Supply-chain controls.
Incident-response and continuity plans.
Secure deletion.
Contractual application of the same safeguards to subcontractors and data hosts.

These requirements protect citizens’ information, but they also protect investigations. A compromised camera, altered log, leaked hotlist, or stolen credential can endanger officers, expose investigative methods, undermine evidence, and create liability for the agency.

Security-Incident Reporting

Section 424.156 requires immediate containment and investigation when an operator loses data, cannot account for it, or discovers unauthorized access, alteration, disclosure, or acquisition.

The contracting agency must be notified within 24 hours. The Department of Information Resources and attorney general must generally be notified within 72 hours. Relevant logs and evidence must be preserved, and a corrective-action report must follow. Affected people receive notice when existing Texas breach law requires it or when the attorney general determines that the misuse creates a material risk of harm.

Operators must also certify their data locations, hosting regions, data centers, affiliates, subcontractors, support providers, possible access locations, security incidents, deletion practices, and ownership changes every year.

The agency must conduct quarterly user-access recertification and an annual audit of searches, exports, historical queries, disclosures, deletion, vendor compliance, and adherence to the approved use tier.

Accountability and Enforcement

Rules matter only if violations can be detected and corrected.

Annual reporting

Each governmental body must publish annual totals for searches, historical queries, alerts, exports, disclosures, emergency access, misuse allegations, substantiated violations, disciplinary actions, security incidents, contract actions, corrective measures, and deleted data.

These figures must be interpreted carefully. Frisco’s report, for example, notes that alert totals include unconfirmed misreads. Reporting should therefore distinguish an automated alert from a verified hit, an investigative lead, an arrest, a charge, and a conviction (Frisco Police Department, 2025a).

Complaints and whistleblowers

Agencies must maintain a process for receiving, documenting, investigating, and resolving complaints. Good-faith whistleblowers receive protection from retaliation.

Discipline

Negligent violations require correction and retraining. Knowing or repeated violations can result in suspension, termination, access revocation, contract termination, criminal referral, or referral to the Texas Commission on Law Enforcement. Relevant records must be preserved.

Civil remedies

A person may seek declaratory or injunctive relief to enforce the statute without first proving that the government collected that particular person’s data. Someone whose information was knowingly misused may recover proven direct economic damages and statutory damages between $1,000 and $5,000 per violation, subject to notice requirements, limitation periods, consolidation, and protections against duplicative recovery.

Attorney-general enforcement

The attorney general may seek civil penalties of $5,000 to $25,000 for a knowing violation and $25,000 to $100,000 for a pattern or practice. Courts may order deletion, remediation, compliance monitoring, function-specific suspension, contract termination, cost recovery, and debarment. Penalties are directed to the compensation-to-victims-of-crime fund.

Contract remedies

Government contracts must be suspended or terminated when an operator knowingly or repeatedly violates the act, falsely certifies compliance, refuses a lawful audit, permits prohibited foreign access, or fails to delete data. The comptroller may debar a noncompliant operator from covered state contracts for up to five years after notice and a hearing.

Criminal offenses

Knowing unlawful access, use, retention, disclosure, sale, or provision of surveillance data is generally a Class A misdemeanor. More serious conduct becomes a state jail felony when committed for financial gain, involving at least 50 people, vehicles, or devices, to facilitate stalking or violence, or through falsification or destruction of audit records. Conduct facilitating another felony or involving the knowing sale or disclosure of data concerning at least 1,000 people, vehicles, or devices can become a third-degree felony.

The penalties focus on culpable conduct. The act preserves a defense for reasonable reliance on apparently valid legal process unless the person knew the conduct was unlawful.

Protecting Good-Faith Officers

A privacy law should distinguish between deliberate misuse and an officer who acts reasonably under a lawful policy or valid direction.

Section 424.209 provides that the act does not create an individual damages claim against a peace officer, firefighter, emergency medical worker, or other first responder who acts in good-faith reliance on a facially valid policy, warrant, court order, legal process, or supervisory instruction—unless the individual knows that the conduct is unlawful.

That protection is essential. The purpose of the law is not to punish an officer for responsibly using an approved tool during a stolen-vehicle alert, missing-child search, emergency, or active investigation. The law is designed to make the boundaries clear, train users, identify misuse, and direct liability toward knowing misconduct and organizational failures.

Evidence and Due Process

Section 424.208 requires knowingly unlawfully obtained or maintained data to be deleted or segregated while a lawful decision is made concerning preservation or evidentiary use. Evidence obtained in violation of the act remains subject to Texas Code of Criminal Procedure Article 38.23 to the extent that article applies.

Unlawfully maintained data may not be used to impose a governmental penalty, revoke a license, terminate a benefit, or create civil liability unless an independent lawful source, inevitable discovery, or another recognized rule permits the use.

Section 424.207 also makes clear that a civil or administrative finding does not establish criminal guilt. It does not create collateral estoppel, eliminate the presumption of innocence, or reduce the state’s burden of proof.

These provisions protect both sides of the justice system: government may not profit from knowing misuse, but an administrative finding is not converted automatically into a criminal conviction.

Local Control

Section 424.251 permits a city, county, or other political subdivision to adopt stronger privacy, retention, security, transparency, or accountability protections. A local rule may not disable compliance with a valid statewide missing-person, stolen-vehicle, or emergency-alert system.

This establishes a statewide floor while preserving local authority. A Texas community may decide that its circumstances justify a shorter retention period, narrower deployment, additional public reporting, or stronger security. But local action cannot prevent officers from participating in legitimate statewide emergency systems.

Implementation

The bill uses a phased transition rather than demanding immediate replacement of every system.

By September 1, 2027, governmental bodies must:

Inventory covered systems, features, vendors, hosts, subcontractors, data flows, retention settings, and access pathways.
Suspend prohibited sales, monetization, and routine access to private databases.
Disable facial recognition, biometric recognition, wireless-device collection, communications-content collection, behavioral analytics, and cross-camera tracking unless properly authorized.
Publish the public registry.
Submit initial ownership and data-location certifications.
Adopt the required policies.

The relevant state agencies must adopt initial cybersecurity, use, training, supervision, and documentation rules by the same date.

Existing systems and contracts must reach full compliance by September 1, 2028. Contracts renewed, extended, or materially modified after September 1, 2027, must comply at that time.

Governmental bodies must report completion to state oversight agencies by October 1, 2028.

The substantive changes apply prospectively to conduct occurring on or after September 1, 2028. This gives agencies, vendors, and local governments time to modify contracts, relocate data, disable unauthorized features, train employees, and build the required audit systems.

Measuring Effectiveness Honestly

A sound surveillance policy should require evidence rather than slogans.

The randomized Mesa study provides credible support for one specific conclusion: ALPRs can substantially increase the number of plates checked and improve the detection and recovery of stolen vehicles. It does not establish that every fixed-camera network reduces overall crime or that every additional camera produces the same marginal benefit (Office of Justice Programs, 2011).

The later randomized hot-spot analysis similarly found improved detections but emphasized that arrests and recoveries were rare outcomes and that only the detection effect reached statistical significance (National Institute of Justice, 2018).

RAND found that license-plate readers can save investigative time and improve officer awareness, while also identifying unresolved issues involving staffing, interoperability, retention, access, privacy, and data sharing. RAND recommended that departments address privacy and operational rules as part of implementation rather than as an afterthought (RAND Corporation, 2014).

Accordingly, agencies should report outcomes in distinct categories:

Total observations.
Automated alerts.
Alerts verified as accurate.
False or unconfirmed alerts.
Investigative searches.
Searches producing a relevant lead.
Vehicles or property recovered.
Missing or endangered people located.
Arrests.
Charges.
Warrants.
Cases cleared.
Convictions.
Complaints and substantiated misuse.
Cost per verified investigative result. Without these distinctions, a large number of alerts may be presented as a large number of crimes solved even though those are not equivalent measures.

The Governing Principle

Texas should not force communities to choose between effective policing and constitutional liberty.

Police should be able to receive a narrowly targeted alert when a stolen vehicle enters the city. They should be able to use a specific vehicle description to investigate a robbery. They should be able to search for an abducted child, an endangered senior citizen, or a wanted violent offender. They should be able to respond immediately when human life is in danger.

But government should not build unlimited travel histories for innocent people, scan every face in a crowd, search a former romantic partner, hide surveillance capabilities from elected officials, sell public data, permit uncontrolled nationwide access, or treat an algorithmic output as proof of guilt.

The Texas Public Surveillance Technology Privacy, Security, and Accountability Act establishes that distinction in enforceable law. It preserves targeted public-safety uses, requires judicial authorization for the most intrusive capabilities, protects sensitive locations and private systems, imposes security and deletion rules, creates public transparency, holds vendors and deliberate abusers accountable, and protects officers who act in good faith.

The objective is not less effective law enforcement. It is more disciplined, trustworthy, constitutional, and defensible law enforcement—supported by technology that serves Texans rather than quietly tracking them.

Provision-to-Problem Guide

Documented risk, statutory response, and lawful capability preserved

Bill provision	Problem addressed	Documented example	Lawful use preserved
Public approval and impact reports	Surveillance capabilities can be acquired without meaningful public understanding	Network functions may include national searches and interagency sharing beyond the immediate camera owner (Flock Safety, 2025) (Flock Safety, 2025)	Emergency deployment for imminent threats, followed by approval if use continues
Public registry	Residents may not know the system’s capabilities, vendor, retention, or sharing settings	Public-record research identified access pathways not apparent from ordinary local descriptions (University of Washington Center for Human Rights, 2025) (University of Washington Center for Human Rights, 2025)	Narrow redactions for active investigations and genuine security vulnerabilities
Authorized-purpose requirement	Users may search for curiosity, jealousy, or personal reasons	Kansas chief searched an ex-partner and her boyfriend 228 times in total (Kansas Commission on Peace Officers’ Standards and Training, 2024) (Kansas Commission on Peace Officers’ Standards and Training, 2024)	Specific investigations, warrants, emergencies, missing people, stolen property, and wanted persons
Unique accounts and detailed search records	False reasons can be entered, and shared credentials obscure responsibility	The Kansas searches carried purported investigative labels despite a personal motive (Kansas Commission on Peace Officers’ Standards and Training, 2024) (Kansas Commission on Peace Officers’ Standards and Training, 2024)	Every legitimate user retains access under an individually attributable account
Human verification	Incorrect inputs or automated readings can trigger coercive responses	Wrong-state entry led to a high-risk stop of an innocent family in Frisco (Frisco Police Department, 2023) (Frisco Police Department, 2023)	Verified alerts remain available as investigative leads
Historical-query limits	Stored observations can reconstruct movements beyond a specific case	Courts have not established one uniform constitutional rule for every ALPR search (Congressional Research Service, 2025) (Congressional Research Service, 2025)	Narrow searches based on reasonable suspicion remain available without a warrant
Real-time alerts	A total ban would eliminate a demonstrated stolen-vehicle capability	Randomized testing found more scans, hits, and recoveries with ALPR use (Office of Justice Programs, 2011) (Office of Justice Programs, 2011)	Crimes in progress, verified stolen vehicles, arrest warrants, emergencies, and missing-person alerts
Sensitive-location warrants	Location records can disclose worship, medical treatment, legal services, and political association	NYPD records documented photography and plate collection at mosques (Associated Press, 2012) (Associated Press, 2012)	Targeted surveillance of a known suspect remains possible with probable cause
Facial-recognition warrant and corroboration	False matches can contribute to wrongful arrests	Robert Williams was wrongfully arrested following a false facial-recognition lead (American Civil Liberties Union of Michigan, 2025) (American Civil Liberties Union of Michigan, 2025)	Warrant-authorized use to locate a known suspect, with independent evidence
Wireless-device warrants	Cell-site simulators can affect non-target devices and reveal precise location	DOJ adopted a probable-cause warrant policy with limited emergency exceptions (U.S. Department of Justice, 2015) (U.S. Department of Justice, 2015)	Immediate pursuit and life-threatening emergencies remain covered
Thirty-day deletion	Innocent observations can otherwise become long-term movement histories	Frisco already uses a 30-day ordinary retention period (Frisco Police Department, n.d.) (Frisco Police Department, n.d.)	Case-related evidence may be preserved as long as its lawful basis continues
Security standards	Camera equipment and databases can contain exploitable vulnerabilities	CISA identified authentication, credential, and encryption weaknesses in covered equipment (Cybersecurity and Infrastructure Security Agency, 2024) (Cybersecurity and Infrastructure Security Agency, 2024)	Securely operated systems remain available
Annual audits and anomaly detection	Audit logs do little if no one reviews unusual behavior	The Kansas misuse continued through repeated searches over several months (Kansas Commission on Peace Officers’ Standards and Training, 2024) (Kansas Commission on Peace Officers’ Standards and Training, 2024)	Routine legitimate work proceeds while anomalies receive review
Good-faith first-responder protection	Officers should not face personal liability for reasonable reliance on valid authority	Frisco’s mistaken stop was acknowledged, reviewed, and used to reinforce training (Frisco Police Department, 2023) (Frisco Police Department, 2023)	Good-faith reliance on policy, warrants, legal process, and supervision is protected

Proposed Legislation

Complete legislative text for review, printing, and download

House BillTexas Public Surveillance Technology Privacy, Security, and Accountability Act

90th Legislature • H.B. No. _____ • Rep. Will Campbell • HD 109

By: CampbellH.B. No. _____

A BILL TO BE ENTITLED

AN ACT

relating to the acquisition, deployment, collection, use, retention, security, disclosure, and accountability of certain public surveillance technology and public-place observation data; creating criminal offenses and civil remedies; providing administrative enforcement and civil penalties.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

ARTICLE 1. GENERAL PROVISIONS

SECTION 1.01. SHORT TITLE. This Act may be cited as the Texas Public Surveillance Technology Privacy, Security, and Accountability Act.

SECTION 1.02. PURPOSE AND CONSTRUCTION. (a) The purposes of this Act are to:

(1) permit accountable public-safety uses of surveillance technology to protect life, respond to emergencies, locate missing or endangered persons, recover stolen property, and investigate criminal offenses;

(2) protect Texans from warrantless mass tracking, unauthorized identification, unauthorized device surveillance, commercial exploitation, foreign access, and misuse of data generated by surveillance technology;

(3) preserve the ability of peace officers and first responders to use narrowly tailored, lawfully authorized tools while protecting honest personnel, agencies, investigations, and evidence from misuse by an individual user, contractor, or vendor;

(4) prevent a governmental body from outsourcing, purchasing, receiving, or accessing surveillance data through a private intermediary to evade a constitutional, statutory, warrant, retention, disclosure, security, or accountability limitation;

(5) protect the ordinary use of privately owned residential and business security systems while preventing those systems from being converted into undisclosed government-accessible or commercial surveillance networks; and

(6) establish enforceable public approval, transparency, security, audit, retention, deletion, ownership, and accountability requirements.

(b) This Act shall be construed to protect the rights guaranteed by the United States Constitution and the Texas Constitution. This Act does not:

(1) authorize a search, seizure, interception, disclosure, or use of information prohibited by the United States Constitution, the Texas Constitution, or other law;

(2) limit a peace officer's authority to respond to an imminent threat to life or serious bodily injury when acting under otherwise applicable law;

(3) alter a warrant requirement, legal-process requirement, or privacy protection provided by another law except as this Act expressly provides a greater protection; or

(4) authorize an automated match, classification, inference, alert, or other technological output to establish identity, probable cause, guilt, or a basis for an adverse action without trained human review and independent corroboration.

SECTION 1.03. GOVERNMENT CODE. Subtitle F, Title 4, Government Code, is amended by adding Chapter 424 to read as follows:

CHAPTER 424. PUBLIC SURVEILLANCE TECHNOLOGY PRIVACY, SECURITY, AND ACCOUNTABILITY

SUBCHAPTER A. GENERAL PROVISIONS

Sec. 424.001. DEFINITIONS. In this chapter:

(1) "Access" means to view, query, search, retrieve, copy, download, export, transmit, alter, delete, or otherwise interact with covered surveillance data.

(2) "Active operation" means a documented law enforcement investigation, pursuit, apprehension operation, emergency response, missing-person investigation, or other public-safety operation that is ongoing at the time surveillance technology is used.

(3) "Automated license plate reader" or "ALPR" means a fixed, mobile, portable, vehicle-mounted, aerial, or other camera system or related service that uses optical character recognition, machine learning, artificial intelligence, or another automated process to detect, capture, interpret, compare, analyze, or index a license plate number or vehicle-identifying information.

(4) "Biometric identifier" has the meaning assigned by Section 560.001 and includes a biometric template, faceprint, voiceprint, embedding, feature vector, hash, mathematical representation, or other derived record that is used or capable of being used to identify or verify a specific individual.

(5) "Communications content" means the substance, meaning, or information contained in a wire, oral, electronic, text, visual, or other communication, including information displayed on the screen of a wireless communications device and data stored on such a device.

(6) "Covered surveillance data" means data, an image, audio, video, metadata, alert, query result, audit record, location record, identifier, search index, biometric identifier, derivative, or analytical product generated, captured, retained, received, or made available by public surveillance technology. The term includes:

(A) a license plate image or number; a vehicle image; vehicle characteristics, including make, model, type, color, damage, decals, bumper stickers, racks, cargo, or other distinguishing features; and associated date, time, location, direction, speed, camera identifier, alert, query result, hit, non-hit, confidence score, and metadata;

(B) an image, video, audio, thermal, infrared, radar, lidar, acoustic, or other sensor recording associated with a person, vehicle, device, residence, location, or activity;

(C) a face, body, clothing, gait, voice, iris, retina, hand geometry, or other biological, behavioral, or identifying characteristic;

(D) a wireless-device identifier, including an IMSI, IMEI, MAC address, Bluetooth identifier, Wi-Fi probe request, radio-frequency identifier, device-presence record, proximity record, connection record, or location record;

(E) a travel history, movement pattern, association, recurring-location pattern, profile, score, prediction, classification, inference, watchlist result, candidate list, search result, or dataset derived from information described by Paragraphs (A) through (D);

(F) information created by combining information described by Paragraphs (A) through (E) with another public or private dataset; and

(G) an access log, query log, export log, disclosure record, model-training record, or other record necessary to establish compliance with this chapter.

(7) "Covered technology" means a fixed, mobile, portable, vehicle-mounted, aerial, networked, or software-enabled system used by or on behalf of a governmental body, or a private operator subject to this chapter, to collect, retain, process, analyze, infer, identify, associate, track, search, classify, predict, disclose, or otherwise use covered surveillance data. The term includes:

(A) an ALPR or vehicle-recognition system;

(B) a public-space video network, persistent video system, real-time video feed, cross-camera tracking system, person re-identification system, or vehicle-fingerprinting system;

(C) facial detection, facial recognition, face search, biometric recognition, gait analysis, voice analysis, behavioral recognition, or other system using a biometric identifier;

(D) a cell-site simulator or a system that collects, detects, identifies, analyzes, or locates an IMSI, IMEI, MAC address, Bluetooth identifier, Wi-Fi identifier, radio-frequency identifier, or comparable device identifier;

(E) a thermal, infrared, radar, lidar, acoustic, sensor-fusion, object-recognition, or artificial-intelligence system when its output is associated with a person, vehicle, device, residence, location, or activity; and

(F) a successor or substantially similar system designated by rule based on its function.

(8) "Data host" means a person that stores, processes, transmits for processing, backs up, indexes, administers, or provides remote support for covered surveillance data.

(9) "Derived data" means data, an inference, analytical product, profile, score, prediction, classification, alert, vehicle-location history, person-location history, association, biometric template, or another record created from covered surveillance data, whether or not the originating data remains attached to the record.

(10) "Emergency" means circumstances in which a reasonable peace officer would believe immediate action is necessary to prevent imminent death, serious bodily injury, abduction, or the escape of a person who presents an imminent threat of death or serious bodily injury.

(11) "Foreign ownership interest" means a direct or indirect legal, equitable, beneficial, voting, controlling, or economic interest held by a foreign person, including through a parent, affiliate, subsidiary, trust, intermediary, nominee, or other arrangement.

(12) "Foreign person" means an individual who is not a United States citizen or a business entity organized under the laws of a jurisdiction other than the United States or a state or territory of the United States. The term does not include a person or entity excepted by a federal statute, federal regulation, federal procurement requirement, treaty obligation, or federal order that controls the procurement or use at issue.

(13) "Governmental body" has the meaning assigned by Section 552.003 and includes a law enforcement agency, political subdivision, special district, campus police department, and an officer, employee, agent, or contractor acting for a governmental body.

(14) "Historical query" means a query intended to identify or retrieve a person’s, vehicle’s, or device’s prior presence, location, travel history, associated observations, or related covered surveillance data for a period beginning before the time the query is initiated.

(15) "Material expansion" means an acquisition, deployment, renewal, or change that materially increases the number, geographic reach, type, capability, data collected, retention period, data sharing, government access, analytical function, or vendor access of covered technology. The term includes activation of facial recognition, biometric recognition, wireless-device collection, communications-content collection, cross-camera tracking, real-time crime-center integration, or a materially new artificial-intelligence function.

(16) "Operator" means a governmental body, private operator, vendor, contractor, subcontractor, data host, or person that owns, deploys, manages, operates, maintains, accesses, or provides covered technology or covered surveillance data.

(17) "Private operator" means a nongovernmental person that operates covered technology and:

(A) provides, sells, licenses, transfers, or makes covered surveillance data available to a governmental body or law enforcement agency;

(B) permits a governmental body or law enforcement agency to search the operator's data or system;

(C) operates the technology under a contract, grant, memorandum of understanding, donation, subsidy, or other arrangement with a governmental body; or

(D) operates a commercial network that collects public-place observation data for identification, tracking, aggregation, sale, licensing, monetization, or disclosure to another person.

(18) "Public-place observation data" means an image, video, audio, sensor record, identifier, location record, vehicle record, person record, device record, or derivative captured from a street, sidewalk, public right-of-way, park, public facility, or another place open to the public. The term does not include an ordinary private-security recording used solely for security, access control, parking management, safety, loss prevention, or documentation of a specific incident and not used for identification, persistent tracking, aggregation, sale, monetization, or routine government access.

(19) "Public surveillance technology" means covered technology used by or on behalf of a governmental body or by a private operator.

(20) "Sensitive location" means:

(A) a house of worship, religious school, or ministry;

(B) a political event, campaign office, polling place, election office, or lawful assembly;

(C) a medical facility, reproductive-health facility, mental-health facility, school, child-care facility, youth shelter, domestic-violence shelter, homeless shelter, or social-services location;

(D) a news organization, newsgathering location, legal office, attorney-client meeting location, or court location when a person is seeking legal services; or

(E) another location designated by rule because surveillance of the location presents a comparable risk to protected constitutional activity or confidential services.

(21) "United States business entity" means a business entity organized under the laws of the United States or a state or territory of the United States, with its principal place of business in the United States, that is owned and controlled exclusively by United States citizens.

(22) "Vendor" means a person that sells, leases, licenses, provides, maintains, hosts, or supports public surveillance technology or covered surveillance data.

(23) "Wireless-device data" means information identifying, locating, associating, or inferring the presence, movement, use, or activity of a wireless communications device.

Sec. 424.002. APPLICABILITY; PRIVATE-SYSTEM SAFE HARBORS. (a) This chapter applies to:

(1) a governmental body that acquires, operates, accesses, receives, or contracts for public surveillance technology or covered surveillance data;

(2) a vendor, contractor, subcontractor, or data host acting for or providing services to a governmental body;

(3) a private operator; and

(4) a person that provides public-place observation data to a governmental body, except as provided by Subsection (c).

(b) A governmental body may not avoid a requirement of this chapter by obtaining covered surveillance data or public-place observation data through a vendor, data broker, private operator, affiliate, contractor, gift, donation, grant, memorandum of understanding, reciprocal-access arrangement, or other intermediary.

(c) A person who owns or controls a residential security camera, doorbell camera, or ordinary private-business security camera is not an operator solely because the camera incidentally records an entrance, driveway, parking area, sidewalk, street, or adjacent public place. This subsection applies only if the person does not:

(1) enroll the system in a government-connected, commercial, or neighborhood surveillance network;

(2) permit automatic, routine, bulk, real-time, or searchable government access;

(3) aggregate observations for identification, persistent tracking, biometric recognition, wireless-device identification, sale, licensing, monetization, or commercial analysis; or

(4) act as an agent of a governmental body.

(d) A private person may voluntarily provide a recording, photograph, or information concerning a specific incident personally observed to a law enforcement agency. A governmental body may not use this subsection to require access to a historical database, obtain routine access to a private system, or evade a warrant or other legal-process requirement.

(e) Enrollment of a residential or private-business system in a government-connected or neighborhood surveillance program must be voluntary, affirmative, informed, and documented. A program may not use prechecked consent, condition a government benefit or service on enrollment, or represent that voluntary enrollment authorizes a governmental body to conduct a search not otherwise authorized by law.

Sec. 424.003. OWNERSHIP AND CONTROL OF GOVERNMENT-CONTRACT DATA. (a) Covered surveillance data collected, generated, obtained, or maintained under a contract or other arrangement with a governmental body is controlled by the governmental body for purposes of this chapter.

(b) A vendor, contractor, subcontractor, or data host has no independent ownership, licensing, commercialization, advertising, product-development, or independent-use right in covered surveillance data described by Subsection (a).

(c) A contract concerning public surveillance technology must provide that the governmental body retains the right to obtain, preserve, export, audit, delete, and direct the disposition of covered surveillance data without unreasonable delay, fee, or technical impediment.

(d) This chapter supplements and does not limit Chapter 560, Government Code, Chapter 503, Business & Commerce Code, or another law providing a greater protection for biometric or other identifying information. If this chapter imposes a greater restriction on a governmental body, public surveillance technology, or public-place observation data, this chapter controls to the extent of the conflict.

SUBCHAPTER B. PUBLIC APPROVAL, REGISTRY, AND USE TIERS

Sec. 424.051. PUBLIC APPROVAL REQUIRED. (a) Except as provided by Subsection (d), before acquiring, deploying, materially expanding, renewing a material contract for, or activating a materially new capability of public surveillance technology, a governmental body shall:

(1) prepare a surveillance-technology impact report;

(2) publish the report, proposed use policy, vendor identity, proposed contract, data categories, retention period, sharing arrangement, data-hosting location, security requirements, expected cost, funding source, and reasonably available alternatives;

(3) provide notice and accept public comment at an open meeting held in compliance with Chapter 551; and

(4) obtain an affirmative vote of the governmental body's governing body at the open meeting approving the acquisition, deployment, expansion, renewal, or capability activation.

(b) A surveillance-technology impact report must state:

(1) the specific public-safety purpose and capability of the technology;

(2) the categories of data collected, created, received, analyzed, retained, or disclosed;

(3) the applicable use tier under Section 424.053;

(4) the retention, deletion, security, audit, and accountability measures;

(5) each governmental body, vendor, data host, affiliate, contractor, subcontractor, or other person that may access the data;

(6) the potential effects on civil liberties, privacy, protected speech, association, religion, voting, journalism, and legal representation;

(7) the measures used to minimize collection of information about non-targets and sensitive locations; and

(8) the reason less intrusive means are inadequate to accomplish the stated purpose.

(1) the expiration of the associated contract; or

(2) the fifth anniversary of the approval date.

(d) A governmental body may make an emergency acquisition or deployment without prior approval only if the chief executive of the governmental body determines in writing that an emergency requires immediate action to prevent imminent death or serious bodily injury. The body shall cease use of the technology not later than the 90th day after deployment unless it complies with Subsection (a).

Sec. 424.052. PUBLIC REGISTRY. (a) Each governmental body using public surveillance technology shall maintain on a publicly accessible Internet website a continuously updated registry identifying:

(1) each covered system and its vendor;

(2) the camera or sensor category and general deployment location;

(3) the governmental owner and operating agency;

(4) the approved purpose, authorized capabilities, and applicable use tier;

(5) whether the system can perform ALPR, vehicle fingerprinting, facial recognition, biometric analysis, wireless-device collection, audio capture, cross-camera tracking, or artificial-intelligence analytics;

(6) the categories of data collected and the retention period;

(7) data-sharing partners, network connections, and government-access arrangements;

(8) each vendor, cloud host, data-hosting region, data-center location, affiliate, subcontractor, and remote-support provider with access to covered surveillance data;

(9) the governing-body approval date and links to the impact report, use policy, contract, and material amendments;

(10) contract amount, duration, renewal date, and funding source; and

(11) completed audits, substantiated misuse findings, material security incidents, and corrective actions, subject only to a narrowly tailored redaction necessary to protect an active investigation, a specific security vulnerability, or information made confidential by law.

(b) The registry must be updated not later than 30 days after a material change.

Sec. 424.053. USE TIERS. (a) For purposes of this chapter, public surveillance technology is assigned to the following tiers:

(1) Tier 1 includes ordinary fixed video of a defined public facility or government property that is not configured to perform biometric identification, wireless-device collection, cross-camera tracking, or persistent person or vehicle location tracking;

(2) Tier 2 includes ALPR, vehicle fingerprinting, persistent public-space video, cross-camera tracking, person re-identification, location-history analysis, object recognition, and a comparable system capable of identifying, associating, or tracking a person or vehicle over time; and

(3) Tier 3 includes facial recognition, biometric recognition, cell-site simulators, wireless-device collection, communications-content capture, device-content capture, covert device tracking, and a comparable technology capable of identifying or tracking a person or device through highly sensitive information.

(b) A Tier 1 system is subject to the public approval, use-policy, security, retention, audit, no-sale, and accountability requirements of this chapter.

(c) A Tier 2 system is subject to the requirements of Subsection (b) and may be used only on a documented case, incident, alert, or other authorized-purpose basis. A governmental body shall require query-level documentation, supervisory review, and searchable audit records for Tier 2 use.

(d) A Tier 3 system may be used only as expressly authorized by this chapter and only after the requirements applicable to the particular Tier 3 technology are satisfied.

Sec. 424.054. PROHIBITED USES. An operator may not use public surveillance technology, covered surveillance data, or public-place observation data for:

(1) commercial exploitation, advertising, marketing, consumer profiling, credit, insurance, employment, housing, debt collection, repossession, private investigation, or commercial location tracking;

(2) social scoring, generalized population tracking, indiscriminate identification of persons in public, or surveillance based on a person's lawful speech, association, religious exercise, political activity, voting, journalism, legal representation, or lawful assembly;

(3) harassment, stalking, retaliation, discrimination, or monitoring a person because of race, color, religion, sex, national origin, age, disability, political belief, viewpoint, party affiliation, or another status protected by law; or

(4) an unauthorized private-enforcement purpose.

SUBCHAPTER C. AUTHORIZED ACCESS, SEARCHES, AND SENSITIVE LOCATIONS

Sec. 424.101. AUTHORIZED PURPOSE REQUIRED. (a) A governmental body or user may access or use covered surveillance data only for:

(1) a specific criminal investigation supported by reasonable suspicion that an identified criminal offense has occurred, is occurring, or is about to occur;

(2) execution of a warrant, court order, subpoena, or other legal process;

(3) an active missing-person, endangered-person, or abducted-person investigation;

(4) identification or recovery of a stolen vehicle or property;

(5) an emergency;

(6) a documented effort to locate a person subject to a valid arrest warrant, including a person sought for a violent offense or felony offense; or

(7) a purpose expressly authorized by another state or federal law that does not conflict with this chapter.

(b) A generalized law-enforcement interest, curiosity, personal interest, or a purpose prohibited by Section 424.054 is not an authorized purpose.

Sec. 424.102. HISTORICAL QUERIES. (a) A governmental body may conduct a narrowly tailored historical query of Tier 1 or Tier 2 data without a warrant if the query:

(1) is supported by reasonable suspicion;

(2) concerns an identified offense, a missing or endangered person, a stolen vehicle or property, or a documented active investigation;

(3) is limited to the target, geographic area, and period reasonably necessary for the authorized purpose; and

(4) is recorded under Section 424.106 and approved by a supervisor before the query when practicable and otherwise not later than 24 hours after the query.

(b) A warrant is required for a Tier 1 or Tier 2 historical query that:

(1) is extended, repeated, or broad enough to reconstruct a person's, vehicle's, or device's movements over time beyond the scope reasonably necessary under Subsection (a);

(2) concerns a sensitive location; or

(3) otherwise requires a warrant under the United States Constitution, the Texas Constitution, or other law.

(c) Emergency access without prior legal process is permitted only if the user documents the facts establishing the emergency before the query when practicable and otherwise not later than 24 hours after the query. Continued access requires a warrant or other legal process as soon as practicable if required by law.

Sec. 424.103. REAL-TIME ALERTS. (a) A warrant is not required for a real-time alert if a peace officer could lawfully act on the same information had the officer personally observed the relevant facts in a public place.

(b) A warrantless alert under Subsection (a) must be tied to:

(1) a crime in progress;

(2) a verified stolen vehicle;

(3) a valid arrest warrant;

(4) a missing, abducted, endangered, or vulnerable person;

(5) an immediate and articulable threat to life, serious bodily injury, or public safety; or

(6) a documented active pursuit or active operation.

(c) An alert must be narrowly keyed to a known vehicle, person, or device; limited to the shortest duration reasonably necessary; reviewed periodically; and disabled when its factual basis ends.

Sec. 424.104. FACIAL AND BIOMETRIC RECOGNITION. (a) A governmental body shall keep facial-recognition and biometric-recognition capabilities disabled unless use is authorized by a judicial warrant.

(b) A warrant under this section must:

(1) identify a known suspect;

(2) describe the active criminal investigation, active pursuit, or court-sanctioned operation;

(3) authorize the use solely to locate and apprehend the known suspect; and

(4) state the geographic scope and duration of the authorized use.

(c) A governmental body may not use facial-recognition or biometric-recognition technology for generalized scanning, continuous facial surveillance, real-time crowd identification, or reverse-image searching of the general public.

(d) A facial or biometric match is an investigative lead only and may not alone establish identity, probable cause, guilt, or a basis for enforcement. A trained person shall review the match and independently corroborate the match before an enforcement action.

(e) The governmental body shall promptly delete nonresponsive facial images, biometric identifiers, templates, embeddings, candidate lists, and related search outputs, except to the extent retention is required by a warrant, court order, evidentiary duty, or investigation of a violation of this chapter.

Sec. 424.105. WIRELESS-DEVICE DATA; COMMUNICATIONS CONTENT. (a) A governmental body may not collect, detect, identify, analyze, or locate wireless-device data, or operate a cell-site simulator, unless authorized by a judicial warrant.

(b) Subsection (a) does not prohibit narrowly tailored warrantless use during an active, authorized pursuit of a known suspect if the officer reasonably believes the suspect is a violent offender, fugitive, or person whose immediate apprehension is necessary to prevent imminent death or serious bodily injury. The user shall document the facts and seek a warrant as soon as practicable if continued use is required.

(c) A governmental body may not capture, obtain, retain, analyze, or use communications content, phone-screen content, or data stored on a wireless communications device without a judicial warrant. This subsection does not limit a greater protection or requirement under Article 18.0215, Code of Criminal Procedure, or other law.

(d) A warrant or emergency use under this section must be target-specific; minimize collection of non-target data; document the area and duration of use; segregate nonresponsive data; and require prompt deletion of nonresponsive data. The warrant return must describe the use, data obtained, and data deleted.

Sec. 424.106. SENSITIVE LOCATIONS. (a) A governmental body may use Tier 2 or Tier 3 technology to collect, query, or search data concerning a sensitive location only under a warrant supported by probable cause.

(b) In addition to other warrant requirements, an application under Subsection (a) must establish:

(1) the identity of the known suspect;

(2) the active warrant or active criminal operation;

(3) specific facts showing that the suspect frequents or is likely to appear at the sensitive location;

(4) why the surveillance is necessary and less intrusive means are inadequate;

(5) the steps that will be used to avoid collecting or using information about non-targets;

(6) the narrowest reasonable geographic scope and shortest reasonable duration; and

(7) the plan to avoid unnecessary interference with worship, voting, medical care, education, journalism, legal representation, or protected assembly.

Sec. 424.107. USER AUTHORIZATION; SEARCH RECORD. (a) A governmental body shall ensure that each access is attributable to an individual user with unique credentials. Shared, generic, anonymous, or untraceable accounts are prohibited.

(b) Before or contemporaneously with an access or search, the user shall create a record stating:

(1) the user's name, employing agency, and unique account identifier;

(2) the date and time;

(3) the query terms and data searched;

(4) the authorized purpose;

(5) the associated offense report, incident number, warrant, court order, alert identifier, or emergency justification;

(6) the data accessed, exported, copied, or disclosed; and

(7) the recipient and legal basis for each disclosure.

Sec. 424.108. DISCLOSURE TO GOVERNMENTAL ENTITIES AND PRIVATE OPERATORS. (a) A governmental body may disclose covered surveillance data to another governmental body only if the receiving body is authorized to receive the data, the disclosure serves an authorized purpose, the receiving body agrees to comply with this chapter, and the disclosure is recorded in an audit log.

(b) A private operator may not provide public-place observation data or covered surveillance data to a governmental body except:

(1) in response to a warrant, court order, or other legal process;

(2) during an emergency;

(3) in response to a specific request for information concerning a particular incident personally observed by the operator; or

(4) through a voluntary, affirmative, informed, and documented enrollment arrangement that complies with this chapter.

(c) A governmental body may not obtain routine, bulk, real-time, or searchable access to a private operator's system or historical database unless expressly authorized by a warrant, a court order, or a government contract approved under Subchapter B.

SUBCHAPTER D. RETENTION, COMMERCIAL LIMITS, DATA RESIDENCY, AND SECURITY

Sec. 424.151. RETENTION AND DELETION. (a) Except as provided by Subsection (b), an operator shall permanently delete covered surveillance data and public-place observation data not later than the 30th day after collection.

(b) Data may be retained longer only if it is associated with a documented criminal investigation, prosecution, warrant, court order, missing-person investigation, stolen-property investigation, emergency, preservation notice, litigation hold, evidentiary duty, or suspected violation of this chapter.

(c) An operator shall delete a record retained under Subsection (b) when the legal, evidentiary, investigative, or compliance basis ends, unless another lawful basis for retention applies.

(d) An operator shall use a method that makes deleted information unrecoverable by ordinary means. If immediate deletion from a backup system is not technically feasible, the operator shall isolate the data, prohibit ordinary restoration or use, delete it at the first technically feasible backup-rotation opportunity, and document completion.

Sec. 424.152. SALE, MONETIZATION, AND COMMERCIAL AGGREGATION PROHIBITED. (a) An operator may not sell, license, rent, exchange, monetize, commercially exploit, disclose, transfer, provide subscription access to, or otherwise make covered surveillance data, derived data, or public-place observation data available to a person not expressly authorized by this chapter.

(b) A transaction is prohibited under Subsection (a) whether or not the operator receives money and whether consideration is monetary, in-kind, reciprocal, contingent, or otherwise valuable.

(c) A private business may capture ordinary security video of an adjacent public area for security, access control, parking management, safety, loss prevention, or documentation of a specific incident. The business may not use the recording to identify, persistently track, aggregate, sell, license, monetize, or otherwise commercially exploit people, vehicles, or devices observed in the public area.

(d) A vendor, contractor, subcontractor, or data host may process data only as necessary to provide an authorized service and may not independently use or disclose the data.

(e) The restrictions imposed by this section survive expiration or termination of a contract or other arrangement.

Sec. 424.153. ARTIFICIAL INTELLIGENCE. (a) Covered surveillance data may be used to train, test, validate, calibrate, or improve an artificial-intelligence model only if:

(1) the model is wholly owned and operated by the operator of the specific surveillance product;

(2) the use is strictly necessary to improve the product's accuracy, reliability, error detection, bias testing, security, or lawful functionality;

(3) the data is not transferred to a third-party artificial-intelligence developer or used to train or improve a generalized commercial or shared foundation model, advertising model, consumer-profile model, or unrelated analytics product;

(4) government-collected data is used only with the written approval of the governmental body that controls the data;

(5) the training environment complies with the residency, security, logging, deletion, and no-sale requirements of this chapter; and

(6) the data is minimized, access-restricted, and pseudonymized or de-identified when practicable.

(b) An artificial-intelligence output is an investigative lead only and may not alone establish identity, probable cause, guilt, culpability, or a basis for adverse action.

Sec. 424.154. UNITED STATES RESIDENCY; UNITED STATES OWNERSHIP. (a) An operator shall store, process, transmit for processing, back up, replicate, index, administer, and remotely access covered surveillance data only within the United States.

(b) Subsection (a) applies to primary databases, camera and edge-device storage, backups, disaster-recovery systems, caches, indexes, logs, exports, analytics systems, development and test environments, model-training datasets, support systems, and telemetry containing covered surveillance data.

(c) A governmental body may contract for public surveillance technology only with a United States business entity. A contract may not permit a foreign ownership interest in the vendor, contractor, subcontractor, data host, affiliate, or remote-support provider that owns, controls, or accesses covered surveillance data.

(d) A governmental body may approve a limited exception to Subsection (c) only to the extent required by controlling federal law, federal procurement requirements, treaty obligations, or a federal order. An exception must be made in writing, identify the controlling authority, be limited to the minimum extent required, and be entered in the public registry.

(e) A governmental body may approve temporary access from outside the United States only during a declared disaster or comparable emergency that makes domestic access unavailable. The approval must be written, limited to the least data and shortest duration necessary, use encryption and multifactor authentication, be continuously logged, and be reported in the registry not later than 30 days after the access ends.

(f) A vendor, contractor, subcontractor, data host, affiliate, or remote-support provider shall notify the contracting governmental body not later than the fifth business day after a change in ownership, control, beneficial ownership, parent company, affiliate structure, data-hosting arrangement, subprocessor, or foreign-access risk.

Sec. 424.155. MINIMUM SECURITY SAFEGUARDS. (a) An operator shall implement and maintain reasonable administrative, technical, and physical safeguards, including at least:

(1) encryption in transit and at rest, including for backups, exports, logs, removable media, and edge-device storage;

(2) multifactor authentication for every governmental, vendor, privileged, administrative, and remote-support account;

(3) unique credentials, role-based access, least-privilege permissions, separation of administrative and auditing functions, and prompt access revocation;

(4) network segmentation between field devices, administrative systems, and data-storage systems;

(5) tamper-evident audit logs retained for at least five years;

(6) automated monitoring and alerts for bulk searches, unusual geographic searches, repeated searches, mass exports, after-hours access, failed access attempts, and access outside assigned duties;

(7) vulnerability management, secure software-development, code-signing, patching, update controls, and remediation deadlines based on severity;

(8) annual independent security assessments and penetration testing;

(9) hardware, firmware, software, cloud-service, and supply-chain risk controls;

(10) a written incident-response, continuity, and disaster-recovery plan;

(11) secure deletion practices required by Section 424.151; and

(12) contractual flow-down of each requirement of this section to each affiliate, contractor, subcontractor, data host, and remote-support provider.

(b) The Department of Information Resources shall adopt and update minimum technical cybersecurity standards under this section. The Department of Public Safety and the Texas Commission on Law Enforcement shall adopt rules concerning permissible law-enforcement uses, documentation, supervision, and training. A rule may not weaken a protection established by this chapter.

Sec. 424.156. INCIDENT RESPONSE; CERTIFICATION; AUDIT. (a) An operator that discovers unauthorized access to, acquisition of, disclosure of, loss of, alteration of, or inability to account for covered surveillance data shall:

(1) immediately contain and investigate the incident;

(2) preserve relevant evidence, logs, configurations, and records;

(3) notify the contracting governmental body not later than 24 hours after discovery;

(4) notify the Department of Information Resources and the attorney general not later than 72 hours after discovery, unless the attorney general authorizes a longer period in writing for an active criminal investigation;

(5) provide notice to affected individuals when required by Chapter 521, Business & Commerce Code, or when the attorney general determines misuse creates a material risk of harm; and

(6) submit a corrective-action report not later than the 30th day after discovery unless an extension is approved in writing.

(b) Not later than January 31 of each year, each operator shall submit to the contracting governmental body a certification signed by a responsible official that identifies data locations, hosting regions, data centers, affiliates, subcontractors, remote-support providers, technically possible access locations, material security incidents, deletion practices, and ownership or control changes.

(c) A governmental body shall conduct quarterly access recertification and an annual audit that includes a statistically valid review of searches, historical queries, exports, disclosures, user access, deletion, vendor compliance, and adherence to approved use tiers.

SUBCHAPTER E. TRANSPARENCY, DISCIPLINE, REMEDIES, AND PENALTIES

Sec. 424.201. ANNUAL REPORT; COMPLAINTS; WHISTLEBLOWERS. (a) Not later than March 1 of each year, each governmental body using public surveillance technology shall publish an annual report stating the number of searches, historical queries, alerts, exports, disclosures, emergency accesses, suspected misuse incidents, substantiated violations, disciplinary actions, contract actions, referrals, security incidents, corrective actions, and amount of data deleted.

(b) A governmental body shall maintain a process for receiving, documenting, investigating, and resolving a complaint alleging a violation of this chapter.

(c) An operator or supervisor may not retaliate against a person who in good faith reports a suspected violation of this chapter to an appropriate governmental authority. This subsection does not immunize a person from an independently justified action that would have occurred in the absence of the report.

Sec. 424.202. INDIVIDUAL DISCIPLINE; REFERRAL. (a) A governmental body shall promptly investigate a credible allegation that an officer, employee, contractor, or other user violated this chapter.

(b) If an investigation substantiates a negligent violation, the governmental body shall require corrective action and retraining. If an investigation substantiates a knowing or repeated violation, the body shall impose proportionate discipline, which may include suspension, termination, revocation of access, contract termination, or referral for criminal investigation.

(c) The governmental body shall preserve the evidence and audit records relevant to an alleged violation. If the allegation concerns a licensed peace officer and may constitute misconduct within the jurisdiction of the Texas Commission on Law Enforcement, the body shall make a referral as required by law.

Sec. 424.203. CIVIL ENFORCEMENT; STANDING. (a) A person may bring an action for declaratory or injunctive relief to enforce this chapter without proving that the person's own data was collected, accessed, or disclosed.

(b) A person whose data was knowingly accessed, used, retained, disclosed, sold, or otherwise handled in violation of this chapter may recover proven direct economic damages and statutory damages of not less than $1,000 or more than $5,000 for each violation, as determined by the court.

(c) A plaintiff shall provide written notice to the governmental body or operator not later than 30 days before filing suit, describing the alleged violation and requested corrective action. Notice is not required for temporary or emergency injunctive relief to prevent imminent irreparable harm.

(d) An action must be brought not later than two years after the date the plaintiff discovered or reasonably should have discovered the violation and not later than five years after the violation occurred.

(e) A court may consolidate related actions, restrict duplicative recovery, and award reasonable attorney's fees and court costs to a substantially prevailing plaintiff. A court may award fees and costs to a defendant only if the court finds the action frivolous, objectively groundless, brought in bad faith, or brought for harassment.

(f) Sovereign immunity and governmental immunity from suit and liability are waived and abolished solely to the extent necessary to permit the relief expressly authorized by this section against a governmental body. This subsection does not waive immunity for exemplary damages, noneconomic damages, or a claim not expressly authorized by this section.

Sec. 424.204. ATTORNEY GENERAL ENFORCEMENT; CIVIL PENALTIES. (a) The attorney general may bring an action in the name of the state to enforce this chapter against a governmental body, operator, vendor, contractor, subcontractor, data host, or private operator.

(b) A court may assess a civil penalty of not less than $5,000 or more than $25,000 for each knowing violation and not less than $25,000 or more than $100,000 for a pattern or practice of violations.

(c) In addition to a civil penalty, a court may order compliance monitoring, corrective action, data remediation, deletion, function-specific suspension, contract suspension or termination, recovery of investigation and remediation costs, and debarment as authorized by law.

(d) A civil penalty collected under this section shall be deposited to the credit of the compensation to victims of crime fund.

Sec. 424.205. CONTRACT REMEDIES; DEBARMENT. (a) A governmental body shall suspend or terminate a contract with an operator that knowingly or repeatedly violates this chapter, makes a materially false certification, refuses a lawful audit, permits prohibited foreign ownership or access, or fails to delete data as required.

(b) The comptroller, after notice and opportunity for a hearing, may debar an operator described by Subsection (a) from state contracts involving public surveillance technology for a period not to exceed five years.

Sec. 424.206. OFFENSES. (a) A person commits an offense if the person knowingly accesses, uses, discloses, retains, sells, or provides covered surveillance data or public-place observation data in violation of this chapter.

(b) Except as provided by Subsection (c) or (d), an offense under this section is a Class A misdemeanor.

(1) commits the offense for a pecuniary benefit;

(2) obtains or discloses information concerning 50 or more vehicles, persons, or devices;

(3) commits the offense to facilitate stalking, harassment, family violence, trafficking, retaliation, or another offense involving violence or a credible threat of violence; or

(4) knowingly defeats, alters, deletes, conceals, or materially falsifies an audit log or other record required by this chapter.

(d) An offense under this section is a felony of the third degree if the actor commits the offense to facilitate or conceal a felony offense or knowingly sells or discloses information concerning 1,000 or more vehicles, persons, or devices.

(e) It is a defense to prosecution under this section that the actor reasonably relied on a facially valid warrant, court order, legal process, or written request that appeared to authorize the conduct, unless the actor knew the conduct was unlawful.

Sec. 424.207. CIVIL-TO-CRIMINAL REFERRAL; DUE PROCESS. (a) If a final judgment or administrative finding establishes facts that reasonably indicate a knowing violation of Section 424.206, the governmental body or tribunal shall refer the judgment or finding and supporting records to the prosecuting attorney with jurisdiction and to the attorney general. A referral involving a licensed peace officer shall also be made to the Texas Commission on Law Enforcement when applicable.

(b) A civil or administrative finding under this chapter does not establish criminal guilt, create collateral estoppel in a criminal proceeding, alter the presumption of innocence, or reduce the state's burden of proof.

Sec. 424.208. UNLAWFULLY OBTAINED OR MAINTAINED DATA. (a) Covered surveillance data knowingly obtained, accessed, or retained in violation of this chapter shall be deleted or placed in restricted segregation pending a lawful determination concerning preservation, disclosure, or evidentiary use.

(b) Evidence obtained by an officer or other person in violation of this chapter is subject to Article 38.23, Code of Criminal Procedure, to the extent otherwise provided by that article.

(c) Covered surveillance data obtained or maintained in violation of this chapter may not be used to impose a governmental penalty, licensing consequence, benefit termination, or civil liability, except to the extent an independent lawful source, inevitable discovery rule, or other applicable rule of law permits the use.

Sec. 424.209. GOOD-FAITH PROTECTION FOR FIRST RESPONDERS. This chapter does not create a claim for money damages against an individual peace officer, firefighter, emergency medical services personnel, or other first responder who acted in good-faith reliance on a facially valid agency policy, warrant, court order, legal process, or supervisory direction, unless the individual knew the conduct was unlawful.

SUBCHAPTER F. LOCAL AUTHORITY AND RULEMAKING

Sec. 424.251. LOCAL STANDARDS. A political subdivision may adopt a more protective privacy, retention, transparency, security, accountability, or use restriction for public surveillance technology if the standard does not prevent compliance with a valid statewide missing-person, stolen-vehicle, or emergency-alert system.

Sec. 424.252. RULEMAKING. The Department of Information Resources, the Department of Public Safety, the Texas Commission on Law Enforcement, the attorney general, and the comptroller may adopt rules necessary to implement their respective duties under this chapter.

ARTICLE 2. CONFORMING AMENDMENTS

SECTION 2.01. BIOMETRIC IDENTIFIERS. Chapter 560, Government Code, is amended by adding Section 560.004 to read as follows:

Sec. 560.004. PUBLIC SURVEILLANCE TECHNOLOGY. This chapter does not limit a requirement or prohibition imposed by Chapter 424. If a governmental body possesses a biometric identifier through public surveillance technology, the governmental body shall comply with Chapter 424 to the extent that chapter imposes a greater protection or restriction.

SECTION 2.02. CELLULAR TELEPHONES AND WIRELESS COMMUNICATIONS DEVICES. Article 18.0215, Code of Criminal Procedure, is amended by adding Subsection (h) to read as follows:

(h) This article does not limit a requirement or prohibition imposed by Chapter 424, Government Code. A governmental body using a cell-site simulator or obtaining wireless-device data, communications content, phone-screen content, or data stored on a wireless communications device through public surveillance technology shall comply with Chapter 424 to the extent that chapter imposes a greater protection or restriction.

ARTICLE 3. IMPLEMENTATION AND TRANSITION

SECTION 3.01. INITIAL IMPLEMENTATION. (a) Not later than September 1, 2027, each governmental body subject to Chapter 424, Government Code, as added by this Act, shall:

(1) inventory every covered system, feature, vendor, subcontractor, data host, data flow, retention setting, government-access arrangement, and foreign-access path;

(2) suspend prohibited sale, monetization, routine government access to private databases, and new deployment of a prohibited capability;

(3) disable facial recognition, biometric recognition, wireless-device collection, communications-content collection, behavioral analytics, and cross-camera tracking capabilities unless and until their use is approved and authorized under Chapter 424, Government Code, as added by this Act;

(4) publish the public registry required by Section 424.052, Government Code, as added by this Act;

(5) submit initial ownership, control, and data-location certifications required by Section 424.156, Government Code, as added by this Act; and

(6) adopt the policy required by Section 424.051, Government Code, as added by this Act.

(b) Not later than September 1, 2027, the Department of Information Resources shall adopt initial security rules and standards, and the Department of Public Safety and Texas Commission on Law Enforcement shall adopt initial use, documentation, supervision, and training rules.

SECTION 3.02. EXISTING SYSTEMS AND CONTRACTS. (a) A governmental body and operator shall bring an existing system or contract into compliance with Chapter 424, Government Code, as added by this Act, not later than September 1, 2028.

(b) Compliance under Subsection (a) includes obtaining governing-body approval for a system that will remain in operation, amending, replacing, or terminating noncompliant contracts, relocating data and backups to the United States, eliminating prohibited foreign ownership or access, disabling prohibited features, deleting impermissibly held records, and documenting completion.

(c) A governmental body may not renew, extend, or materially modify a contract after September 1, 2027, unless the contract complies with Chapter 424, Government Code, as added by this Act.

(d) Not later than October 1, 2028, each governmental body shall submit a compliance report to the attorney general, the Department of Information Resources, the Department of Public Safety, and the Texas Commission on Law Enforcement.

SECTION 3.03. PROSPECTIVE APPLICATION. The changes in law made by this Act apply only to conduct occurring on or after September 1, 2028. Conduct occurring before that date is governed by the law in effect on the date the conduct occurred, and the former law is continued in effect for that purpose.

SECTION 3.04. SEVERABILITY. If any provision of this Act or its application to a person or circumstance is held invalid, the invalidity does not affect another provision or application that can be given effect without the invalid provision or application, and to this end the provisions of this Act are severable.

SECTION 3.05. EFFECTIVE DATE. Except as otherwise provided by this Act, this Act takes effect September 1, 2027.

References

American Civil Liberties Union. (2012, September 24). ACLU sues federal agencies over license plate reader information.

This announcement documents litigation seeking federal records concerning ALPR retention, sharing, security, and privacy policies. It also reproduces the International Association of Chiefs of Police’s warning that plate readers may collect information at sensitive locations such as clinics, churches, and addiction-counseling meetings. It was used to explain why location records require heightened safeguards even when a vehicle is visible from a public street.

American Civil Liberties Union of Michigan. (2025). Facial recognition.

This case page describes the litigation and settlement arising from Robert Williams’s wrongful arrest following a false facial-recognition lead. As counsel in the litigation, the organization is a direct source for the settlement safeguards, including restrictions on lineups based solely on facial-recognition outputs and requirements for independent evidence. It was used to illustrate the practical consequences of treating a biometric candidate match as proof.

Associated Press. (2012, February 23). With cameras, informants, NYPD eyed mosques.

This investigation was based on internal police records obtained by the Associated Press. It documented photography, camera placement, institutional mapping, and collection of congregants’ license plates in connection with surveillance of Muslim communities. It was used as a documented historical example of surveillance being directed toward religious activity and lawful association.

Congressional Research Service. (2025, July 21). Automated license plate readers: Background and legal issues. Congress.gov.

This nonpartisan congressional legal overview explains ALPR technology and summarizes the developing federal case law. It notes that courts have frequently distinguished ALPR records from historical cellular-location data and have not uniformly treated the ALPR searches before them as Fourth Amendment searches. It was used to explain why statutory rules governing retention, access, auditing, and sharing remain necessary even while constitutional doctrine develops.

Cybersecurity and Infrastructure Security Agency. (2024, June 13). Motorola Solutions Vigilant license plate readers: ICSA-24-165-19.

This federal cybersecurity advisory identifies vulnerabilities in specified Motorola Vigilant fixed license-plate-reader equipment, including authentication bypass, cleartext storage, hard-coded credentials, insufficient credential protection, and missing encryption. CISA also provided technical mitigations and reported that it knew of no public exploitation specifically targeting the vulnerabilities at publication. It was used to support the bill’s encryption, authentication, patching, segmentation, and independent-security-testing requirements.

Flock Safety. (2025, June 18). Flock’s statement on network sharing and federal cooperation.

This statement describes Flock’s one-to-one agency sharing, geographic sharing, National Lookup function, search-reason fields, and audit records. Because it was produced by the vendor, it is used to document the company’s description of its own system rather than as an independent evaluation of effectiveness or compliance. It helps establish how local camera networks may participate in broader interagency searches and why statutory audit requirements are needed.

Frisco Police Department. (n.d.). Technology transparency. City of Frisco.

This official municipal page describes Frisco’s use of Flock license-plate readers, its 30-day ordinary retention period, legitimate-purpose documentation, audit process, and agency ownership of collected data. It was used as an example of safeguards that a Texas department has already incorporated into local practice. The page also explains how officers may use plate and vehicle descriptions in active investigations.

Frisco Police Department. (2023, July 27). Frisco Police Department reviews high-risk traffic stop. City of Frisco.

This official statement explains how an officer entered an Arkansas plate as an Arizona plate, received an incorrect registration return, and initiated a high-risk stolen-vehicle stop. It records the supervisor’s intervention, the department’s review, and the chief’s public acknowledgment of the error. It was used to demonstrate why database and automated outputs require verification before coercive action.

Frisco Police Department. (2025a). Bi-annual Flock usage review: Q1/Q2 2025. City of Frisco.

This official report provides Frisco’s alert, search, arrest, and warrant totals for the first half of 2025. It expressly notes that unconfirmed alerts arising from misread or obscured plates are included in the alert count. It was used both to document operational activity and to explain why agencies must distinguish raw alerts from verified hits, arrests, solved cases, and convictions.

Frisco Police Department. (2025b, December 31). Flock hit leads to arrest. City of Frisco.

This official police release describes an ALPR alert involving a reported stolen vehicle, the officers’ response, a pursuit, and the eventual arrest of the alleged driver. It is a concrete example of a targeted, real-time ALPR use supporting an active stolen-vehicle investigation. It was included to demonstrate the type of legitimate public-safety operation the proposed act preserves.

Kansas Commission on Peace Officers’ Standards and Training. (2024). In the matter of Lee Nygaard: Summary order of revocation, Case No. 2023-0155.

This official administrative order contains findings that a police chief used a Flock system to search a former girlfriend’s plate 164 times and her boyfriend’s plate 64 times. The order records the search reasons entered into the system, the respondent’s admission that jealousy influenced his conduct, and the revocation of his certification. It is the principal primary-source example supporting individualized credentials, purpose verification, anomaly detection, audits, discipline, and criminal prohibitions against stalking-related misuse.

National Institute of Justice. (2018). Optimizing the geographic deployment of hot spot patrols with license plate readers. U.S. Department of Justice.

This record summarizes a peer-reviewed analysis combining two randomized experiments involving license-plate-reader patrols. The study found that ALPR use increased the likelihood of detections, arrests, and recoveries, although outcomes were generally rare and only the detection effect was statistically significant. It was used to describe ALPR effectiveness without overstating what the experimental evidence establishes.

National Institute of Standards and Technology. (2020, January 15). Facial recognition technology (Part III): Ensuring commercial transparency and accuracy.

This official NIST testimony summarizes federal testing of facial-recognition algorithms and explains false-positive and false-negative errors. It documents substantial performance variation and demographic differentials across many algorithms while noting that more accurate systems may produce smaller differences. It was used to support warrants, human review, independent corroboration, testing, and the rule that a facial-recognition output is only an investigative lead.

Office of Justice Programs. (2011). Combating auto theft in Arizona: A randomized experiment with license plate recognition technology. U.S. Department of Justice.

This Department of Justice research record reports results from a randomized experiment conducted with the Mesa Police Department. ALPR-equipped officers checked eight to ten times as many plates, generated nearly three times as many stolen-vehicle hits, and recovered approximately twice as many vehicles as comparison patrols. The study did not establish that the ALPR intervention itself reduced area-wide auto theft, making it useful for distinguishing demonstrated investigative efficiency from broader deterrence claims.

RAND Corporation. (2014, July 2). License plate readers are an important police tool, but hurdles remain to reach full potential.

This RAND summary reports findings from a research project involving prior literature and in-depth reviews of seven police departments. It identifies potential benefits in investigative speed and officer awareness while also emphasizing staffing, compatibility, retention, access, sharing, and privacy challenges. It was used to support the article’s conclusion that useful technology and enforceable safeguards are complementary rather than opposing goals.

University of Washington Center for Human Rights. (2025, October 21). Leaving the door wide open: Flock surveillance systems expose Washington drivers to federal and out-of-state searches.

This university research report analyzes Flock audit records obtained through public-record requests. It documents direct and indirect federal access, searches by out-of-state entities, and local searches reportedly performed on behalf of federal agencies. It was used to explain how interagency network access may exceed local expectations and to support purpose limitations, disclosure records, public registries, and enforceable controls on external access.

U.S. Department of Justice. (2015, September 3). Department of Justice policy guidance: Use of cell-site simulator technology.

This official federal policy requires Department of Justice components to obtain a probable-cause warrant before using cell-site simulators, subject to limited exigent and exceptional circumstances. It also addresses disclosure to courts, handling of non-target data, deletion, and reporting. It was used as an established governmental model supporting the proposed Texas warrant, minimization, emergency-use, and deletion provisions.

The Texas Public Surveillance Technology Privacy, Security, and Accountability Act

The Texas Public Surveillance Technology Privacy, Security, and Accountability Act

Executive Summary

The Technology Has Two Sides

Why Statewide Rules Are Needed

Personal misuse is documented

Database errors can escalate quickly

Network sharing can outgrow local control

Surveillance can reveal protected activity

What the Act Covers

What the Act Does Not Cover

Public Approval Before Deployment

A Public Registry

Three Use Tiers

Tier 1: Defined-site video

Tier 2: Identification and tracking

Tier 3: Highly sensitive identification

Authorized Purposes

Historical Searches

Real-Time Alerts

Facial Recognition

Wireless Devices and Cell-Site Simulators

Data Retention and Deletion

No Sale or Commercial Exploitation

Artificial Intelligence

American Data Control

Cybersecurity

Security-Incident Reporting

Accountability and Enforcement

Annual reporting

Complaints and whistleblowers

Discipline

Civil remedies

Attorney-general enforcement

Contract remedies

Criminal offenses

Protecting Good-Faith Officers

Evidence and Due Process

Local Control

Implementation

Measuring Effectiveness Honestly

The Governing Principle

Provision-to-Problem Guide

Proposed Legislation

References

Equal Cancer Protections for Female First Responders and Long Term Research

Enforcing Your Rights - The Local Accountability and Compliance Act

Texas House of Representatives District 109

Will Campbell for Texas