The policies
Two Arvada Police Department policies govern the plate readers: PM 460, on the cameras themselves, and PM 461, on the real-time center they feed. Both came out of the same records request as the contracts. Here is what each says, checked against the contracts it is supposed to govern.
Two policies, by the numbers
The plate-reader policy, eight lines checked
Quoted verbatim. Each is checked against the rest of the policy and the city's Flock and Genetec contracts.
True, and not misleading in context.
Literally correct; the operative word or the documents make it less than it sounds.
The city's own documents say otherwise.
The policy does not address it.
01Weaker than it reads
The policy of the Arvada Police Department is to utilize ALPR technology to capture and store digital license plate data and images while safeguarding the established privacy rights of the public.
The safeguard is stated once, in the purpose section. The operative rule, three sections later, is §460.5(2): an ALPR may be used “in conjunction with any patrol operation or official department investigation. Reasonable suspicion or probable cause is not necessary before using an ALPR.”[1]
That is an honest description of how plate readers work: they record everyone. It is also the reason the rest of the policy, retention, sharing and audit, has to carry all the weight, because the collection itself has no threshold.
02Weaker than it reads
For systems leased through third-party vendors, the data is stored in the cloud and deleted on a rolling 30-day basis.
This matches the Flock order form, which sets “Retention Period: 30 Days,” and is the only line in either policy that describes the Flock cameras, without naming Flock.[1][3]
PM 460 §460.6
deleted on a rolling 30-day basis
Flock security addendum, same contract
no longer than one (1) year
Customer Data may be temporarily retained in Flock backups after deletion
Still openWhich figure governs, and how long backups persist. The contract states no backup-purge period.
03Weaker than it reads
Notwithstanding C.R.S. §24-72-113 which allows retention of the Mobile ALPR data for up to three years, ALPR data collected by APD will be automatically purged after 364 days.
A real limit, and shorter than state law permits. But the line directly above it reads: “Data is also retained by LexisNexis Risk Solutions, per agreement with the Arvada Police Department.” The policy does not say whether the 364-day purge reaches the LexisNexis copy, and the LexisNexis agreement was not in the release.[1]
Still openHow long LexisNexis keeps Arvada's plate reads, and who can search them there.
04Weaker than it reads
Such ALPR data may be released to other authorized and verified law enforcement officials and agencies at any time for legitimate law enforcement purposes.
“Authorized and verified” is the only filter. The policy sets no limit by jurisdiction, no bar on federal immigration enforcement, no memorandum-of-understanding requirement, and no log of what was shared with whom. It never mentions Flock's state or nationwide lookup networks, both of which appear on the city's order form.[1][3]
The contract is, on one point, stronger than the policy: it bars Flock from producing footage under “an immigration subpoena that has not been authorized by a federal court.” Nothing equivalent binds the department's own sharing.[3]
05Weaker than it reads
ALPR system audits should be conducted on a regular basis.
“Should,” not “shall.” No auditor, no interval, no sample, no recipient, and no publication. The access system is required to be “capable of documenting all access of information by name, date and time” (§460.7(2)), so the raw material for an audit exists. Nothing requires anyone to read it.[1]
The Flock contract adds that “Customers do not have the right to independently audit Flock directly.”[3]
06Weaker than it reads
Operators should attempt to verify ALPR hotlist alerts or hits through NCIC … or CCIC … before taking enforcement action that is based solely on an ALPR alert.
“Should attempt to,” and only where action rests “solely” on the alert. Hot lists can also include plates officers “manually add,” with no approval, reason, or expiry required (§460.3). A misread plate or a stale manual entry reaches a traffic stop with nothing in the policy that must stop it.[1]
07Contradicted
Because such data may contain confidential information, it is not open to public review.
The policy itself qualifies this three sections later: public release is decided “case-by-case” under the criminal justice portion of the Colorado Open Records Act (§460.6). And the Flock contract says flatly that “any confidentiality provisions in any contract documents are subject to the provisions of CORA.” Plate data is a criminal justice record with a discretionary release path, not a category closed to the public.[1][3]
08Silent
Fixed ALPR systems are … owned by the Arvada Police Department, the City of Arvada, and leased through third-party vendors.
The policy never names the vendor. A resident reading PM 460 cannot learn that Arvada's fixed cameras are Flock's, that Flock owns them, that Flock can veto their locations, or that Flock holds a perpetual right to use anonymized versions of their data. The city-owned fixed units the line describes appear in no released contract, and their retention period is not stated.[1][3]
The real-time center that ties it together
PM 461 creates the Arvada Real Time Information Center, ARTIC, “a centralized operational unit that integrates live and near-real-time data, technology platforms, and analytical resources to support patrol officers, investigators, and City partners.” Plate readers are one of its inputs, alongside dispatch, records, city-facility cameras, body cameras, drones including Drone First Responder, police databases, and “open source intelligence.” It is run by a commander who reports to the Field Services Deputy Chief.[2]
The policy says each of those technologies “operates under its own established policies and procedures.” That is the gap. Each component has rules. The act of combining them, a plate hit, a camera, and a drone on the same car in the same minute, has none of its own.[2]
Private cameras: defined, then dropped
§461.2.1 defines “Privately Owned Cameras” as any camera or recording system “owned and maintained by a private entity.” The term is never used again. The policy neither authorizes nor prohibits ARTIC's access to them, while the Flock order form offers “direct access to feeds from privately owned” Flock cameras.[2][3]
Gatherings “deemed” hazardous
Among ARTIC's tasks: “Monitoring special events and gatherings deemed to be critical or potentially hazardous in nature.” The policy does not say who deems, on what criteria, or what protects a protest or other First Amendment activity.[2]
No retention period of its own
“All ARTIC data is considered confidential law enforcement information,” retained under general department and state records schedules. The policy states no period for anything ARTIC assembles: clips, stills, analytics or “ALPR data for release.”[2]
Statistics, for whom?
The commander “will be responsible for the documentation of reporting of ARTIC activities and statistics.” Reporting to whom is not stated. Neither policy mentions City Council, an annual report, or any public release of figures.[2]
The 364-day purge is a real limit, well under the three years state law allows. Access requires a login that records “name, date and time.” Nobody may operate the equipment without department-approved training. And both policies put their weakest points in writing rather than hiding them: “no reasonable suspicion,” “should,” “at any time.” A resident can read exactly how little constrains the system, which is more than some departments allow.[1][2]
Five things a resident would expect and will not find
- Colorado's immigration-data law. Neither policy mentions SB25-276, in force since May 2025, which bars making personal identifying information available for federal civil immigration enforcement without a judicial warrant, subpoena or order. The only statute PM 460 cites is C.R.S. §24-72-113.[1][4]
- A single prohibited use. No ban on tracking protests, religious sites, clinics, or individuals for personal reasons, and no stated discipline for misuse.[1][2]
- A reason field. Nothing requires an officer to record a case number or reason when searching a plate.[1]
- The procedures the policy delegates. PM 460 §460.4.1 has the ALPR administrator write the training, monitoring and purging procedures; PM 461 cites them as “RM 460.1.” They were not released.[1][2]
- Facial recognition. The phrase appears in neither policy, for plate readers, city cameras, body cameras or drones: not permitted, not prohibited.[1][2]
Requests that name records which already exist
Police records are generally handled as criminal justice records, where release is at the custodian's discretion. Naming a record that already exists, a stored setting or a system export, is the request least open to a “we would have to create it” answer.
- The Flock sharing configuration as currently set: every agency and network able to search Arvada's cameras, and state and national lookup status.
- The Falcon Flex agreement named in the 2025 contract.
- All invoices, purchase orders and extensions under the March 2023 Flock order form.
- The LexisNexis Risk Solutions agreement PM 460 §460.6 relies on.
- RM 460.1 and the §460.4.1 administrator guidelines.
- Any ALPR audit conducted under §460.7(5), or confirmation that none has been.
- The Flock Deployment Plan: the camera locations.
Sources for this page
- Arvada Police Department, Policy Manual PM 460, “Automated License Plate Readers (ALPR),” effective June 11, 2025, obtained under the Colorado Open Records Act. DOCX
- Arvada Police Department, Policy Manual PM 461, “Arvada Real Time Information Center (ARTIC),” effective July 16, 2026, obtained under CORA. DOCX
- City of Arvada / Flock Group Inc., Master Services Agreement with Exhibits A–E, signed December 3 and 9, 2025, obtained under CORA. PDF
- Colorado Senate Bill 25-276, “Protect Civil Rights Immigration Status,” signed May 23, 2025. leg.colorado.gov