Ordinance · Cambridge, Massachusetts · Ordinance No. 1402, adopted December 2018
Cambridge’s surveillance ordinance
The strongest Stage 1 and Stage 8 in this library. Nothing gets bought, funded, or shared with an outside entity without an impact report, a use policy, and a council vote. The council can turn it off, and in 2026 it did.
8
Meets
15
Partial
0
Fails
3
Missing
of 26 practices this document could address
Cambridge adopted its ordinance in December 2018, the second city on the East Coast to do so. Before the city may seek funds for, acquire, or use a surveillance technology, or enter an agreement with an outside entity to acquire or share one, the city manager must put a Surveillance Technology Impact Report in front of the council: what it is, what it is for, where and when it will run, the privacy and civil-rights impact with a plan to address it, and the full cost. The report is public seven days before the meeting. Using an approved tool “for a purpose, in a manner, or in a location not previously approved” starts the process over, and so does a software upgrade that adds a capability.
Every technology needs a council-approved use policy with ten required elements, including retention period with a stated reason, third-party sharing terms, and oversight mechanisms. Every March the city manager files an annual report per technology: how it was used, whether and how often data was shared and with whom, complaints, violations, effectiveness, records requests, cost, and disparate impact. By May 31 the council holds a hearing and may modify the policy, demand a report, or “disapprove further use.” In June 2026 it disapproved ShotSpotter under that clause. In October 2025 it voted unanimously to halt Flock cameras approved eight months earlier, and the city terminated the contract in December after the vendor installed two more.
The ordinance governs the decision and the disclosure. It sets no retention maximum, imposes no restriction on who may receive data, never mentions federal agencies, and requires no independent audit. Its use policy reads one clause as letting police share data with outside entities without council approval. And when residents requested the ShotSpotter agreement, the city sent them to the regional intelligence center that holds it.
Primary source
Cambridge Municipal Code Chapter 2.128, Surveillance Technology Ordinance (enrolled text as published; current codification on Municode)Read 2026-09-28
Document
Practice by practice
What the document says, or does not say, on each practice in the Standard. Practices this kind of document has no business addressing are marked n/a. These marks are evidence for a jurisdiction’s grade; the document itself gets no score.
Stage 1
Decide
- Meets
§ 2.128.030(C): the impact report must state the technology, “the proposed purpose(s),” locations and timing, privacy and civil-rights impacts with a mitigation plan, and full cost, and be public seven days before the council discusses it.
- Partial
The impact report must describe impacts and a plan to address them. It does not have to show what was tried first or why a less invasive option was rejected.
- Meets
1.3Public notice and a recorded vote
§ 2.128.030: council approval required before “seeking funds for,” acquiring, using, or “entering into an agreement with a non-City entity to acquire, share, or otherwise use” a surveillance technology. Grants and donations included.
Stage 2
Acquire
- Partial
2.1Direct contract, no marketplace add-ons
Agreements with outside entities need approval, which reaches consortium tools like ShotSpotter through the regional homeland security region. The police version of the clause omits the words “or the Surveillance Data it provides,” and the city’s use policy reads it as allowing police to share data with non-City entities without prior approval.
- Meets
2.2Published use policy before deployment
§ 2.128.050: a council-approved use policy with ten mandatory elements, from purpose and prohibited uses to retention, third-party sharing, training and oversight, due within 180 days of the ordinance.
- Partial
No sunset date. The annual report and the May 31 hearing give the council a yearly chance to disapprove, which is a review, not an expiry.
- Missing
2.4No irrevocable license to the vendor
Nothing on vendor licenses to city data.
Stage 3
Deploy
- Meets
3.1Purpose limitation in writing
The use policy must list authorized and prohibited uses. § 2.128.030(3): using a technology “for a purpose, in a manner, or in a location not previously approved” requires new approval.
- Meets
The impact report must state “the location(s) it may be deployed and when.” A new location is a new approval.
- Partial
Impact reports and annual reports are public. No signage requirement.
Stage 4
Use
- Partial
4.1Logged justification for every query
The oversight element requires “internal record keeping of the use of the technology or access to information collected.” No per-query justification standard.
- Partial
4.2Access control and separation of duties
Data access rules and “any independent person or entity with oversight authority” must be described in the policy. Neither separation of duties nor an independent overseer is required.
- Meets
§ 2.128.070(B)(2): after a patch or upgrade, “the department shall not use the new surveillance capabilities of the technology until the requirements of Section 2.128.030 are met.”
- Partial
4.4Misuse is reported like a near miss
The policy must include “technical measures to monitor for misuse” and sanctions; the annual report must list violations and “any actions taken in response.” No duty to investigate or to study the control that failed.
Stage 5
Share
- Partial
5.1No sharing without a published policy
The policy must state “if and how” outside entities can access the data, the legal standard, and obligations on the recipient. The ordinance restricts nothing itself and never mentions federal agencies or immigration.
- Partial
§ 2.128.060(B)(2): the annual report names every recipient entity, the data type, the legal standard and the justification. Vendors’ sub-processors are not covered.
- Partial
The policy must state “any obligation(s) imposed on the recipient.” Deletion is not among the obligations required.
- Partial
5.4Consortium and platform terms are public
Agreements with outside entities need council approval. When residents requested the ShotSpotter agreement, the city directed them to the regional intelligence center and, by its own account, “nothing was provided by the City of Cambridge.”
Stage 6
Retain
- Partial
6.1Shortest retention that serves the stated purpose
The policy must state the retention period, “the reason that retention period is appropriate,” and the deletion process. No maximum. The city’s ALPR policy chose 14 to 30 days.
- Partial
“The process by which the information is regularly deleted” must be written down. Verification is not required.
Stage 7
Audit
- Partial
7.1Independent audit on a schedule
The annual report must include “the results of any non-privileged internal audits.” No audit is required and none has to be independent.
- Partial
7.2Logs available to the oversight body
The council receives the annual report and holds a hearing. It has no direct access to logs.
- Meets
7.3Annual public report with counts
§ 2.128.060: by March 1 each year, per technology: use, sharing frequency and recipients, complaints, violations, effectiveness, records requests, total cost and funding source, disparate impact. Query counts are not among the required items.
Stage 8
Retire
- Meets
§ 2.128.060(C): the council “may ... disapprove further use of the Surveillance Technology.” Used against ShotSpotter on June 1, 2026. Any injured person may sue for an injunction.
- Missing
8.2Exit terms and certified destruction
Nothing on data destruction when a technology is retired. Flock’s cameras came out in October 2025; the ordinance says nothing about the reads.
What to take from it
Read this next to Minnesota’s statute and the two documents govern different halves of the ladder. Cambridge decides, discloses and can turn things off. Minnesota logs, deletes and audits. Neither restricts who receives the data. A city that had both would still need to write the sharing clause itself.