The Vendor Audit: We Graded Motorola Solutions' ALPR Disclosures Against Its Own Documents. It Got a 46.

The lowest score on the card, and the mirror image of the highest-scoring area on Flock's. Flock earned a 72 there for denying facial recognition consistently, including on the product where denying it was inconvenient. Motorola sells facial recognition — which is a product decision, not a disclosure failure, and is not what is being graded. What is graded is that a reader cannot learn this from the ALPR material. The License Plate Recognition Usage & Privacy Policy governs "the license plate recognition System" and states that LPR data "is not considered personally identifying information (PII)," adding that linking a plate to a person requires separate DMV access under the Driver's Privacy Protection Act. The LPR product pages describe vehicle attributes — "make, model, color, accessories and even unique vehicle features like damage or bumper stickers" — and nothing else. The App Store listing for Vigilant Mobile Companion, published by Vigilant Solutions, Inc. as developer and integrated with "Vigilant LEARN Server," carries a "Scan Face" capability, FaceSearch, "Person ID," gallery and booking-image searches. The same listing's privacy label reads: "The developer does not collect any data from this app" — for an application whose stated function is to "Scan and upload detections." That is the company's only machine-readable privacy disclosure for the field app, and it describes a product that does not exist. The facial recognition is real, disclosed in the store, and absent from every document a resident researching the cameras would be sent to.

Ten points below Flock's retention score, for a structural reason rather than a rhetorical one. Flock's carve-outs were bounded and quantified — a one-year extension requiring elected-official approval, under one percent of images retained for machine learning. Motorola's marketing makes the stronger promise: "Stay in control of your LPR data throughout. Set your own retention rules according to policy." The data-management FAQ repeats it — "As the data is your property, it is held according to the retention policy set forth by you" — and adds a disclosed exception, that Motorola "keeps no record of data after deletion unless metadata archival and classification is requested by the agency." Both statements are accurate about customer-collected data. The governing privacy policy then describes a second category in a single sentence: "The company retains company collected LPR data as long as it has commercial value. The company periodically evaluates the use of historical LPR data to determine if the cost to maintain the data exceeds its value." No period, no ceiling, no customer input, no deletion trigger except a business judgment about cost. The compliance guide separately notes that audit records "are held indefinitely unless specified for deletion by the customer owner." A police department reading the product page is told retention is entirely its own decision. For the dataset the company sells it access to, retention is a line item.

Three company documents give three answers, and only a careful reader holding all three at once can reconcile them. The data-management FAQ is unqualified: all customer-collected data "is the property of the respective customer, and Motorola has no rights or ownership to any of this data." The CJIS compliance guide states the opposite about the other dataset in the same breath as the first — "Corporately, we do not share Vigilant LEARN customer data with anyone as we do not own the data," immediately after "We own the commercial data and what the customers can access." The privacy policy then authorizes company use of "company owned aggregated LPR data" to provide analytics, and names the company "the custodian and owner of the LPR system." These are reconcilable: two datasets, two ownership regimes, consistently maintained. The word doing the damage is any — "no rights or ownership to any of this data" is printed in the FAQ a customer reads, and it is not true of the system as a whole. The heavier finding is a clause with no equivalent anywhere on the Flock card: "The company reserves the right to revise this policy at any point in the future and such changes will be retroactively applicable to data collected prior to any revision of this policy." Every assurance above it is revocable, by the party that wrote it, backwards in time. To the company's credit, it wrote that down rather than leaving it implied.

Motorola never makes Flock's absolute claim — there is no trust page here announcing "It captures vehicles. Not people," and the company gets real credit for not writing a sentence it would have to defend. What it does instead is assert a legal characterization: LPR data "is not considered personally identifying information (PII), or information which directly relates the license plate image to the driver or registered owner," with the policy adding that "law enforcement and other users may have access to vehicle registration information, and other sources of PII, which they may correlate with LPR data." That is candid about correlation, which is more than most vendors concede. Two things pull the score down. First, the same platform's field app matches faces, which makes the not-PII framing a statement about one data type rather than about the system. Second, the policy's own drafting undercuts it: the sentence establishing the PII limit runs into the next one mid-clause — "the driver or registered owner of PII contained in vehicle registration information is protected by federal law" — leaving the central privacy assertion in the governing document grammatically incomplete. Flock's policy had a misspelling; this one has a dropped clause in the load-bearing sentence. The narrower claim also has a defensible core, and this card counts it: a plate photograph genuinely is not a name, and the policy says so without pretending the gap cannot be closed.

The best-documented architecture on the card, and the least well explained to the public. Where Flock answered "Is there a national database of my data? No" while selling a National LPR Network, Motorola never denies the shared pool exists — VehicleManager advertises "access to billions of detections beyond your own." The compliance guide then describes the plumbing with unusual precision: law-enforcement data is "physically (geographically) and also logically separated from our sister subsidiary commercial LPR data partner, DRN," customers "can acquire access to the commercial data, but it is a one-way share," and "Law Enforcement data is not shared with commercial customers." The data FAQ says plainly what the commercial database is: "This data is collected by repossession vehicles." That is a real safeguard, honestly documented, and it runs the protective direction — police data cannot leak to commercial users. The deduction is for what the marketing omits. "Billions of detections beyond your own" does not tell a city council that the detections were gathered by private repossession contractors driving public streets for commercial purposes, that the company owns them outright, or that the one-way valve points toward law enforcement. The FAQ frames the arrangement as privacy architecture — "This is part of meeting CJIS compliance requirements" — which is true of the separation and not of the access. A council approving this system is approving a subscription to a private surveillance archive, and would have to read the compliance guide to know it.

Seven points above Flock's, and earned. Motorola publishes a section-by-section walk through the FBI-CJIS Security Policy with specific answers rather than adjectives, identifies itself precisely as "a private contractor as defined in 5.1.1.5," names FIPS 140-2 certification with a 128-bit minimum, and draws a distinction most vendors elide — that its systems are "completely CJIS compliant, not only compliant because they are 'Hosted in a CJIS Compliant Cloud.'" It also discloses a weakness against its own interest, which is the single most trust-building sentence in any document read for this series: "From the initial detection prior to the data being sent via https, the data is not encrypted." Vendors do not usually volunteer that. Two deductions. The SOC 2 and ISO 9001 credentials cited in the compliance guide belong to Microsoft, the Azure host — "Microsoft is certified ISO 9001:2015... and has been independently audited and verified for compliance under the Statement of Auditing Standards Number 70 [SOC 2 Report]" — not to Motorola's own application layer, and the distinction is not drawn for the reader. And the SOC 2 report itself is "available under a Non-Disclosure Agreement," which means the strongest third-party assurance offered is one a resident or reporter cannot read. Flock lost points for a FedRAMP badge with no written backing; Motorola loses them for borrowing its landlord's certificates.

The largest gap between the two cards, and it runs in Motorola's favor by fifty-five points. Flock's lowest score was a headline statistic appearing at three different magnitudes on three of its own pages. Motorola publishes no comparable aggregate claim at all — no "percent of U.S. crime solved," no crimes-per-week counter, no national effectiveness figure to contradict. What appears instead is agency-attributed and specific enough to check: a Baytown department quoted saying that "within 24 hours of our first training session, we got almost 29,000 license plate reads and had our first lead" — a reads-and-a-lead claim, not a crimes-solved claim, and sourced to the customer rather than asserted by the vendor. A disclosure audit has to score that well; you cannot contradict yourself with a number you never published. The deduction is for the other side of the same coin. Flock at least published its 2025 Impact Census with a disclosed survey design, sample size, and confidence range, which is why the contradiction was findable in the first place. Motorola offers no published effectiveness research whatsoever. Nothing here overstates the product. Nothing here substantiates it either, and a jurisdiction weighing renewal has no vendor-published evidence to weigh.

The strongest area on this card, as it was on Flock's, and by a similar margin for similar reasons. The privacy policy enumerates five fields captured on every query: date and time, "the IP address from which the LPR data is accessed," the plate number or other elements used, "the username of the person who accessed the information and, as applicable, the organization or entity with whom the person is affiliated," and "the purpose for accessing the information." The data FAQ adds that "Required reasoning notation to query the LPR database is mandatory," promises "Full auditing capability, including ANY users from a shared agency querying the data," and lists multi-factor authentication, mandatory logout after inactivity, role-based accounts, and printable audit reports. The compliance guide requires audit review "at a minimum of once a week," retains audit records "indefinitely unless specified for deletion by the customer owner," logs secondary dissemination, and captures "on behalf of" searches — a field Flock does not document, and the one that catches a query run by an officer for someone else. Two deductions, both real. The privacy policy states that "All employees of the company are authorized to use the LPR system" for demonstrations to customers or potential customers, support, and quality assurance, which sits badly against the FAQ's assurance that "Data access is restricted, including to the vendor, and is totally managed by the agency." And the policy is unusually frank about why the logging exists: "because the company considers LPR data a valuable asset of the company, we maintain system and data usage logs." The mechanism is genuine and better documented than the competitor's. Its stated purpose is protecting the asset.