AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
San Francisco Moves Toward Limits on Police Drones
San Francisco's Police Commission has approved the department's first comprehensive drone-use policy, according to The San Francisco Standard's reporting yesterday. With police already conducting more than 600 flights monthly, the rules would put retention limits and surveillance restrictions around a substantial existing operation. Further approvals remain pending.
Separate reporting covered a Japanese app-data breach disclosed October 15 and a September ruling keeping Apple biometric claims alive. These are different kinds of developments: proposed operational limits, incident response and unresolved litigation—not a single turn in privacy regulation.
The San Francisco policy generally limits drone-footage retention to 30 days, with up to two years allowed through senior approval for an open criminal investigation. It also requires a warrant to record inside homes and prohibits monitoring based solely on protected characteristics or constitutionally protected activity. Critics argue that broad permitted purposes and weak oversight leave room for recording protests and unrelated people. Union review and Board of Supervisors approval remain outstanding.
Shattered reported that BK Japan disclosed unauthorized access to its app membership-management system, exposing approximately 11.18 million records. The reported information included names, contact details and demographic data. That is a record count, not a verified count of affected people. The company notified Japan's Personal Information Protection Commission; no regulatory finding or enforcement action is reported.
All About Cookies revisited a September decision denying most of Apple's summary judgment motion in an Illinois biometric-privacy case. Questions about whether Photos generates covered face geometry and performs identification remain for trial. This was not a new October ruling, a liability finding or an announced product change.
Key Points
- For San Francisco's drones, the practical force of a retention limit depends on its exceptions. A 30-day default and a potential two-year investigative period create materially different exposure; final approval and oversight will determine how that distinction works.
- The Apple dispute shows why a privacy-oriented technical design does not settle statutory coverage. Apple's arguments about encrypted, user-controlled data remain distinct from the contested legal questions about what the software generates and who controls processing.
Implications
Compliance teams should distinguish procedural movement from settled obligations. Commission approval does not complete San Francisco's policy process; surviving summary judgment does not establish Apple's liability; notifying a regulator does not establish a violation.
BK Japan's reported combination of contact and demographic information creates potential for targeted fraud even though the company says payment-card information was excluded. Password exposure and confirmed misuse remain unverified, making precise customer guidance and verified findings especially important.
Watchpoints
Watch
Whether San Francisco's remaining reviews change permitted drone uses, retention exceptions or oversight—and what rules ultimately receive approval.
Watch
BK Japan's verified affected-person count, findings on passwords, customer remediation and any response from the Personal Information Protection Commission.
Watch
Apple trial scheduling and further rulings on covered biometric information, identification and control over processing.
Fallout
The most concrete policy movement concerns police drones. The breach and biometric case carry separate operational and legal risks, with neither a regulatory outcome nor liability established.
Police Drone Retention and Oversight
San Francisco is considering operational limits for an already heavily used surveillance tool. The important question is how restrictive the final rules will be in practice.
Fresh developments
The San Francisco Standard reported commission approval of the first comprehensive police drone-use policy. It includes a general 30-day footage limit, an investigative exception allowing up to two years with senior approval, restrictions on protected-activity monitoring and a warrant requirement for recording inside homes. Further approvals remain pending.
Why we noticed
At more than 600 flights monthly, retention and permitted-use rules affect an existing operation rather than a hypothetical deployment. Critics' concerns about broad purposes and oversight remain unresolved; approval alone does not demonstrate effective safeguards.
Watch for:
- Completion of union review and Board of Supervisors consideration.
- Changes to retention exceptions, permitted purposes and oversight provisions.
BK Japan App-Data Exposure
The reported exposure puts incident scope, customer protection and regulatory follow-through at issue, without establishing how many unique people were affected.
Fresh developments
Shattered covered BK Japan's October 15 disclosure of approximately 11.18 million exposed app records. Unauthorized access reportedly occurred October 2–7 and was discovered October 13. The company reported the incident to Japan's Personal Information Protection Commission.
Why we noticed
The combination of contact and demographic information could support targeted fraud. BK Japan says card information was excluded, but that does not resolve password exposure or potential misuse. The account remains single-source.
Watch for:
- A verified count of affected people and clarification of password exposure.
- Customer remediation, confirmed misuse and any regulator response.
Article links:
Apple Photos and Biometric Consent
The Illinois litigation tests whether consumer photo-grouping features fall within biometric-privacy consent requirements.
Fresh developments
All About Cookies reported on the September ruling allowing most claims to proceed toward trial. Plaintiffs allege unlawful faceprint creation. Apple disputes that characterization, saying its numerical groupings cannot reconstruct faces and encrypted album data remains user-controlled.
Why we noticed
The unresolved distinction is between technical safeguards and legal coverage. Neither Apple's design arguments nor the case's continuation establishes whether the challenged processing violates the law.
Watch for:
- Trial scheduling and decisions on face geometry and identification.
- How the court addresses competing arguments about control over processing and data.
Final Thought
The clearest movement is toward rules for surveillance already in use. Whether those rules meaningfully limit exposure will depend less on their headline prohibitions than on their exceptions and oversight.