JimmieJoe / KC6YRU

Pressure has been mounting on Flock Safety concerning it’s Automated License Plate Reader system. It’s widespread adoption across the United States has reached a level of public awareness and pushback that led the Georgia-based company to release an “update” to it’s policies, dated August 13, 2026. The cat of 24/7 surveillance and abuse by law enforcement officials is out of the bag, and it has startled the flock. Here are some highlights to it’s new policies, and some comments. (See the list at the end of this blog for all of the articles I’ve posted on the Flock system.)

Privacy

When we started Flock 9 years ago, we set the default ALPR retention period to 30 days, unless state or local policy decided on a shorter or longer period. We believed this struck a careful balance between safety and privacy. 

Today, we are updating our recommendation and default to a 7-day retention, and introducing “Evidence Mode.” Our analysis shows that over 90% of searches without a full plate are done within a week. Evidence Mode, which will roll out in the coming weeks, addresses the exceptional cases that take longer: detectives can preserve specific ALPR data as evidence for an active investigation in cold storage, consistent with existing laws and policies.

“Recommendation and default” to 7-day retention. That doesn’t indicate that the customer agency can’t choose the 30-day and ignore the 7-day option. I suspect many agencies will opt for the 30-day setting. The “evidence mode” will probably be useful in ongoing cases.

Existing customers will keep their current, democratically approved retention periods. Customers who adopt the 7-day recommendation will receive Evidence Mode at no cost. Every community will continue to choose the retention period that fits its public safety strategy.

So this means every agency already using the Flock Automated License Plate Reader system (currently at more than 5,000 agencies, according to Flock) will continue with the 30-day data retention plan. Only new customers will have operate under the new “option” to only keep data for 7 days. Shall we take a wild guess at how many will opt for something other than the “default” suggestion?

And that “democratically approved” line is an attempt to mask that most agencies received approval from their city councils or county board of supervisors in the “consent calendar” agenda. That usually means no public discussion by the body, and the only members of the public that knew about it were those who bother to read the consent calendar and it’s agenda packets. Most communities never realized their leaders had bought (leased, actually) the system until problems started hitting the press. That’s how the Visalia, Porterville, and Farmersville city councils approved the contracts. The police departments asked, the cities put the items on the consent agendas, and they were approved with no discussion.

We are also introducing Offense filtering for sharing. Now, cities can choose which type of offenses are permissible for other agencies to access their cameras. For example, City A could allow City B to search its cameras only for a stolen vehicle, missing person, or violent crime while blocking searches related to immigration enforcement. This gives communities more control over data sharing while preserving collaboration where policies align.

This will require agencies to use the exact same codes for access to data from another agency. Computers are notoriously literal-minded, and see ‘INVESTIGATION’ as a different code than ‘investigation’. The California code for stolen vehicle is ‘10851’. If it’s entered as ‘stolen vehicle’, that’s a different offense as far as the computer is concerned. Most agencies will likely not activate ‘Offense filtering’, and just let other agencies have access. I suspect few will institute this option.

Accountability

Abuse of Flock technology, at any level, is unacceptable. We have strengthened safeguards over the past nine years, from basic audit logs to proactive monitoring. 16 weeks ago, we introduced Audit Assistance, which detects abnormal activity and flags it for Administrator review. In recent weeks, those reviews have been associated with arrests of several law enforcement officers who allegedly abused the system. More than one-third of our customers have voluntarily adopted Audit Assistance. 

Just now they’re instituting more robust methods of detecting unauthorized abuse. Most past abuses have been brought to light by news media or citizen auditing of access logs, not by the departments involved themselves.

We will now require all law enforcement customers to adopt this feature by the end of this year. In addition, we will institute proactive lockout. When a user’s activity meets defined criteria for abnormal behavior, Flock will automatically suspend access pending administrator review. The goal is to intervene before misuse becomes recurring or widespread.

They’re going to take three months to institute these procedures, while current abuse goes unchecked.

In July 2025, we introduced an optional case code requirement for searches. Results from participating agencies have been promising, so we will now require case codes for all law enforcement searches by the end of the year. Agencies may bypass the requirement in emergencies, but every exigent search will be flagged for administrator review.

Only a year ago did they introduce an “optional” requirement that searches be tied to a specific case number. This allowed agencies to ‘opt out’ (or just never ‘opt in’) to this, resulting in searches listed as “investigation”, “stolen”, or “theft”. A case number should always have been required.

Data Ownership

From the beginning, we have been clear that our customers own the data captured by their ALPR cameras. This has always been the case, but some of our contractual language has confused the public on this crucial point. To make that commitment easier to understand, next week we will publish an easy to read / plain English explanation of our contract on our website, organized section by section. The principle is simple: customers own the data, decide who can access it, and choose who they share it with. 

The contract signed by the City of Visalia states, in three places, that data generated by the Flock cameras utilized by the Visalia Police Department is owned by the city, and will not be sold to other parties. The same contract also says:

4. DATA USE AND LICENSING
   4.1 Customer Data. As between Flock and Customer, all right, title and interest in the Customer Data, belong to and are retained solely by Customer. Customer hereby grants to Flock a limited, non-exclusive, royalty-free, irrevocable, worldwide license to use the Customer Data and perform all acts as may be necessary for Flock to provide the Flock Services to Customer. Flock does not own and shall not sell Customer Data.

• 4.2 Customer grants Flock a non-exclusive, irrevocable, worldwide, royalty-free, license to use the Customer Generated Data for the purpose of providing Flock Services. Flock does not own and shall not sell Customer Generated Data.

• 4.3 Anonymized Data. Flock shall have the right to collect, analyze, and anonymize Customer Data and Customer Generated Data to the extent such anonymization renders the data nonidentifiable to create Anonymized Data to use and perform the Services and related systems and technologies, including the training of machine learning algorithms. Customer hereby grants Flock a non-exclusive, worldwide, perpetual, royalty-free right to use and distribute such Anonymized Data to improve and enhance the Services and for other development, diagnostic and corrective purposes, and other Flock offerings. Parties understand that the aforementioned license is required for continuity of Services. Flock does not own and shall not sell Anonymized Data.

They claim “some of their contractual language has confused the public”, and they’re going to release a “plain English” explanation of their contracts. There contracts also say this:

11. MISCELLANEOUS
    11.1 Compliance With Laws. Parties shall comply with all applicable local, state and federal laws, regulations, policies and ordinances and their associated record retention schedules, including responding to any subpoena request(s).

Maybe I’m “confused”, but that reads to me that they’ll give up those data files to anyone with a subpoena. I’m not confident Flock will stand up to an “administrative subpoena” issued by ICE or DHS. We’ll see what the “plain English” notice says. I’m also wondering about their 3-times repeated comment that Flock does not own and will not sell customer data. They won’t sell it, but does saying the agency owns it’s data mean that Flock, while it won’t ‘sell’ it, can give it away? Like to AI training? (That is a term in the contract. They’ll use “anonymized” data to train “machine learning algorithms”. Who else?)

There’s been a growing pushback against Flock for several years, and it’s reached a tipping point. They’re now adjusting their contracts and attempting to make “options” look like the operating standards. The 7-day retention is a choice, not a requirement, as some media sources are reporting. New contracts can still opt for the 30-day retention, and existing users don’t have to change, either.

This action by Flock is much like that line from Macbeth, “Told by an idiot, full of sound and fury, signifying nothing”. It is doubtful most agencies will lock themselves into 7-day time frames unless their controlling governments force it upon them. On their own, they’ll opt for the 30-day, and possibly longer, if that option is afforded to them. I don’t mean that as a slam, but it would be organizationally logical to take advantage of the abilities presented.

The real problem is the warrantless dragnet collection of data on citizens in every community with these cameras (of whatever brand, it’s not just Flock). Courts are finding similar mass data-gathering to be in violation of the 4th Amendment, and eventually one will make it to the Supreme Court of the United States dealing with license plate readers. While Flock and others insist there is no facial recognition capability, it’s only a matter of time and software development. The cameras are already technologically advanced to provide that data, it just has to be programmed. It’s just a matter of time.

Here are my previous Flock-related posts:

• What the Flock?
• Well, Flock Me!
• More Flock, more fun
• Flock you later
• Flock the Lawyers
• Flock Me A Little Bit
• Tick tock tick Flock
• The Final Flock – and the answer is “NO”
• Hidden in the Flock
• Reason me this, Flock
• Flock Me – Round 2
• Another Flock of Cameras in Visalia