Pressure has been mounting on Flock Safety concerning it’s Automated License Plate Reader system. It’s widespread adoption across the United States has reached a level of public awareness and pushback that led the Georgia-based company to release an “update” to it’s policies, dated August 13, 2026. The cat of 24/7 surveillance and abuse by law enforcement officials is out of the bag, and it has startled the flock. Here are some highlights to it’s new policies, and some comments. (See the list at the end of this blog for all of the articles I’ve posted on the Flock system.)
Privacy
When we started Flock 9 years ago, we set the default ALPR retention period to 30 days, unless state or local policy decided on a shorter or longer period. We believed this struck a careful balance between safety and privacy.
Today, we are updating our recommendation and default to a 7-day retention, and introducing “Evidence Mode.” Our analysis shows that over 90% of searches without a full plate are done within a week. Evidence Mode, which will roll out in the coming weeks, addresses the exceptional cases that take longer: detectives can preserve specific ALPR data as evidence for an active investigation in cold storage, consistent with existing laws and policies.
“Recommendation and default” to 7-day retention. That doesn’t indicate that the customer agency can’t choose the 30-day and ignore the 7-day option. I suspect many agencies will opt for the 30-day setting. The “evidence mode” will probably be useful in ongoing cases.
Existing customers will keep their current, democratically approved retention periods. Customers who adopt the 7-day recommendation will receive Evidence Mode at no cost. Every community will continue to choose the retention period that fits its public safety strategy.
So this means every agency already using the Flock Automated License Plate Reader system (currently at more than 5,000 agencies, according to Flock) will continue with the 30-day data retention plan. Only new customers will have operate under the new “option” to only keep data for 7 days. Shall we take a wild guess at how many will opt for something other than the “default” suggestion?
And that “democratically approved” line is an attempt to mask that most agencies received approval from their city councils or county board of supervisors in the “consent calendar” agenda. That usually means no public discussion by the body, and the only members of the public that knew about it were those who bother to read the consent calendar and it’s agenda packets. Most communities never realized their leaders had bought (leased, actually) the system until problems started hitting the press. That’s how the Visalia, Porterville, and Farmersville city councils approved the contracts. The police departments asked, the cities put the items on the consent agendas, and they were approved with no discussion.
We are also introducing Offense filtering for sharing. Now, cities can choose which type of offenses are permissible for other agencies to access their cameras. For example, City A could allow City B to search its cameras only for a stolen vehicle, missing person, or violent crime while blocking searches related to immigration enforcement. This gives communities more control over data sharing while preserving collaboration where policies align.
This will require agencies to use the exact same codes for access to data from another agency. Computers are notoriously literal-minded, and see ‘INVESTIGATION’ as a different code than ‘investigation’. The California code for stolen vehicle is ‘10851’. If it’s entered as ‘stolen vehicle’, that’s a different offense as far as the computer is concerned. Most agencies will likely not activate ‘Offense filtering’, and just let other agencies have access. I suspect few will institute this option.
Accountability
Abuse of Flock technology, at any level, is unacceptable. We have strengthened safeguards over the past nine years, from basic audit logs to proactive monitoring. 16 weeks ago, we introduced Audit Assistance, which detects abnormal activity and flags it for Administrator review. In recent weeks, those reviews have been associated with arrests of several law enforcement officers who allegedly abused the system. More than one-third of our customers have voluntarily adopted Audit Assistance.
Just now they’re instituting more robust methods of detecting unauthorized abuse. Most past abuses have been brought to light by news media or citizen auditing of access logs, not by the departments involved themselves.
We will now require all law enforcement customers to adopt this feature by the end of this year. In addition, we will institute proactive lockout. When a user’s activity meets defined criteria for abnormal behavior, Flock will automatically suspend access pending administrator review. The goal is to intervene before misuse becomes recurring or widespread.
They’re going to take three months to institute these procedures, while current abuse goes unchecked.
In July 2025, we introduced an optional case code requirement for searches. Results from participating agencies have been promising, so we will now require case codes for all law enforcement searches by the end of the year. Agencies may bypass the requirement in emergencies, but every exigent search will be flagged for administrator review.
Only a year ago did they introduce an “optional” requirement that searches be tied to a specific case number. This allowed agencies to ‘opt out’ (or just never ‘opt in’) to this, resulting in searches listed as “investigation”, “stolen”, or “theft”. A case number should always have been required.
Data Ownership
From the beginning, we have been clear that our customers own the data captured by their ALPR cameras. This has always been the case, but some of our contractual language has confused the public on this crucial point. To make that commitment easier to understand, next week we will publish an easy to read / plain English explanation of our contract on our website, organized section by section. The principle is simple: customers own the data, decide who can access it, and choose who they share it with.
The contract signed by the City of Visalia states, in three places, that data generated by the Flock cameras utilized by the Visalia Police Department is owned by the city, and will not be sold to other parties. The same contract also says:
- DATA USE AND LICENSING
4.1 Customer Data. As between Flock and Customer, all right, title and interest in the Customer Data, belong to and are retained solely by Customer. Customer hereby grants to Flock a limited, non-exclusive, royalty-free, irrevocable, worldwide license to use the Customer Data and perform all acts as may be necessary for Flock to provide the Flock Services to Customer. Flock does not own and shall not sell Customer Data.
- 4.2 Customer grants Flock a non-exclusive, irrevocable, worldwide, royalty-free, license to use the Customer Generated Data for the purpose of providing Flock Services. Flock does not own and shall not sell Customer Generated Data.
- 4.3 Anonymized Data. Flock shall have the right to collect, analyze, and anonymize Customer Data and Customer Generated Data to the extent such anonymization renders the data nonidentifiable to create Anonymized Data to use and perform the Services and related systems and technologies, including the training of machine learning algorithms. Customer hereby grants Flock a non-exclusive, worldwide, perpetual, royalty-free right to use and distribute such Anonymized Data to improve and enhance the Services and for other development, diagnostic and corrective purposes, and other Flock offerings. Parties understand that the aforementioned license is required for continuity of Services. Flock does not own and shall not sell Anonymized Data.
They claim “some of their contractual language has confused the public”, and they’re going to release a “plain English” explanation of their contracts. There contracts also say this:
- MISCELLANEOUS
11.1 Compliance With Laws. Parties shall comply with all applicable local, state and federal laws, regulations, policies and ordinances and their associated record retention schedules, including responding to any subpoena request(s).
Maybe I’m “confused”, but that reads to me that they’ll give up those data files to anyone with a subpoena. I’m not confident Flock will stand up to an “administrative subpoena” issued by ICE or DHS. We’ll see what the “plain English” notice says. I’m also wondering about their 3-times repeated comment that Flock does not own and will not sell customer data. They won’t sell it, but does saying the agency owns it’s data mean that Flock, while it won’t ‘sell’ it, can give it away? Like to AI training? (That is a term in the contract. They’ll use “anonymized” data to train “machine learning algorithms”. Who else?)
There’s been a growing pushback against Flock for several years, and it’s reached a tipping point. They’re now adjusting their contracts and attempting to make “options” look like the operating standards. The 7-day retention is a choice, not a requirement, as some media sources are reporting. New contracts can still opt for the 30-day retention, and existing users don’t have to change, either.
This action by Flock is much like that line from Macbeth, “Told by an idiot, full of sound and fury, signifying nothing”. It is doubtful most agencies will lock themselves into 7-day time frames unless their controlling governments force it upon them. On their own, they’ll opt for the 30-day, and possibly longer, if that option is afforded to them. I don’t mean that as a slam, but it would be organizationally logical to take advantage of the abilities presented.
The real problem is the warrantless dragnet collection of data on citizens in every community with these cameras (of whatever brand, it’s not just Flock). Courts are finding similar mass data-gathering to be in violation of the 4th Amendment, and eventually one will make it to the Supreme Court of the United States dealing with license plate readers. While Flock and others insist there is no facial recognition capability, it’s only a matter of time and software development. The cameras are already technologically advanced to provide that data, it just has to be programmed. It’s just a matter of time.
Here are my previous Flock-related posts:
Needles in the Flock Haystack
October 9, 2026
Jim Reeves commentary, News, Personal ai, ALPR, Flock, Flock Camera, flock liccense plate reader, License Plate Reader, News, technology, visalia, Visalia Police, VPD Leave a comment
On September 10, 2026, I filed a California Public Records Act request of the City of Visalia, and the Visalia Police Department. On October 5, I got my response.
A lot to digest there, but let’s start with “5. The Department’s case/incident number is withheld.” A lot of verbiage to deny giving me the case numbers associated with each incident that was allegedly solved with the use of the Flock ALPR system.
They’re also saying they don’t have to release “arrest and incident information” that is more than a year old, and that “much” of my requested information predates that by “many months”, but they are giving it to me (minus what they decided to withhold) “in the interest of transparency”.
They tell me how generous they were being by including information that was more than a year old, citing a court case that they claim means they didn’t have to.
Visalia, I hate to say it, but “transparency” went out the window a long time ago. (Encrypting police radio transmissions and removing a data field on the Flock transparency page was just the beginning.)
Other information gleaned from the “response” –
From January 1, 2025 through May 29, 2026, there were 123 incidents solved which were attributed to Flock ALPR use by the Visalia Police Department.
To justify mass surveillance, proponents of ALPR systems often talk about two types of incidents: missing persons, and stolen cars. In Visalia’s record, there are no cases of missing persons found using the Flock system. Out of 123 incidents that were attributed to the Flock system, only 45 are stolen vehicles.
Six were violent crimes – assault with a deadly weapon, armed robbery, and a home invasion.
The rest of the cases “solved” by Flock ALPR data are not classified as violent crimes.
I had asked for location information, as well. Either addresses of incidents, or the hundred block and street name. They refused to provide that, stating the “existing” data only listed VPD “area” zones, and they didn’t have to provide the address or location information more detailed than that.
In the time period covered by the data released, Flock ALPR cameras took more than 5,950,000 images of license plates. Perhaps many more. The “transparency” page lists an average monthly “unique plate reads” of more than 300,000 every 30 days. Multiply that by the 17 months of data released, and the total number surveillance images is staggering.
And, at $3,000 a year per camera, expensive. (The cameras are not bought by and owned by Visalia. They are a subscription. The cameras and related equipment remain the property of Flock.)
Share this:
Like this: