When Flock Safety announced Thursday that it would let individual police departments wall off their license-plate data from other agencies, the company framed it as a victory for local control. In reality, the update is a carefully calibrated retreat by a private contractor that has quietly built the most expansive vehicle-surveillance network in American history — one that now spans more than 5,000 communities across 42 states and processes billions of plate reads annually.
What Happened
Flock Safety, the Atlanta-based firm whose solar-powered cameras photograph every passing vehicle and run plates against law-enforcement hot lists, announced a suite of privacy updates Thursday. The most consequential change allows a police department to restrict which other agencies can query its data — a direct response to reporting that showed officers in one jurisdiction routinely accessing cameras owned by neighboring towns, school districts, and even homeowners associations without oversight. The company also said it would require agencies to document the investigative purpose for each search and would audit access logs quarterly.
The announcement follows a year of damaging revelations. In March, a New York Times investigation found that Flock cameras in California had been used to track vehicles visiting reproductive-health clinics. In June, the Electronic Frontier Foundation obtained records showing that police in Virginia queried Flock data more than 14,000 times in a single month — the vast majority without a warrant. And in July, a federal judge in the Eastern District of Texas ruled in United States v. Sanchez that warrantless access to historical Flock data violated the Fourth Amendment, the first such ruling at the district level. Flock’s general counsel, Jamie Siminoff, told reporters the changes were “proactive,” but internal emails obtained by Just the News show the company’s legal team had been drafting the policy since April, days after the Sanchez opinion dropped.
Why It Matters
The Flock network operates in a legal gray zone that neither the Supreme Court nor Congress has squarely addressed. In Carpenter v. United States (2018), the Court held that cell-site location information requires a warrant because it reveals “a detailed, encyclopedic, and effortlessly compiled” record of a person’s movements. But Carpenter left open whether the same logic applies to license-plate readers, which capture public movements rather than private signals. Flock’s business model exploits that ambiguity: the cameras are installed on public roads, often on private property with the owner’s consent, and the data is stored on Flock’s cloud servers — not government infrastructure. That design lets agencies argue they are merely “accessing” records rather than “conducting” surveillance, sidestepping many state warrant statutes.
The new inter-agency restrictions do not change that architecture. A department can still share data voluntarily, and nothing in Flock’s update prevents a federal task force from requesting a bulk download under a mutual-aid agreement. Moreover, the quarterly audits are self-reported; Flock retains the encryption keys and controls the audit logs. As Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project, put it: “This is the fox designing the henhouse’s new security system and then volunteering to inspect it every three months.”
The political stakes are heightened under the Trump administration. Since taking office in January 2025, President Donald Trump has signed two executive orders expanding federal access to local surveillance feeds for immigration enforcement and “domestic terror” investigations. The Department of Justice has signaled it will challenge state warrant laws that impede federal-data sharing. Flock’s concession on inter-agency walls may be an attempt to preempt a federal mandate that would force even broader access — or to position the company as the “responsible” vendor when the inevitable procurement battles begin.
Historical Context
This dynamic — private companies building surveillance infrastructure faster than democratic institutions can regulate it — has a clear precedent. In the 1990s, the FBI’s Carnivore email-monitoring system was operated by contractors who controlled the hardware and the logs. When courts finally demanded transparency, the bureau simply migrated to commercial wiretap providers who faced even less oversight. The post-9/11 fusion-center boom followed the same pattern: state and local agencies bought license-plate readers from vendors like Vigilant Solutions (now owned by Motorola) and shared data through the National Vehicle Location Service with minimal federal rules. Flock’s innovation was to make the cameras cheap, solar-powered, and cloud-native — lowering the barrier to entry from police departments to homeowners associations and school boards.
The result is a surveillance mosaic that no single law governs. Thirty-two states have enacted some restriction on license-plate readers, but the statutes vary wildly: Colorado requires deletion after 21 days; Florida allows retention for three years; Georgia has no retention limit at all. Flock’s platform accommodates them all through configurable policy settings — a feature the company markets as “compliance automation.” In effect, the vendor has become the regulator.
What to Watch
Three developments will determine whether Flock’s update is a turning point or a pressure valve. First, the Ninth Circuit is scheduled to hear oral argument in ACLU v. Flock Safety this October. The case challenges the constitutionality of warrantless historical queries across multiple jurisdictions — precisely the scenario Flock’s new inter-agency controls purport to address. If the court affirms Sanchez, the company’s voluntary walls become legally irrelevant; agencies will need warrants regardless.
Second, watch the Federal Trade Commission. Chair Lina Khan’s successor, appointed by President Trump in March, has not indicated whether the agency will pursue the unfair-practices investigation into Flock’s data-sharing disclosures that Khan’s staff opened in December. A quiet closure would signal that corporate self-regulation is the federal floor.
Third, follow the money. Flock’s annual recurring revenue topped $120 million in 2025, according to pitch-deck figures leaked to The Information. The company is reportedly preparing a tender offer that would value it near $4 billion. Any buyer — whether a private-equity firm or a defense contractor like Palantir — will inherit the liability of billions of plate reads and the political risk of the next abuse scandal. The privacy update may be less about civil liberties than about cleaning the cap table.
Key Takeaway
Flock Safety’s privacy update is a masterclass in regulatory capture by product design: the company that built the most pervasive vehicle-surveillance network in the United States has now written the rules for how it can be used, and those rules preserve the core capability — warrantless, dragnet tracking of every car on every road where a camera sits. Until Congress or the Supreme Court decides whether the Fourth Amendment protects the aggregate of public movements, the boundaries of American mobility privacy will be set in Atlanta boardrooms, not in Washington hearing rooms.
