Automated licence-plate reader cameras have expanded across American roads, car parks and neighbourhood entrances. Flock Safety is one prominent vendor in this category. The cameras can help an authorised customer search for vehicles connected with investigations, but the same capability raises a privacy question: when ordinary travel is captured at scale, who can search it, how long is it kept and how far can access extend beyond the agency or property that installed the camera?
There is no single national answer. Contracts, state law, agency policy, customer settings, network-sharing choices and court decisions can differ. This guide separates the technical capture from the governance questions a resident, driver or policymaker can verify. It does not claim that every Flock deployment uses identical retention, sharing or alert rules.
The short answer
An automated licence-plate recognition system typically records a plate image or plate characters together with contextual information such as time, location and vehicle characteristics. It is designed to make those observations searchable. The privacy risk comes less from one roadside photograph than from aggregation: repeated sightings can help reconstruct movement.
To assess a local deployment, obtain the contract, data-retention setting, sharing configuration, user and search audit rules, hot-list sources, alert policy, prohibited-use policy and public reporting. Do not rely on a vendor marketing page or a critical article alone.
Evidence matrix
| Question | Evidence to request | Why it matters |
|---|---|---|
| What is captured? | Technical specification, sample record and local privacy policy | Distinguishes plate data from broader vehicle imagery or attributes |
| How long is it kept? | Contract plus live administrator setting and deletion logs | Stated default may differ from local configuration or legal hold |
| Who can search? | Role matrix, account list and authentication policy | A policy is weak if access is broad or shared accounts exist |
| Which agencies receive access? | Network-sharing list, mutual-aid settings and data agreements | Local capture can become regional or interstate access |
| What creates an alert? | Hot-list sources, approval flow and validation procedure | Erroneous or stale lists can cause harmful stops |
| Are searches audited? | Immutable logs, supervisor review and disciplinary policy | Deterrence depends on detection and consequence |
| Can a person challenge misuse? | Complaint, records and correction process | Transparency is incomplete without remedy |
What the system may record
The core function is automatic recognition of a vehicle's licence plate from an image. A record may include the interpreted plate characters, image, date and time, camera location and vehicle details inferred from appearance. The exact fields should be confirmed from the local contract and system, not assumed from a generic description.
This data is different from a conventional traffic camera viewed only after an incident. Searchable ALPR data can answer questions such as whether and when a plate was observed near a location. When many cameras participate, the system can reveal patterns across time and space.
It is also imperfect. Dirty plates, unusual fonts, temporary tags, lighting and occlusion can produce errors. Vehicle-description attributes can be wrong. An alert should therefore be an investigative lead, not proof that a driver committed an offence. Agencies need a validation step before action.
Retention: look for the configured fact
Retention is often debated using one number, but three layers can exist: vendor defaults, customer settings and exceptions such as evidence preservation or legal hold. State-specific provisions may also impose limits. Flock publishes state-required legal provisions, which should be read alongside the specific customer agreement.
A meaningful audit asks for the live retention configuration and deletion evidence. If policy says data is kept for a defined period, administrators should be able to demonstrate that ordinary records age out. Copies exported into a case-management system may follow another schedule. Backups and derived alerts should also be addressed.
Longer is not automatically better for public safety. Retention should be proportionate to a documented purpose. A city should explain why the chosen period is necessary and what would fail with a shorter one.
Sharing: the network is the policy issue
An agency can own a camera yet participate in a wider sharing network. Access may be extended to neighbouring jurisdictions, task forces or other customers under agreements and settings. That can make regional investigations more effective, while also increasing the number of people and purposes that touch local data.
Residents should request the current list of sharing relationships, not just the initial procurement document. Ask whether sharing is always on, case-specific, reciprocal or approved by a supervisor. Determine whether a receiving agency can re-share or export records.
Cross-state access is especially important where laws and policies differ. A local government may prohibit using its data for immigration, reproductive-health or other sensitive investigations, but that prohibition needs contractual, technical and audit enforcement.
The ACLU has raised detailed concerns about Flock's network, representations and customer controls in a current critique of company practices and an earlier analysis of Flock terms and conditions. These are advocacy sources, not neutral technical specifications. They are useful for identifying questions that should be tested against contracts and audit logs.
Search access and authentication
Every search should be attributable to one trained user, tied to a permitted purpose and preserved in an audit log. Shared credentials defeat accountability. Strong access controls include individual accounts, multi-factor authentication, least-privilege roles, prompt deactivation for departing staff and periodic access review.
The system should require a reason or case number where appropriate. Supervisors should sample searches for legitimacy rather than review logs only after a scandal. Policies need a defined consequence for curiosity searches, personal stalking or other misuse.
Ask whether vendor staff can access customer data for support and under what approval. Technical troubleshooting should be logged and time-limited. Access from personal devices should be restricted or managed.
Hot lists and alert validation
Real-time alerts depend on a list or rule that identifies a plate of interest. The source may be a stolen-vehicle database, warrant information or a locally entered plate. Each source can contain stale, ambiguous or erroneous data.
Before a stop or other consequential action, an officer should verify that the plate, state, vehicle and underlying record still match. Local policy should explain the confirmation process and prohibit treating the automated alert as sole probable cause where law requires more.
Auditors should examine false-positive rate, alert disposition and harm. A system that reports many hits but rarely produces valid outcomes may create risk without proportional benefit. Public performance reporting should include errors and complaints, not only success stories.
Public-safety case and proportionality
Supporters point to faster recovery of stolen vehicles, locating wanted vehicles and generating leads after serious offences. Those use cases are concrete. The policy challenge is to capture the benefit without turning every journey into a long-lived, widely searchable record.
Proportionality requires a defined purpose, limited retention, controlled sharing, audited searches and meaningful public oversight. It also requires considering alternatives. A narrowly placed camera with short retention can have a different risk profile from a dense regional network with broad sharing.
El Paso's public materials provide an example of a local government's explanation of an LPR programme in a 2026 city FAQ document. A FAQ is not independent proof that every control works, but it shows the kinds of commitments a city can state and that the public can later audit.
What a city council should approve before purchase
A procurement vote should not be limited to camera count and annual price. The governing body should approve a use policy covering purpose, prohibited searches, retention, sharing, hot lists, access, auditing, public reporting and complaint handling. The contract should preserve local control and provide deletion, export and termination provisions.
Risk review should include cybersecurity, vendor breach notice, subcontractors, insurance and the fate of data after contract end. A pilot should have a fixed duration and success criteria rather than rolling into permanent deployment by inertia.
Public notice should identify camera locations or at least placement categories unless a specific operational reason justifies limited disclosure. Secret infrastructure reduces the public's ability to evaluate distribution and disparate impact.
Driver and resident verification checklist
Use public-records law or the jurisdiction's transparency portal to request:
Executed contract, amendments and current statement of work.
Data fields and technical architecture description.
Live retention and sharing settings, with the date checked.
User-access list by role and the most recent access review.
Search and alert audit policy plus aggregate statistics.
Hot-list sources and validation procedure.
Prohibited-use policy and disciplinary process.
Data-security assessment and breach history.
Complaints, misuse investigations and remedial actions.
Performance results, including false alerts and cases closed.
Redaction may be appropriate for active investigations or security details, but broad secrecy should be justified rather than assumed.
Personal privacy steps and their limits
Drivers generally cannot opt out of a camera observing a plate displayed on a public road. Practical protections therefore focus on governance and adjacent digital exposure. Limit public real-time location posts, secure navigation and vehicle apps, review connected-car data sharing and use strong account authentication.
Do not obscure, alter or unlawfully cover a licence plate. That can create safety and legal consequences. The solution to public surveillance is accountable policy, not unsafe evasion.
For the device layer, the mobile privacy guide and secure phone guide explain permissions, location history and account protection. A secure device cannot prevent roadside plate capture, but it can reduce the additional trail created by apps and compromised accounts.
An approved VERTU privacy context may help explain device controls from the current product knowledge base. It must not imply anonymity from public infrastructure, immunity from lawful process or a guarantee about an external surveillance network.
How to read vendor and advocacy claims
Vendor materials tend to emphasise crimes solved, fast deployment and safeguards. Civil-liberties groups tend to emphasise network scale, policy gaps and misuse potential. Both can supply important evidence and both should be tested.
For each claim, ask: Is it about the product's capability, a default setting, one customer's configuration or a legally enforceable commitment? Is the data current? Can the result be reproduced from an audit? Does a cited case show causation or only association?
The best local assessment triangulates vendor documentation, the executed contract, administrator settings, audit logs, independent reporting, court records and community testimony. No single press release should govern the conclusion.
A governance scorecard
Score a local programme from zero to two on each dimension: purpose limitation, retention minimisation, sharing control, individual access, authentication, audit review, hot-list validation, public reporting, complaint remedy and contract exit. Zero means absent or undocumented; one means policy exists but evidence is incomplete; two means the control is documented, implemented and audited.
A high score does not make surveillance harmless. It shows that the programme has more visible constraints. A low score means expansion should pause until controls are established. Re-score after every contract renewal or material network change.
Final verdict
Flock cameras should be evaluated as a searchable movement-data system, not merely individual roadside cameras. The relevant facts are what a local deployment captures, how long data remains, which agencies can search it, how alerts are verified and whether misuse can be detected and remedied.
The public-safety case and privacy case are not resolved by slogans. A defensible programme needs narrow purpose, proportionate retention, controlled sharing, strong authentication, immutable audit logs and public readback. Drivers cannot assess those safeguards from the pole. Cities and agencies must make the evidence available.
