ALPRs collect license plate numbers and location data, plus the date and time the license plates were observed. Some systems capture the make and model of the vehicle or even information what people on the street or drivers look like. These systems can record thousands of license plates per minute. Time, location, and license plate data make it possible for law enforcement agencies to track an individual’s travel and even predict where a driver may be in the future based on their typical travel patterns.
California law says that ALPR data can’t be shared with federal agencies and that data can’t be retained for more than 60 days in most cases. This means it’s illegal for Elk Grove’s data to be shared with ICE, CBP, DEA or any other federal agency, other states’ law enforcement, or private companies.
We know that Flock is not complying with these laws.
According to California Senate Bill (SB) 34, the California Highway Patrol can “retain license plate data captured by license plate recognition (LPR) technology … for not more than 60 days unless the data is being used as evidence for the investigation of felonies.” SB 34 also requires agencies to disclose security breeches to any affected California resident.
Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
California SB 54, which went into effect on January 1, 2018, states that no state and local resources are used to assist federal immigration enforcement.
This bill would, among other things and subject to exceptions, prohibit state and local law enforcement agencies, including school police and security departments, from using money or personnel to investigate, interrogate, detain, detect, or arrest persons for immigration enforcement purposes, as specified, and would, subject to exceptions, proscribe other activities or conduct in connection with immigration enforcement by law enforcement agencies.
In 2023, California attorney general Rob Bonta confirmed that “SB 34 does not permit California LEAs to share ALPR information with private entities or out-of-state or federal agencies.” If Flock were following the law, audits would show that no California data appeared in searches by federal agencies or other states’ law enforcement. This is not the case.
Elk Grove PD states that it routinely conducts internal audits, but has otherwise dismissed concerns. In April 2026, the city council voted to expand Elk Grove’s use of Flock, despite multiple comments calling for an audit before committing to the expanded contract. Elk Grove PD has not released the results of these internal audits to the public.
Audits are our strongest tool in determining whether our data are secure. Technology reporters and privacy watchdogs also play a role in finding ways the Flock system is being exploited.
The Elk Grove PD’s own website says that it shares data with various other California police departments, including cities whose data have appeared in audits. This means that when those cities’ data appear in audits of Flock, Elk Grove’s data may also have been shared out of state or exposed in other ways.
- Multiple police departments have released “completely unredacted Flock audit logs,” which “in some cases include details on millions of Flock license plate searches made by thousands of police departments from around the country.”
- A recent audit in Woodland found more than 3,000 out-of-state organizations directly accessed their Flock data. In addition, Woodland found that agencies searched their data more than 4,500 times with “immigration” as part of the search terms.
- In Mountain View, an audit “showed that the first ALPR camera deployed had been set to a ‘nationwide’ setting by Flock Safety without MVPD’s permission or knowledge.” The ATF (Kentucky and Tennessee), Langley Air Force Base (Virginia), and the GSA Office of Inspector General had all accessed Mountain View’s data.
- A Riverside County Sheriff’s Office audit showed that “law enforcement agencies across Southern California violated state law more than 100 times [in one] month”
- U.S. Senator Ron Wyden (D-OR) publicly released findings from his investigation into Flock’s safety practices. The investigation indicated that data has been exposed to “hackers, foreign spies, and criminals,” and that at least 35 customer account passwords were stolen. That means we have no idea who may currently have access to Flock’s data.
- Flock has left AI-powered cameras exposed to the internet, making them accessible to anyone. This is especially troubling because this variety of camera can focus on people on the street, not just license plates.
Law enforcement agencies search data recorded from Flock or other ALPRs without first getting a warrant. ALPRs form a passive system that does not require law enforcement to monitor it. ALPRs record the license plate and the time and date it passed a camera, whether or not there is a warrant for the driver or a legal justification for monitoring them. Some civil liberties groups have sued local governments, arguing that this particular form of constant surveillance without a warrant is a violation of the Fourth Amendment.
Flock and ALPRs do not stop or prevent crime. At best, they give law enforcement an additional tool to use when investigating crimes. In one city, crime increased after Flock cameras were installed.
If Elk Grove wants to prevent crime, it can invest in proven solutions like increasing street lighting.