Flock Adds New Controls After Police Plate-Reader Misuse Cases

Flock Safety announced a package of automatic licence-plate reader changes on 13 August. By the end of 2026, it says Audit Assistance, which flags abnormal searches, will be required for all law-enforcement customers. Accounts meeting its criteria will be suspended pending administrator review, and searches will require investigation-linked case codes except in emergencies.

Flock also says its recommended and default retention period will fall from 30 days to seven. A forthcoming Evidence Mode can preserve specific records for an active investigation, and new controls can let an agency share its camera data for some offence types while blocking others. Existing customers are not automatically moved from retention periods already approved locally.

The Record linked the changes to cases in which officers were accused of using plate-reader searches to track former partners or other people for personal reasons. A large cross-agency database can turn a routine roadside observation into a history of where a vehicle appeared, making insider access and secondary use central privacy questions.

Shorter retention can reduce how much historical movement data is available after the fact. Automatic lockouts and documented case codes may also make misuse harder or easier to investigate, but their value depends on detection quality, administrator response and whether the reason entered for a search is genuine.

The ACLU says there is no evidence showing how consistently Audit Assistance detects misuse. It also argues that requiring a stated search purpose has failed before because a user could enter a false justification, and that the seven-day setting will not limit customers that retain longer locally approved periods.

Flock separately says it is commissioning an independent security assessment, requiring multi-factor authentication and creating additional transparency tools. Those commitments should be judged by published results, adoption and enforceable policy rather than the announcement alone.

A VPN can hide a user's usual public IP address from many online services and protect traffic from local network observers. It cannot prevent a physical camera seeing a vehicle, change a licence plate or remove an observation already stored in an ALPR database.

Turning off a phone or changing app permissions does not solve vehicle-camera tracking either. The effective controls are narrow data collection, short retention, strict access, tamper-resistant logs, independent auditing, meaningful penalties and democratic oversight of where systems are deployed and shared.

The announcement illustrates an important boundary in consumer privacy advice: online privacy tools cannot solve every form of location surveillance. A travel trail assembled from cameras sits outside the encrypted tunnel between a phone or laptop and a VPN server.

Seven-day default retention is more privacy-protective than 30 days, but a default is not a universal limit. The next useful evidence will be how many customers adopt it, whether the auditing system is independently evaluated and whether communities can see and challenge the rules governing their local cameras.