Police-tech firm Flock tightens rules on license plate reader access amid surveillance backlash

Flock, a company operating a nationwide network of 120,000 license plate readers used by law enforcement, announced stricter rules aimed at addressing misuse and a widening backlash over surveillance. The company now requires officers to enter a criminal case number before conducting a search, a feature previously optional that is now mandatory. Flock also expanded a mandatory automatic auditing system designed to flag suspicious search patterns to administrators. The company did not disclose the accuracy of the auditing tool or allow independent evaluation.

The changes follow reporting and advocacy highlighting misuse, including a Washington Post investigation that found 46 cases of officers accused of using Flock’s cameras for unauthorized purposes such as stalking. Civil liberties groups have long called for such safeguards, but past requirements—like entering a reason for a search—have been circumvented by officers using generic terms or mock entries, according to the ACLU.

Flock also recommended that agencies reduce data retention from 30 days to seven, though departments may override this. Additionally, agencies can now restrict cross-agency searches to specific stated reasons, such as allowing searches related to kidnapping but not immigration enforcement. These measures rely on officers to accurately report search purposes.

The policy adjustments come amid broader backlash against Flock, including public statements from figures like Tucker Carlson, city contract cancellations, and laws in some jurisdictions banning or limiting license plate readers. Flock disputes the scale of cancellations, asserting that only a small fraction of its 5,000 agency contracts have been dropped. The company’s CEO attributed customer losses partly to misinformation, while acknowledging a shift from optional safeguards toward enforced guardrails.

Critics, including the ACLU, argue the changes are incremental and insufficient without independent oversight and structural limits on data collection and warrantless access. They call for transparent, independently verifiable auditing and stricter limits on data retention and search purposes.