The Camera Company Watching Your License Plate Just Added New Rules for Police
Flock Safety announced changes on August 13, 2026, that it calls "guardrails," designed to make it harder for police to misuse the company's license plate reader cameras. The changes include mandatory audit monitoring, required case codes for searches, and a shorter data retention window for new customers. Engadget
The biggest change is Flock's Audit Assistance feature. It used to be optional. Now it is required for all users. The system flags "abnormal search behavior" and locks out suspicious users until an administrator reviews their activity. Flock CEO Garrett Langley told The Verge that making the feature mandatory was "such an obvious way to curb abuse" and acknowledged that Flock should have required it from the start. "We got this one wrong," Langley said. The Verge
Police officers are now required to enter case codes to run searches on Flock cameras. A case code is basically a reason for the search, tied to a specific investigation. The idea is to discourage officers from looking up plates for personal reasons. An administrator can override the case-code requirement in certain scenarios. Flock is also shortening its data retention period, meaning how long it keeps recorded plate data, from 30 days to one week. The shorter window applies only to new customers. Existing customers are allowed to keep their current, democratically approved retention periods. Engadget
The announcement comes after a documented history of misuse. Police officers have reportedly used license plate readers to stalk romantic interests at least 14 times in recent years, according to the Institute for Justice. Several law enforcement officers have been disciplined for misusing data from Flock's cameras, including an officer in Milwaukee. IJ NYT
Flock maintains that each local agency decides where its cameras are placed, who can access the system, and what rules apply, with communities participating through public discussions. The company states that every search and action can be reviewed through permanent audit logs tied to individual users, and that when misuse occurs, the customer agency applies disciplinary action. Flock also reports that 30+ courts have ruled its license plate readers are not mass surveillance because they capture public roadway images, not movement. Flock Safety Flock Safety
Those claims have not gone uncontested. The ACLU has documented that Flock has repeatedly lied to city councils, police departments, and the public about its operations. As of April 2026, some U.S. cities were cutting ties with Flock over privacy concerns, others were signing new contracts, and many were still deciding. Flock CEO Garrett Langley previously called a website that tracks Flock cameras "terroristic" and has since apologized for that language. ACLU The Guardian Forbes
The broader context here is that the most important thing about these changes is not any single feature but the direction they point. By making audit monitoring and case codes mandatory, Flock is moving some oversight from local agency policy into the product itself. Think of it like a car that won't start unless the driver buckles the seatbelt. The safety check lives in the machine, not in the driver's habits. When audit logging is optional, whether it actually gets used depends entirely on local will and staffing. Making it a condition of use builds in a minimum accountability floor that travels with the product regardless of which agency deploys it.
The retention reduction is more complicated than it sounds. Applying the seven-day default only to new customers means existing deployments, many operating under 30-day windows, continue unchanged. Flock frames this as respecting locally democratically approved retention periods. Critics may reasonably note that this leaves the largest installed base operating under the older, longer window.
Langley's candor about the audit requirement is worth noting. A CEO publicly stating "we got this one wrong" is uncommon in the surveillance technology sector, where companies more typically defend existing configurations and frame criticism as misunderstanding. Whether that admission reflects genuine institutional humility or a strategic response to mounting pressure from the ACLU's documentation, city-level contract reviews, and media scrutiny is something readers will assess based on the company's follow-through. The guardrails Flock has described are structural and testable. If Audit Assistance flags abnormal behavior and locks users out, those events should produce auditable records. If case codes are required and overrideable, the override logs will reveal whether the safeguard has teeth or functions as a checkbox.
For anyone who designs or deploys systems that collect sensitive data, the Flock episode is a concrete example of the difference between optional and mandatory controls. The same tension exists in workplace access systems, security architectures, and audit logging across regulated industries. Controls that depend on opt-in tend to be underused. Controls baked into the product flow, enforced at the platform level, are harder to circumvent and easier to verify. Flock's move from optional to mandatory audit is an admission of that principle in practice.
The broader question is whether product-level guardrails are enough to address the harms documented by the IJ and reported by the NYT, or whether they are a necessary but incomplete layer. Audit logging can detect misuse after it occurs. Case codes can deter casual abuse. Neither prevents an officer with legitimate system access from querying data for illegitimate purposes in real time. The lockout mechanism in Audit Assistance is the closest feature to preventive control, but it depends on the system correctly identifying "abnormal" behavior before harm occurs.
Flock's own literature emphasizes that disciplinary action for misuse falls to the customer agency, not to Flock itself. That division of responsibility means the company can build guardrails but cannot enforce consequences. The effectiveness of the new measures will ultimately depend on whether agencies act on what the audit logs reveal.
