Flock cameras and privacy: who gets to watch?

You can cover every face in a family photo, remove the location and decide to keep the whole thing private. Then you drive home past a camera that records the car, the place and the time without needing you to publish anything.

And a roadside plate reader is only one part of this. Flock also sells live-video cameras, and its platform can connect cameras that a business already owns. So the question can extend from who can search your journeys to who can watch the room where your child has a class.

There have been documented problems with both. What you ask your town, school or club needs to depend on which cameras it uses and who has access to them.

A plate number can be enough

Automated license plate readers, or ALPRs, record vehicle sightings that can be searched later. Repeated sightings can reveal a routine without identifying anyone's face. A car outside a clinic doesn't prove who was driving or why they were there, but the record can still lead someone to draw that conclusion.

The names in the reporting refer to different parts of Flock's system:

Flock says its plate readers don't use facial recognition. Its video products can nevertheless detect people and provide live viewing. A promise about facial recognition doesn't tell you whether someone can watch a child on a screen.

Dunwoody's official crime-center description shows how these sources can come together, including plate readers, Condor cameras and third-party video. Ask for the inventory before accepting an answer that only discusses license plates.

The cameras that could be watched without a login

In December 2025, Benn Jordan and security researcher Jon Gaines, who publishes as GainSec, found Flock camera interfaces exposed to the internet. The discovery included live video and recordings that could be viewed without signing in.

404 Media's Jason Koebler went to locations in Bakersfield, California, and watched himself through the exposed cameras. That matters because it demonstrated access to deployed cameras recording everyday life. It wasn't just a possibility inferred from software. 404 Media's December 22 investigation

Jordan's This Flock Camera Leak is like Netflix For Stalkers shows what that access meant around public paths and a playground. He also describes using an outside face-search service to investigate people in the footage. That is a separate identification step, not evidence that Flock itself was running facial recognition.

There is an update to the exposure: in his January 9, 2026 technical account, Gaines reported 67 identified interfaces, mostly associated with PTZ video, and said all 67 were no longer publicly accessible without authentication at his last check. He did not give that check's date or establish how long each had been exposed.

Flock acknowledged the exposure and said it had corrected it in a statement published by Cedar Rapids on December 23. It said the visible material was live and recorded video, with no access to its cloud infrastructure or customer accounts. If your local operator had affected equipment, ask what was exposed, what was corrected and how the correction was checked. An old video cannot establish whether a particular camera is exposed today.

What the hardware research showed

Jordan's We Hacked Flock Safety Cameras in under 30 Seconds. 🫥 covers the earlier work on acquired devices. Gaines documented weaknesses across several Flock products, including ways into device controls and credentials built into software. His research publication links the findings and disclosure history.

Flock's May 2025 advisory acknowledged several device issues and described software and factory-setting changes. Its November response characterized the research as involving physical access and said customers needed to take no action. Those statements addressed the hardware research; they preceded the public-video exposure above.

For a council assessing equipment, the useful follow-up is which deployed models and software versions were affected and whether they were corrected. A demonstration on one acquired device cannot answer that for an entire town.

Jordan's earlier Breaking The Creepy AI in Police Cameras explores plate-reading models and includes other vendors. Its experiments shouldn't be read as proof that a particular trick will stop the cameras near your family from recording or recognizing a vehicle.

A children's gymnastics room used in a sales demonstration

In April 2026, public-records reporting revealed that Flock employees had accessed cameras in Dunwoody, Georgia, for sales demonstrations, including one in a children's gymnastics room at a community center. These included private cameras connected to the city's system. 404 Media's reporting

Flock said the city had explicitly authorized the demonstrations and denied improper conduct. It also said employees would be trained to demonstrate products in more public locations, such as retail parking lots. Flock's response 404 reported that Flock also agreed to stop using Dunwoody's cameras for demonstrations.

The resident who obtained the records, Jason Hunyar, identified a limitation in the live-view logs: they showed when someone started a view, but not when it ended. A long gap before the next logged action doesn't establish that someone watched throughout that gap.

For a parent, there is already a concrete question here without guessing at anyone's motives. If a club permits police access for security, does that arrangement also let the vendor show the room to prospective customers? Who agreed to that, and what were families told?

Ask the club or school:

Are any of your cameras connected to a police or commercial camera network? Which rooms are included, who outside your organization can view or download the footage, and can it be used for product demonstrations or testing?

The school photography guide covers requests about pictures taken and published by a school. Security-camera sharing needs this separate question; declining a social-media photo doesn't answer it.

What the audits actually found

Access to vehicle records has also crossed stated boundaries. In August 2025, the Illinois Secretary of State's office reported that U.S. Customs and Border Protection had accessed Illinois plate data in violation of state law. It ordered the access shut off. Illinois's audit finding

In August 2026, San Mateo County's Civil Grand Jury reported improved sharing controls alongside continuing gaps in policy maintenance, audits and oversight. The grand jury's announcement

A published rule can tell you that a search is prohibited. A completed review can show whether someone checked for it and what happened when they found it. Ask for both.

A new default doesn't tell you your town's setting

Flock announced a seven-day ALPR retention default on August 13, 2026, while keeping existing customers' approved periods. Its Evidence Policy still describes a thirty-day standard unless the agreement says otherwise. Your town's actual setting matters more than either headline.

Flock also said multi-factor authentication became mandatory at the start of August, and announced that required case codes and Audit Assistance would reach all law enforcement customers by year-end. Evidence Mode would let agencies preserve specific records beyond ordinary deletion. The dated announcement

Ask which controls are enabled now and who approves longer storage. When the answer refers to future work, keep the promised date so you can follow up.

Six questions to take to your local council

Look for the police department's camera policy, transparency page or purchase papers. A school or club may need to answer directly about its own cameras.

You can start with:

I'm a local resident asking about our camera network. Please send its current policy, camera inventory, access and sharing arrangements, retention agreement and latest completed audit. Please include any vendor demonstration permissions. If another office holds these records, please point me to it.

If the reply only provides a policy or a list of searches, ask who reviewed the activity and what they found. If nobody replies, follow up through the organization's public-records contact. Disclosure rules vary by location; request the releasable records and reasons for any withheld material.

What this looks like in one city: Palo Alto

Palo Alto's ALPR information page gives residents a starting set of policies and records.

In the August 1, 2026 police manual, Policy 462.3 requires routine data to be purged after thirty days, with specified exceptions. Sections 462.4 and 462.6 require a case or incident number and a lawful search reason, and restrict sharing to California public agencies. The published policy, starting on printed page 455

The June 1 staff report describes monthly sampled search reviews, including outside-agency checks. The attached surveillance policy requires an annual audit memorandum to the police chief. That gives you a specific document to request:

Please send the latest completed search-review memorandum, the current sharing-agreement list and any completed independent assessment of Flock. If a review is still pending, when is it expected?

An older contract packet also calls for vendor security self-audits. Checking whether equipment is secure and checking whether police searches had a proper purpose are separate jobs. A response about one can leave the other unanswered.

Use your own town's documents for the same exercise. Palo Alto's storage period and California sharing boundary won't apply everywhere.

This is where our tool stops helping

Our face-covering app changes a file before you publish it. It can't alter a roadside database or a club's camera permissions.

For the material your family shares, privacy beyond face blur covers the names, locations and other details a covered face can leave behind. For a camera network, take the questions above to the organization operating it. Start by finding out who can access the recordings your family never chose to publish.