Flock cameras and privacy: who gets to search your journeys?

We can spend quite a lot of time deciding which family photos to put online. Cover the faces. Remove the location. Ask everyone else to do the same.

Then we get in the car.

A camera beside the road doesn't need us to publish anything. It can record a vehicle, a place and a time. And if enough of those sightings are kept and made searchable, the question becomes much bigger than whether someone can see your face.

That's why I'm including Flock cameras in a family privacy guide. A history of where a car goes can say something about the people inside it. Editing our own photos won't fix that, and I don't want to sell you the idea that it will.

This article looks at the controversy as of September 5, 2026. The useful place to end up is your local policy: who can search, how far back they can look, and who checks that they're following the rules.

A plate number can be enough

Flock says its automated license plate readers, or ALPRs, collect pictures of number plates, details about the vehicle, and the time and place it was seen. It says this system does not use facial recognition. That describes its vehicle system; it isn't a statement about every surveillance product. Flock's data privacy documentation

The absence of facial recognition is useful to know. But it doesn't settle the privacy question.

A car seen outside a clinic once tells you relatively little. Repeated sightings might invite a conclusion about somebody's appointments. The same applies to a workplace or a home. Those conclusions could also be wrong: a record of a car doesn't prove who was driving it or why they were there.

This is the concern I draw from the system's described capabilities. It makes ordinary journeys available for later interpretation. You don't have to think every police search is abusive to want limits on how much of that history is collected and who gets to use it.

What the audits actually found

Some of the criticism is about what a system like this could allow. Some of it is about failures that officials have already documented. It's worth being precise about which is which.

On August 25, 2025, the Illinois Secretary of State's office said its audit found that U.S. Customs and Border Protection had accessed Illinois license plate camera data in violation of state law. The office ordered the access shut off and reported that Flock had paused its federal pilot programs. That was a finding about CBP's access to Illinois data. It doesn't establish the same access at every Flock installation or by every federal agency. Illinois Secretary of State audit announcement

In August 2026, San Mateo County's Civil Grand Jury reported improvements in data-sharing controls, alongside remaining gaps in policy maintenance, audits and oversight of sharing within California. Both halves of that finding matter. A control can improve while the job of checking how it's used remains unfinished. San Mateo County Civil Grand Jury announcement

For me, the practical lesson is to ask for completed audits. A written rule tells you what should happen. An audit can tell you whether anyone looked at what actually happened.

A new default doesn't tell you your town's setting

Flock says it has no contract with U.S. Immigration and Customs Enforcement, known as ICE, and that customers control sharing with federal agencies. Its explanation also discusses permitted sharing relationships and historical federal pilots. The absence of a direct contract answers one question; access through another agency is a separate one to investigate. Flock's explanation of federal access

On August 13, 2026, the company announced a seven-day default and recommendation for retention, meaning how long it keeps the records. It also said existing customers would keep their current approved periods. So reading “seven days” in an announcement doesn't tell you how long the cameras near you keep records.

There is another wrinkle. Flock's Evidence Policy, dated August 12, 2026, still describes a thirty-day standard unless a customer's agreement says otherwise. The announcement and that policy don't give you one answer you can apply everywhere. Ask which agreement and setting apply locally.

The August 13 announcement also introduced an Evidence Mode for keeping particular records as evidence. It said Audit Assistance, a feature that flags unusual activity for review, would become mandatory for law enforcement customers by the end of 2026. By then, searches would also need a case code linking them to an investigation, with emergency exceptions flagged for review. Those are Flock's commitments. They don't establish that the cameras in your town already have those controls in place. Flock's August 2026 safeguards announcement

Shorter routine retention would leave less history available to search. Good. The next question is what can be kept beyond that period, who approves it, and whether those exceptions are reviewed. Otherwise you've only learned the headline setting.

Six questions to take to your local council

Start with the organisation operating the cameras, such as your local police department or council. Ask for the current policy, contract and most recent completed audit: a review of how the system has actually been used. Those documents give you something concrete to read and follow up on.

“We take privacy seriously” is a perfectly pleasant sentence. It doesn't answer any of those questions.

If you're not sure how to begin, here's an ordinary email you can adapt:

I'm a local resident trying to understand how our license plate cameras are used. Could you send me the current policy, the agreement that sets how long records are kept, and the most recent completed audit, if there is one? I'd also like to know which agencies can currently search our data. If another office holds these records, please point me to it.

When the reply arrives, write down four things: the document's date, the local retention period, who can search, and when searches were last reviewed. Leave a blank where the reply doesn't answer. That blank is your follow-up question.

For example, a reply that links only to Flock's seven-day announcement hasn't answered what your local cameras are set to. Ask which setting and agreement apply to this installation. If someone says the searches are audited, ask when the latest review was completed and whether a report is available.

A document you haven't been given isn't necessarily a document that doesn't exist. If you hear nothing, follow up with the office or ask where it publishes public records. The route and what must be disclosed depend on where you live. Keep unanswered questions labelled as such; don't turn a missing reply into evidence of a specific misuse.

This is where our tool stops helping

Our face-covering app changes a file you're about to publish. You choose the file, make the edit and decide whether to share it.

It can't change a roadside camera's database. And I think a privacy guide attached to a face-blurring app needs to be comfortable saying that.

For the information you do publish, there is still plenty worth doing: checking location clues in photos, securing accounts and choosing smaller audiences. The guide to privacy beyond face blur puts those jobs in order.

For Flock, take the question to the organisation using it. Find out what it keeps about people's journeys, who can see it, and who has checked. That responsibility shouldn't fall on every family trying to work out which road to take.