Flock Safety, the company behind the license plate reading cameras now mounted along thousands of American streets, recently rolled out a new set of rules meant to reassure the public that police departments can't misuse the data these cameras collect. But a recent CNET investigation into the update found something less comforting: several practical workarounds that let law enforcement agencies sidestep the very restrictions the company just introduced. For anyone who drives through a neighborhood with one of these cameras, and that's a growing share of the country, the findings raise fresh questions about how much control drivers actually have over their own location data.
What Flock's New Rules Actually Restrict
Flock's automated license plate readers work by photographing every vehicle that passes, logging the plate number, timestamp, and location, then storing that information so police departments can search it later. The system has expanded rapidly, and with that growth has come mounting criticism over how loosely the data has historically been shared between agencies. Flock's newest rules are meant to address that criticism directly, tightening who can access a given department's camera network and narrowing the reasons an officer can cite when running a search.
On paper, this looks like meaningful progress. Requiring departments to state a reason for each search, and limiting which outside agencies can tap into a local network, are the kinds of guardrails privacy advocates have been asking for. If you've read our explainer on Flock cameras and Fourth Amendment concerns, you know that courts still haven't settled whether this kind of mass location tracking even requires a warrant. New internal rules from the company were positioned as a way to add accountability while that legal question remains unresolved.
The Loopholes That Let Police Bypass the Rules
The trouble, according to CNET's reporting, is that the new safeguards rely heavily on how individual officers and departments choose to use the system, not on technical barriers that would actually prevent misuse. A rule that requires a stated justification for a search does little if there's no meaningful review of whether that justification is accurate or necessary. Similarly, restrictions on cross-agency data sharing can be worked around when departments still have informal or indirect ways to request lookups from partner agencies.
In other words, the new policy changes function more like a code of conduct than a technical lock. That distinction matters enormously. A rule that depends on trust and self-reporting is only as strong as the willingness of every department, and every individual officer within it, to actually follow it. CNET's investigation found enough gaps in enforcement and oversight to suggest that the promised protections may look better in a press release than they do in daily practice.
What This Means for Your License Plate and Location Data
For drivers, the practical reality hasn't changed much. Your license plate, and by extension your movements, are still being logged every time you pass one of these cameras, and that data can still end up shared more broadly than the new rules suggest. Because the restrictions are largely procedural rather than built into the underlying software, there's little a private citizen can do to verify whether a given search of their plate history was properly justified or who ultimately saw the results.
This is the core tension at the heart of the Flock camera debate. The company markets these systems as tools for solving crimes, and law enforcement agencies frequently point to specific cases where camera data helped close an investigation. But the same infrastructure that helps recover a stolen car or locate a suspect also creates a detailed, searchable record of ordinary people's daily routines, one that's vulnerable to being accessed for reasons that have nothing to do with public safety.
Legal Protections That Do (and Don't) Exist
Right now, the legal framework around automated license plate readers is thin and inconsistent. Some states have passed laws limiting how long this kind of data can be stored or who can access it, but there's no uniform federal standard governing systems like Flock's. Courts have also been slow to weigh in on whether continuous location tracking through license plate cameras counts as a search under the Fourth Amendment, a question we've explored in more depth in our look at the Fourth Amendment fears surrounding Flock's camera network. Until that legal picture becomes clearer, company policies like Flock's updated rules are essentially filling a vacuum, and as this investigation shows, that kind of self-regulation has real limits.
What This Means For You
If you live in an area with Flock cameras installed, understanding these Flock camera surveillance loopholes is the first step toward advocating for stronger protections. You likely have little say over whether a camera is installed on your street, but local governments and police oversight boards often do hold public meetings where policies on ALPR use are discussed and voted on. Attending those meetings, or simply asking your local department how it uses and shares this data, can put pressure on agencies to close the gaps that CNET's reporting identified.
Takeaways
Flock's new rules are a step in the right direction, but they rely on voluntary compliance rather than technical enforcement, which leaves real gaps for misuse. Your license plate and location history are likely being logged regardless of whether you notice the cameras. Legal protections vary widely by state and remain untested in many courts. Staying informed about how your local police department uses this technology, and pushing for transparency, is currently one of the few tools available to drivers concerned about their privacy.
