Guardrails audit

A surveillance company promised to change. We are checking.

On August 13, 2026, Flock Safety announced changes to how long licence plate reader data is kept, how searches are audited, and who may search what. Announcements are not outcomes. This page keeps three things apart: what the company committed to, what independent critics said about it, and what the agencies’ own transparency portals actually publish — which we capture every week.

1 — What Flock committed to

The announcement, in its own words.

Quoted verbatim from Flock Safety CEO Garrett Langley’s announcement of August 13, 2026. This is the company describing its own reform: it is the authority on what was promised, and evidence of nothing else.

Retention. “Today, we are updating our recommendation and default to a 7-day retention ... Existing customers will keep their current, democratically approved retention periods.”

A default and a recommendation for customers going forward, not a ceiling and not a mandate. Existing customers are explicitly excluded, and the announcement describes the 7-day period as itself optional.

Auditing (Audit Assistance) and case codes. “We will now require all law enforcement customers to adopt this feature by the end of this year. ... we will now require case codes for all law enforcement searches by the end of the year.”

The only requirement in the announcement, and its only deadline: the end of 2026. "This feature" is Audit Assistance, Flock's own misuse-detection tool. The announcement also allows agencies to bypass the case-code requirement in emergencies, with those searches flagged for administrator review.

Sharing filters. “Now, cities can choose which type of offenses are permissible for other agencies to access their cameras. For example, City A could allow City B to search its cameras only for a stolen vehicle, missing person, or violent crime while blocking searches related to immigration enforcement.”

A capability a customer may switch on, not a restriction applied by default, and no date is attached to it.

One date is worth naming because it is missing. The only deadline in Flock’s announcement is “the end of this year”, and it applies only to the audit and case-code requirements. The retention default is described as rolling out over “the coming weeks”, and the sharing filters carry no date at all. If you have read that these changes take effect on a particular day, that day did not come from the company.

2 — What its critics say

The people who read it closely were not satisfied.

Named organisations and legislators, quoted and linked. We are not neutral about mass surveillance and do not pretend to be — but nothing in this section is our characterisation. Every line is somebody else’s, on the record.

“The reforms are a combination of long overdue changes along with some cosmetic fixes that fail to address the fundamental dangers of this technology.”

— Matthew Guariglia, Electronic Frontier Foundation, August 13, 2026

“The most consequential is Flock’s default setting of an optional 7-day retention period for ALPR data, down from its original default optional 30-day retention period.”

— Matthew Guariglia, Electronic Frontier Foundation, August 13, 2026

“So, while towns can likely easily flip the switch to longer retention periods, it might come with a price tag some cities will be unwilling to pay.”

— Matthew Guariglia, Electronic Frontier Foundation, August 13, 2026

“For states and localities that want and permit longer data retention periods, all they have to do is ask. Although Flock may not technically be the one unlocking the door to months of people’s private location data, it is responsible for building the door and handing out the keys.”

— Chad Marlow, senior policy counsel, American Civil Liberties Union, August 13, 2026

“But if "Evidence Mode" triggers the retention of any ALPR data that is searched, then the new mode could indefinitely retain all the ALPR data Flock collects and shares nationally. This would make Flock’s data retention problem even worse.”

— Chad Marlow, senior policy counsel, American Civil Liberties Union, August 13, 2026

“This is not new. Flock has attempted this before, and the security measure failed because users were easily able to circumvent the system’s requirement that police input the purpose of their search. ... police officers quickly realized they could just input "investigation" or even "hehehe" as a search reason and it would be approved.”

— Chad Marlow, senior policy counsel, American Civil Liberties Union, August 13, 2026

“However, unless we know the number of officers misusing the system, we cannot conclude if Flock and its auditing tools are catching 95 percent of violators or 5 percent. Flock needs to have its auditing tool analyzed by an independent evaluator to determine its actual effectiveness. Until then, we don’t know if the tool is a real security measure or just window dressing.”

— Chad Marlow, senior policy counsel, American Civil Liberties Union, August 13, 2026

“seem to be a thinly veiled PR attempt to counter communities’ genuine privacy concerns with its mass surveillance system with largely hollow security promises”

— ACLU press release, August 13, 2026

“a default, not an absolute retention ceiling, nor a statutory or contractual legal mandate”

— Brian Hofer, Secure Justice, August 17, 2026

“a week after Flock’s announcement, zero municipalities have announced a move to the 7-day retention period”

— Brian Hofer, Secure Justice, August 17, 2026

“Flock audits Flock. Police audit police. And the public gets whatever sanitized version is left.”

— Brian Hofer, Secure Justice, August 17, 2026

“This is window dressing that doesn’t address the fundamental problem, which is that police officers are the ones deciding who and when to search, and that should be done by judges with real warrants.”

— Robert Frommer, senior attorney, Institute for Justice, quoted by Sarah Rankin and Claudia Lauer of the Associated Press, August 13, 2026

“Now, your blog post has revealed multi-factor authentication was made mandatory literally only days before our hearing.”

— West Virginia Delegates Tristan Leavitt, Ryan Browning and Patrick Lucas, in a letter to Flock’s CEO, August 14, 2026

3 — The record it answers

What was documented first.

Reporting, statements and official findings that preceded the announcement. Each entry names who established it and on what basis — and where something is alleged and unresolved rather than adjudicated, it says so. An allegation is not a finding, and this page does not promote one into the other.

May 27, 2025 — Audit logs from Danville, Illinois showed more than 4,000 nationwide and statewide Flock lookups run by local and state police at the request of, or as informal favours to, federal law enforcement, or with a potential immigration focus — with immigration, ICE and ICE+ERO entered as search reasons. (404 Media (Jason Koebler and Joseph Cox); source; Police audit logs obtained through records requests)
May 29, 2025 — A Texas sheriff’s deputy searched more than 83,000 Flock cameras nationwide, including in states where abortion is legal, looking for a woman whom authorities said had self-managed an abortion. (404 Media (Joseph Cox and Jason Koebler); source; Flock search logs)
August 25, 2025 — US Customs and Border Protection had direct back-end access to Flock through a pilot programme — first reported by 9News Colorado — and regularly searched more than 80,000 cameras. (404 Media (Jason Koebler), crediting 9News Colorado for the pilot-access reporting; source; Data released by three police departments)
August 27, 2025 — The Illinois Secretary of State’s office said Flock had given CBP pilot access to Illinois cameras and accused the company of breaking the state’s 2023 law barring ALPR data sharing for immigration or abortion enforcement. The office opened an investigation; the allegation has not been adjudicated. (Illinois Secretary of State Alexi Giannoulias, reported by Capitol News Illinois; source; Statement by the Secretary of State’s office, and an open investigation — an allegation, not a finding)
September 8, 2025 — Out-of-state authorities made roughly 1.6 million searches of San Francisco police Flock data between August 2024 and February 2025, which the publication reported likely violated California’s limits on sharing that data out of state. (The San Francisco Standard (Tomo Chien); source; Audit logs obtained by the publication)
October 7, 2025 — Flock and the Texas sheriff publicly described the nationwide plate search as a search for a missing person, and said deputies were checking on the woman’s welfare. Court records obtained by EFF described an abortion investigation. (Electronic Frontier Foundation (Dave Maass and Rindala Alajaji); source; Court records obtained by EFF, against the public statements they contradict)
October 16, 2025 — Senator Ron Wyden’s office said Flock’s protections for Oregonians against abuses by federal agencies and out-of-state law enforcement were ineffective, and reported that Homeland Security Investigations, the Secret Service and NCIS also had access. (The office of US Senator Ron Wyden; source; Press release from a senator’s office reporting its own oversight correspondence)
October 21, 2025 — Border Patrol was able to reach ALPR data from at least eight Washington local agencies. (University of Washington Center for Human Rights; source; Academic analysis of Flock audit data)
March 31, 2026 — Washington enacted SB 6002, capping ALPR retention at 21 days unless the data is needed as police evidence, restricting searches to specific crime categories and banning immigration-enforcement use. (Washington State Standard (Jake Goldstein-Street); source; State legislation)
June 18, 2026 — A compliance audit surfaced 299 improper inquiries of San Francisco police Flock data conducted for federal and out-of-state agencies. (The San Francisco Standard (George Kelly); source; SFPD compliance audit)
August 2, 2026 — At least 50 officers were found to have been charged with or accused of misusing plate readers, 46 of the cases involving Flock, most often to track women including former partners. (The Washington Post; source; Police and court records, and Flock audit logs)
August 3, 2026 — A leaked internal Flock guide showed the company coaching police departments on how to promote the technology and shape public narrative — published ten days before the guardrails announcement. (404 Media (Jason Koebler); source; Leaked internal document)

4 — What we measure

What the portals actually publish.

2,662 agencies are recorded as operating Flock ALPR cameras. 1 of them publish a transparency portal we have captured. That gap is the first finding: the retention window of nearly every agency in the country is not something the public can check at all, before or after any announcement.

Of the portals we do capture, 1 still publishes a retention window longer than the 7-day figure Flock announced:

Anoka County MN SO (MN) — published retention 30 days, sharing disclosure “list”, captured August 15, 2026 (after the announcement)

What this is not. We do not hold a capture from before the announcement, so nothing here is a before-and-after. What it is, is the starting point of a record kept from now on: these portals overwrite themselves in place, so what they said last month cannot be recovered by anyone who was not already writing it down.

And what a portal cannot show us. Whether an agency switched on the audit tool, whether case codes are actually required of its officers, whether an offence filter is configured — none of that appears on a transparency portal. We can measure what agencies publish. We cannot measure what the company enforces, and neither can you.

Method

How this is kept.

Portal figures are captured by our transparency crawler, which reads the public pages agencies and their vendor already publish, about weekly. Every figure above is read live from those captures rather than typed into this page, so it changes when the portals change. Quotes are verbatim and linked to their source. Operator counts derive from the Atlas of Surveillance, a project of the Electronic Frontier Foundation and the Reynolds School of Journalism at the University of Nevada, Reno (CC BY 4.0). Everything here is at the agency level — nothing on this page is about an individual person, plate, or driver.