Which states restrict Flock Safety camera data?

Statutory risk record

Last verified: August 4, 2026. Legal-background review: municipal technology-procurement counsel. This article is general legal-risk information for public-agency, procurement, and litigation-support readers; it is not legal advice and does not substitute for jurisdiction-specific counsel review.

For agencies assessing Flock Safety camera privacy legal issues, the useful first question is not whether automatic license plate reader cameras are lawful in the abstract. It is whether a particular agency may collect, retain, search, share, and use plate data under the state statute that governs that agency, its vendor contract, and any neighboring-agency access.

This record is deliberately narrower than a constitutional-litigation survey. It does not repeat the site’s separate Flock lawsuit tracks, and it does not revisit the Flock drone Fourth Amendment gap or the broader autonomous police drones Fourth Amendment analysis. The immediate procurement question is statutory: which setting, policy, sharing permission, warrant workflow, or litigation use creates exposure before the next renewal vote.

State-law tracker for Flock-derived ALPR data

“Flock-derived ALPR data” here means plate reads, associated timestamps, camera locations, vehicle images, hotlist alerts, searches, and related access logs generated through Flock Safety or comparable automatic license plate reader systems. The table is a compliance tracker, not a product description. Rows are limited to state developments identified in the current record; where the available record does not provide a precise retention period, penalty, or warrant rule, the table says so rather than filling the gap with a vendor norm or another state’s rule.

The empty-looking cells are not harmless. They are procurement assignments. A city attorney reviewing a Flock renewal in Oregon, Virginia, Arkansas, or Idaho should not assume that a standard vendor setting or a neighboring jurisdiction’s practice supplies the rule. The question is whether the contract, police policy, access permissions, audit trail, and records schedule match the state statute that is actually in force for that agency.

Washington shows what a modern ALPR statute can control

Washington’s SB 6002 is the cleanest example in this record because it reaches the points that usually sit in different parts of a procurement file. It is not just a privacy-policy statute. It addresses how long data can sit, where collection may occur, how private-entity data may be reached, and what happens in court when the rule is knowingly violated.

The 21-day default deletion rule is the first operational lever. If the agency’s Flock configuration, export practice, evidence workflow, or downstream repository keeps routine ALPR data longer than the state permits, the problem is not cured by saying the vendor dashboard has a deletion option. Someone must be able to show what was collected, where it went, when it was purged, and whether any copied dataset outlived the statutory clock. Washington’s new restrictions set the default deletion period at 21 days. [1]

The sensitive-location rule is a different kind of risk. It is not fixed by shortening retention after the fact. If collection is barred at places such as schools, places of worship, courts, food banks, and health-care facilities, the siting decision, camera angle, geofence, and data-source integration need review before installation or expansion. Washington’s restrictions identify those categories as barred collection locations. [1]

The private-entity warrant treatment is also procurement-relevant. Local agencies increasingly encounter ALPR data through networks that mix public cameras, private cameras, vendor-hosted systems, and shared searches. Washington treats access to private-entity ALPR data as requiring probable-cause warrant treatment. That means an agency cannot safely analyze only its own camera inventory; it must also understand whether officers can query private-network data through a vendor portal, partner account, or investigative request. [1]

The evidentiary hook is the part that should get litigation counsel’s attention. A knowing violation can make the resulting evidence inadmissible. That consequence moves the statute out of the compliance manual and into suppression practice, case screening, and prosecutor disclosure. It also changes the renewal conversation: if the police department cannot document lawful collection, retention, access, and search rules, the defect may not stay inside the procurement file. [1]

The controls are not interchangeable

ALPR statutes often get summarized as “privacy laws,” but that label is too loose for counsel deciding what to change before a board meeting. A retention ceiling, a sharing bar, a warrant requirement, a use limit, and a damages provision all require different fixes.

A retention problem usually calls for configuration evidence: screenshots, audit logs, written deletion schedules, and proof that exported data is not escaping the purge rule. A sharing problem calls for an access map: which agencies can query the system, which users can approve access, what defaults changed after installation, and whether the contract allows the vendor to facilitate access beyond the adopting agency’s policy. A warrant problem calls for a workflow, not a promise; officers need to know when a query must stop until legal process is obtained.

Those distinctions matter because a Flock deployment can be compliant on one axis and exposed on another. A city may delete data quickly but allow broader neighboring-agency searches than state law permits. A county may restrict sharing but keep private-entity search access inside a routine detective workflow when state law requires probable-cause warrant treatment. A police department may have a written use policy but no audit trail showing who actually searched the plate, why, and under whose authority.

Why the 2025–2026 enforcement record matters before renewal

The practical risk is no longer limited to an eventual Fourth Amendment ruling. Recent public files put pressure on government users in more immediate ways: attorney-general action, class-action damages theories, audit findings, and evidence consequences. Those are the files that change renewal language.

The El Cajon attorney-general action matters because it ties ALPR compliance to government conduct, not merely vendor marketing. For local counsel, the operational lesson is to review sharing settings and interagency access as legal decisions. If a department treats a data-sharing toggle as a technology preference, the city attorney may inherit a statutory problem after the public has already been told the system is a safety success.

The Javorsky class action matters for a different reason: it keeps damages exposure in view. California’s minimum $2,500-per-violation statutory-damages figure is not a rounding error when ALPR systems generate many reads, many accesses, and many potential class members. The legal exposure may turn less on whether any single read feels dramatic and more on whether the agency can prove that collection, retention, access, and sharing complied with the statute for each challenged category.

The Illinois audit belongs in the same conversation because audits expose ordinary administrative weakness: incomplete policies, poor documentation, unclear access controls, or review gaps. Those findings can be less theatrical than constitutional litigation, but they are often harder for a public agency to explain. A board packet saying “other cities use Flock” does not answer whether this agency can document authorized users, retention settings, search reasons, and external access.

Washington adds the litigation consequence. When a knowing violation can make evidence inadmissible, the risk is not just reputational or budgetary. It can affect whether a criminal case survives a statutory challenge. That possibility should reach the prosecutor, the evidence unit, the records officer, and the person who signs the vendor renewal. [1]

What counsel should verify in the file

Before procurement, expansion, or renewal, the useful file is not a generic privacy memo. It is a jurisdiction-specific control record that can be checked against the statute in force on the date the agency acts.

• Authority to deploy: the ordinance, board approval, procurement record, grant condition, or policy authorizing ALPR use.
• Data inventory: what the system collects, including plate reads, images, timestamps, camera locations, hotlist alerts, searches, and access logs.
• Retention setting: the vendor default, agency-selected period, export rules, evidence-copy handling, backup treatment, and deletion verification.
• Sharing map: every agency, task force, federal user, neighboring jurisdiction, and private-entity source that can provide, receive, search, or approve access.
• User permissions: who can search, who can approve access, who can change sharing settings, and who reviews anomalous queries.
• Legal-process workflow: when officers must obtain a warrant, court order, subpoena, supervisor approval, or prosecutor review before searching or obtaining ALPR data.
• Use limitations: whether the statute or local policy restricts ALPR to particular offenses, investigative purposes, hotlists, or emergency uses.
• Location review: whether any camera, feed, or private-network source captures a barred or sensitive location.
• Audit evidence: logs showing searches, reasons, users, approvals, sharing events, deletion events, and policy exceptions.
• Litigation hold exception: how the agency preserves data for a lawful case without turning an exception into a general retention practice.

The contract should not be allowed to carry the entire compliance burden. Vendor language can help with deletion, logs, role-based access, and support obligations, but the agency still needs a policy that matches state law and a person accountable for reviewing access. If the statute limits sharing, the contract should not leave partner access to an implementation call. If the statute creates an evidentiary consequence, the police policy should not depend on unwritten detective practice.

A narrow answer to “are Flock cameras legal?”

In most procurement files, the better answer is conditional: Flock cameras and similar ALPR systems may be lawful only if the agency’s collection, retention, access, sharing, warrant workflow, use limits, and litigation use comply with the state statute that governs that deployment. A practice that is ordinary in one state may create statutory damages, audit exposure, attorney-general scrutiny, suppression risk, or public-facing noncompliance in another.

Constitutional arguments remain important, but they are not the only moving part counsel can act on now. The clearest near-term exposure is the uneven state ALPR patchwork. Washington’s 21-day deletion rule, sensitive-location bars, probable-cause warrant treatment for private-entity data, and knowing-violation inadmissibility show how specific these rules can become. California’s damages exposure, the El Cajon attorney-general action, the Javorsky class action, the Illinois audit, and the 2025 enactments in Arkansas, Idaho, and Virginia show why “everyone else is using it” is not a compliance theory.

References

1. What to Know About the New Restrictions on Flock and Similar Camera Systems — MRSC, April 27, 2026.