Are Flock cameras legal? Your rights and how to verify

Legal information, not legal advice. Last verified: August 26, 2026. If a Flock camera captured your license plate, the useful first question is not simply “Are Flock cameras legal?” The answer depends on the state, the public agency using the system, the data-retention rule, the sharing rule, and the way the database is queried.

The compact answer is this: a single automated license plate reader scan on a public road is generally treated by courts as outside the Fourth Amendment’s search rule, but that is only the constitutional floor. Repeated scans, dense camera networks, database searches, state privacy statutes, public-records laws, and agency policies can change the practical rights analysis. Flock’s footprint makes that distinction more than academic: reporting in 2026 described Flock cameras as operating with more than 5,000 agencies, across 49 states, and producing more than 20 billion monthly scans [1].

Start with custody, not the camera brand

For a driver trying to verify legal rights around Flock camera surveillance, the most common wasted move is treating Flock as the only records custodian. Flock’s own Evidence Policy, last cited here as dated August 12, 2026, says customers own their customer data and that Flock generally redirects subpoenas, court orders, and public-records requests to the customer agency [2].

That custody sentence changes the next step. If the cameras are used by a city police department, sheriff’s office, transportation authority, university police department, homeowners’ association working through a police account, or other customer, you need to identify that customer before asking for the record. A request to Flock may produce a redirection; a request to the wrong city may expire while a short purge clock is running.

Do not assume the retention period from a vendor FAQ alone. Flock’s public materials have not been perfectly uniform: the August 12, 2026 Evidence Policy page contains retention language that refers to 30 days in some places and 7 days in a camera-description section, while AP reporting described an October 2025 shift to a 7-day default [1][2]. That discrepancy does not prove what your local agency is doing today. It proves why the request should ask for the agency’s current configuration, policy, contract, and audit trail.

A verification workflow that survives contact with local law

Use this sequence before you decide whether to send a records request, preservation letter, complaint, suppression motion, or client memo. It is deliberately procedural because the right answer is usually held in several places, not one national rule.

1. Identify the state and the road location. A camera on one side of a state line may be governed by a 21-day purge statute; a similar camera nearby may not be.
2. Identify the customer agency. Look for city council approvals, police procurement pages, agency ALPR policies, contract documents, or signs that name the operating department.
3. Check the controlling source in this order: statute, court order, attorney general action, agency policy, contract, then vendor policy. Vendor FAQs are useful for routing, but they do not override state law.
4. Find the retention rule. Ask whether captures are deleted by default after a fixed period, whether hot-list hits are held longer, whether investigative exports are preserved, and whether deletion pauses after a preservation request.
5. Find the sharing rule. The important question is not only whether your local agency captured the plate, but whether another agency, federal partner, neighboring state, or private entity can search it.
6. Find the query rule. Some legal regimes focus on collection; others restrict later searches, private-entity data access, or uses unrelated to specified crimes.
7. Send the request to the agency before the purge date. If the state allows public-records access, ask for the image, timestamp, camera location or camera identifier, plate-read result, confidence score if maintained, audit logs for searches of your plate, data-sharing logs, and the current ALPR policy.

A records request does not guarantee disclosure. Law-enforcement exemptions, active-investigation rules, privacy exemptions, and record-nonexistence responses may apply. But a request aimed at the correct custodian, with the correct time window and preservation language, is materially different from a general email asking whether Flock is legal.

The Fourth Amendment baseline: one scan is the easy case; the network is the hard one

The usual government argument begins with public-road exposure. A license plate is displayed outside the vehicle. A person driving on a public road can be observed by officers, other drivers, and cameras. Under that view, one plate read does not reveal a constitutionally protected secret.

That position has substantial force in existing case law, but it does not answer every Flock question. Flock systems do not merely let an officer see one car passing one patrol cruiser. They can create time-stamped records across fixed camera clusters, feed searchable databases, and allow later queries by authorized users. The legal pressure point is the difference between momentary exposure and reconstructed movement.

Schmidt v. Norfolk is important, but not final

In Schmidt v. Norfolk, the federal district court in the Eastern District of Virginia held on January 27, 2026, that Norfolk’s use of 176 Flock cameras in 75 clusters did not constitute a Fourth Amendment search. Courthouse News reported that the court found standing over the plaintiffs’ own vehicle captures but not over database queries, and that the court described 475 captures for Schmidt and 325 for Arrington over about four months [3].

That is a serious ruling for governments defending ALPR programs. It is not, however, a national answer. The ACLU’s case page states that the appeal is pending in the Fourth Circuit, with ACLU and EFF amicus briefs filed on April 20, 2026 [4]. Anyone relying on Schmidt after August 26, 2026 should re-check the Fourth Circuit docket before quoting the district court as the last word.

Flock and its representatives have also pointed to what the company describes as more than 30 court rulings rejecting the idea that license plate readers are mass surveillance. Treat that as a company-attributed claim unless you have the actual orders in front of you. A list of favorable outcomes is not a substitute for the controlling jurisdiction, the facts of the camera network, or the precise holding.

McCarthy supplies the mosaic argument

The strongest rights argument does not usually say that every plate scan is a search. It says that widespread, repeated ALPR tracking can ripen into a search when the government has enough data to reconstruct a person’s movements. The Massachusetts Supreme Judicial Court’s decision in Commonwealth v. McCarthy is the central authority often cited for that mosaic-theory approach; commentary on the decision describes the court as recognizing that widespread ALPR use may, in some circumstances, become a search under the Massachusetts Constitution [5].

The distinction matters. If your argument is about one camera at one intersection, McCarthy may not carry it. If your argument is about repeated captures across a dense network, historical searches of a vehicle over time, or data shared across agencies, McCarthy becomes more relevant. It is still a state constitutional decision, not a United States Supreme Court ALPR holding.

Chatrie may influence arguments; it does not decide ALPR law

Chatrie v. United States, decided June 29, 2026, concerned geofence-ordered cloud location data, not license plate readers. A WilmerHale client alert described the Supreme Court’s 6-3 decision as holding that the geofence warrant at issue involved a Fourth Amendment search despite the third-party doctrine [6].

For Flock litigation, Chatrie is best treated as an argument by analogy. It may strengthen claims that automated, cloud-held location trails deserve constitutional scrutiny. It does not itself hold that ALPR capture is a search, that every Flock query requires a warrant, or that an agency violates the Fourth Amendment whenever it stores plate data with a vendor.

If a brief or memo relies on newer federal circuit authority, pull the opinion itself and update it. Do not build a suppression motion from a case-name summary, especially in this area, where the difference between a single read, a hot-list alert, a database query, and a months-long movement reconstruction can decide the issue.

State law is where most people’s practical rights appear

The Fourth Amendment sets a floor. State law often supplies the working rule: how long data can be kept, who may receive it, whether private camera data can be accessed without a warrant, whether a public agency must register its system, and whether misuse carries penalties. These rules diverge sharply.

Virginia is a good example of why state law must be checked before making a national claim. If a record is subject to a 21-day purge, the timing of a public-records request becomes part of the right. If the rule restricts out-of-state or federal sharing, the relevant question is not merely whether the local police could capture the plate, but whether the data moved to another user after capture [7].

Washington pushes the inquiry even further into operational details. A statutory ban on collection at specified sensitive locations is different from a general privacy policy. A warrant rule for private-entity data is different from a warrant rule for every police-owned camera read. An attorney general registration deadline is different from a constitutional holding. Put each source in its own box before drawing conclusions [8].

California’s SB 34 framework and the El Cajon enforcement action are a reminder that legality is not exhausted at installation. The California Attorney General’s challenge targeted alleged illegal sharing of license plate data. For a requester, that means the records trail should include data-sharing logs, access controls, memoranda of understanding, and the agency’s current ALPR policy—not only the purchase contract [9].

Maine shows the other side of the same problem: some states have statutory provisions that must be read in the motor vehicle code or criminal procedure materials rather than in a free-standing “privacy” chapter. Maine’s 29-A M.R.S. § 2117-A is the starting point for that jurisdiction, but the agency-level order and current policy still matter [10].

Public-records requests: move before the deletion clock does

A public-records law may help you find out whether your plate was captured, but only if the record still exists and the correct agency receives the request. In Washington, a Skagit County Superior Court ruling dated November 6, 2025 held that Flock images were public records under the state Public Records Act even when stored on a third-party cloud system; EFF reported that the requester still received nothing because the cities auto-deleted the data while the request was pending [11].

That result is not a technicality. It is the difference between a recognized records right and an empty production. If a state or agency uses a short deletion period, the request should include a preservation demand and a narrow date range. A request for “all Flock records about me” is easier to delay or deny; a request for records tied to a specific plate, date range, camera corridor, and agency account is harder to misroute.

• Ask for the ALPR image or images associated with the plate during the date range.
• Ask for timestamp, camera identifier, camera location if disclosable, plate-read text, and any confidence or alert metadata the agency maintains.
• Ask for audit logs showing searches or accesses for that plate.
• Ask for sharing logs, external-user access, and any exports to another agency.
• Ask for the current ALPR policy, retention schedule, contract, and any local rule governing hot-list alerts or investigative holds.
• If deletion is imminent, ask the agency to preserve responsive records while it processes the request.

The agency may assert exemptions. It may say no responsive record exists. It may withhold camera locations. It may separate ordinary captures from alert hits or investigative exports. Those answers still matter, because they identify the rule the agency believes governs your record.

Misreads are not a side issue when rights depend on access

Accuracy debates can become vague quickly, but misreads matter legally because they affect who is stopped, searched, investigated, or placed in a report. The ACLU has attributed to Business Insider a finding that one state’s license plate readers misread 1 in 10 plates [12]. The Brennan Center has also discussed ALPR accuracy concerns, including research and examples showing that hits can include substantial numbers of incorrect reads [13].

The point is not that every alert is unreliable. The point is that a person cannot challenge a false association if the image, timestamp, plate-read text, alert basis, and audit trail disappear before anyone sees them. Retention and access rules are therefore not clerical details. They decide whether a mistaken read can be corrected or tested.

How to read a source without mixing up its legal force

A statute, a court ruling, an attorney general lawsuit, an agency policy, and a vendor FAQ are not interchangeable. They answer different questions.

This source discipline prevents two common errors. The first is relying on a vendor statement as if it were a statute. The second is treating a privacy advocacy summary as if it were a court order. Both may be useful signposts. Neither should be the final citation for a rights decision if a primary source is available.

What you can and cannot answer nationally

You can say nationally that license plates are exposed on public roads and that many courts have been reluctant to treat a single ALPR scan as a Fourth Amendment search. You can also say that the harder constitutional questions involve network density, historical tracking, database searches, and the mosaic theory.

You cannot answer nationally how long your Flock record may be kept, whether another agency may query it, whether a warrant is needed for a private-camera database, whether a public-records request will reach it before deletion, or whether your state gives you a complaint route. Those answers require the state, the customer agency, and the current policy.

For a driver or lawyer working under time pressure, the clean path is: locate the camera jurisdiction, identify the agency customer, pull the state statute and any recent court ruling, request the agency’s retention and sharing policy, and send a targeted records request before the purge period expires. If the matter turns on the Fourth Amendment, update Schmidt and any newer circuit authority before relying on the constitutional baseline.

References

1. License plate cameras are everywhere. A backlash is growing — AP News
2. Flock Evidence Policy — Flock Safety, Aug. 12, 2026
3. Judge holds Norfolk’s license plate reader use constitutional — Courthouse News Service, Jan. 27, 2026
4. Schmidt v. Norfolk — ACLU
5. Commonwealth v. McCarthy — Harvard Law Review
6. The Fourth Amendment Moves to the Cloud — WilmerHale, July 2, 2026
7. License plate readers, ICE, ATF, and Virginia’s new law — VPM, July 16, 2025
8. New Restrictions on Flock Cameras — MRSC, April 2026
9. Attorney General Bonta Continues Legal Challenge to Stop El Cajon from Illegally Sharing Drivers’ Location Data — California Department of Justice
10. 29-A M.R.S. § 2117-A — Maine Legislature
11. Washington Court Rules Data Captured by Flock Safety Cameras Are Public Records — Electronic Frontier Foundation, Nov. 2025
12. Get the Flock Out — ACLU
13. Automatic License Plate Readers: Legal Status and Policy Recommendations — Brennan Center for Justice