Questions to Ask Your Leaders

Automated license plate readers (ALPRs) can turn passing vehicles into searchable records of where they were and when. When leaders approve that collection, they make a decision about everyone’s privacy. Residents deserve to know how far the information can travel, what prevents its misuse, and what evidence makes the intrusion worth it.

These questions are for any community considering, using, expanding, or replacing an ALPR system, whether supplied by Flock Safety, Axon, or another provider. Capabilities, hosting arrangements, contracts, and laws differ. The questions ask officials to establish what their particular system does and what limits apply. Flock documents appear below as concrete examples, not as descriptions of every vendor’s practices.

An assurance that the police own the data leaves much of that unanswered. Ownership matters. So do the powers of the company holding the records, the agencies receiving them, and the authorities that may demand them.

Before our communities commit to more surveillance, these are the questions our leaders should be able to answer.

The limits of local control

1. Ownership is only the beginning

The first question is what the applicable contract actually guarantees. For example, Flock’s online terms recognize customer ownership of camera data. Those same terms allow legally required disclosure, including in response to valid legal process. The ownership language therefore leaves a question: who can require the records to be handed over despite the department’s wishes? Local officials should identify which terms govern their own agreement. Flock Customer Terms and Conditions, sections 4.1 and 5.

When leaders tell us they own and control the data, which disclosures can they actually prevent?

Does that control extend to a demand served directly on the vendor or another provider holding the records?
Which limits on that control have been explained to residents?
Will the department publish the contract provisions supporting its assurance?

2. A demand can go to the company holding the records

A local sharing decision and a legal demand served on a vendor are different routes to information. For example, Flock’s ownership explainer says it seeks to coordinate with customers and fights compulsory disclosure. That commitment deserves scrutiny. Resisting a demand does not guarantee defeating it. The company also says the signed agreement controls. Flock Data Ownership explainer.

If an authority demands our records from a company holding them, what power does our community have before the information is released?

Is the provider required to challenge improper or overbroad demands, and is that duty binding in our contract?
Who evaluates the demand, challenges it, and pays for that challenge?
What happens if a challenge fails, or the responsible public agency cannot intervene in time?

3. Local officials may not receive advance notice

Notice provisions deserve the same scrutiny. For example, Flock’s online confidentiality terms qualify prior notice of legally required disclosure: notice is required only to the extent permissible. That qualification matters. A public agency’s opportunity to object may depend on whether it can learn of the demand before disclosure. Flock Customer Terms and Conditions, section 5.

How can leaders promise meaningful local oversight if advance notice is not assured?

What happens when notice is legally restricted?
What later notification or aggregate reporting can the agency obtain when permitted?
Will officials distinguish a guarantee from a protection that has exceptions?

4. Safeguards must work when someone acts improperly

Who hosts the records and who can retrieve them should be established for each system. For example, Flock describes privileged vendor access for support and system issues. Other arrangements need their own examination. Encryption can protect information while leaving authorized administrators able to retrieve it; the relevant issue is who has that ability and how its use is controlled. Flock License Plate Reader Policy.

A system meant to protect residents must account for mistaken, deceptive, or improper requests as well as legitimate ones.

What stops an improper disclosure before it happens?

Who authenticates a government request and evaluates its legal basis and scope?
What approval is required for vendor personnel to retrieve readable records?
Who independently reviews vendor access, and what evidence shows those controls work?

5. Collecting the records creates the exposure

No public agency can promise that every institution handling information will always act correctly. Leaders can, however, choose how much information to collect, how long to retain it, and how widely to make it available. Those choices determine how much ordinary travel becomes available for future use.

If exclusive local control cannot be guaranteed, why create such an extensive record of residents’ movements?

What additional benefit requires this volume of collection and retention?
What assessment compared that benefit with the consequences of improper access or disclosure?
Could fewer cameras, shorter retention, or more targeted collection achieve the same purpose?

6. The camera’s location does not tell us who can use its data

A camera may sit on a local street while its records are available through sharing arrangements involving other agencies. Residents need to know both who has permission to search and who has actually done so. A purchased network feature alone establishes neither.

Who can search the records collected in our community, and who has actually used that access?

Will the department publish a dated list of authorized agencies and actual access over the last year?
Does that accounting include regional sharing programs and task-force accounts?
Which agreements, retention rules, and audit procedures govern each arrangement?

7. Our department’s training does not answer for someone else’s officer

A local policy can describe what local employees are allowed to do. Sharing raises an additional question: how does the department verify the conduct of people outside its own supervision?

An agreement is useful only if someone checks compliance and can act when its terms are broken.

What makes our community’s restrictions enforceable against an outside officer?

Who verifies that outside users receive the required training and follow the permitted-use rules?
Can our auditors inspect the case records needed to verify an outside search?
Who can suspend access, and what violations have triggered that action?

8. Turning off direct access may leave other routes unanswered

An assurance that a federal agency has no direct account answers a specific question. It does not explain whether a local officer can search on another agency’s behalf, whether a task force can obtain results, or whether exported information can later be forwarded. Those possibilities need to be addressed explicitly.

Settings and practice can diverge. California law already bars agencies from sharing plate reader data with non-California agencies, yet the Electronic Frontier Foundation reported California agencies sharing it with federal agencies including U.S. Immigration and Customs Enforcement. EFF, October 2023.

When officials say they do not share with ICE or other federal agencies, does that assurance cover indirect access too?

Are searches performed on behalf of another agency identified in the audit record?
How are joint investigations, task-force accounts, and forwarded results handled?
Who verifies that applicable state and local sharing restrictions are reflected in both settings and actual practice?

9. An allowed search reason can still conceal an improper purpose

A case number or an approved offense category records what a user claims to be doing. Verification requires checking that claim against the actual investigation. The American Civil Liberties Union has questioned whether Flock’s search-purpose controls reliably prevent improper searches. ACLU analysis of Flock’s updates.

The gap is documented. Officials in Johnson County, Texas described a license plate search as looking for a missing person. Flock’s own search logs show a county official’s searches carrying the note “had an abortion, search for female.” EFF, October 2025.

What prevents someone from choosing an acceptable reason for an unacceptable search?

Is a case number checked against a real case, the user’s assignment, and the investigation’s purpose?
How are searches by outside agencies verified?
Has an independent reviewer tested whether a plausible but false justification would pass?

10. Revoking access does not recall a copy

An agency that loses access may already have saved information in a report, screenshot, evidence file, or another database. Disabling an account does not itself remove those copies. The public needs to understand where the original department’s control ends.

Once another agency has copied our records, whose rules protect them?

What restrictions govern further sharing and retention?
Can our department verify deletion, including any lawful preservation exceptions?
If it cannot, why is that limit missing from assurances about local control?

How ordinary travel becomes a lasting record

11. Collection begins before anyone is suspected of a crime

The contents of the record matter. For example, Flock’s LPR policy describes records containing a vehicle image, plate information, date, time, and camera location. Those details can make a routine journey useful to a later search. The decision to retain them deserves an explanation even when no officer ever looks up that particular vehicle. Flock License Plate Reader Policy.

How much of the travel data collected here is ever needed in a documented investigation?

Does the system attempt to identify a vehicle’s occupants, or only the vehicle itself?
Does the department measure the proportion of collected records that becomes relevant to a case?
What retention period is justified for the remaining records?
Have officials evaluated immediate alerts followed by rapid deletion of nonmatching records?

12. A shorter default does not establish a shorter local retention period

A vendor’s default is a starting point; officials must explain the period actually used. For example, Flock’s August 13, 2026 announcement recommends seven-day retention while stating that existing customers keep their current periods. Its current wording says over 90% of searches without a full plate occur within a week. That is a narrower claim than saying 90% of all searches do. Neither statement tells residents what their department has configured. Flock’s privacy and security update.

What evidence justifies keeping ordinary travel records for the period our department has chosen?

What is the actual retention setting today, and who approved it?
How many documented cases required records older than a shorter retention period would allow?
Why would targeted evidence preservation be insufficient for those cases?

13. A retention limit can depend on its exceptions

Preserving evidence for an investigation can serve a legitimate purpose. The scope of preservation still matters: a selected record and all the results of a broad search are very different collections. The ACLU has raised this concern about Flock’s Evidence Mode, including retention of information about uninvolved people. ACLU analysis.

What keeps an investigative exception from becoming long-term retention of unrelated travel?

Exactly which records are preserved when a hold is applied?
Who reviews whether each retained record remains relevant?
What happens when a case becomes dormant or never closes?

14. Disappearing from a search screen is not a complete deletion test

Different copies can have different lifecycles. Active storage, backups, exported files, investigative holds, and derived records need separate accounting. A promise of deletion should explain what is deleted, what remains, and why.

When the department says data is deleted, how much of it is actually gone?

Which systems and recipients are covered by that assurance?
What exceptions apply, and when do they expire?
Who independently verifies that expired records cannot still be retrieved?

What a searchable travel history makes possible

15. A passing observation can become a pattern of life

One observation places a vehicle at one location. A series of observations can support inferences about routines, destinations, or associations. The scale and duration of a search therefore matter, even when each individual observation comes from a public road.

Why should the visibility of a single trip settle whether police may reconstruct someone’s movements over time?

What warrant or supervisory approval rules apply to searches across multiple days or locations?
Which legal authority supports the department’s position, and what limits has it adopted beyond the minimum it believes the law requires?
Can officers search for all vehicles near a location or vehicles that repeatedly travel together, and under what conditions?

16. Sensitive associations can be inferred from ordinary locations

A clinic, religious gathering, protest, or union meeting can be a lawful destination. Searching vehicles associated with that place may expose people’s private lives without establishing wrongdoing. A restriction must address the search itself and the ways its purpose could be disguised.

This has happened at scale. Reviewing ten months of nationwide search logs, the EFF found more than 50 federal, state, and local agencies had run hundreds of searches through Flock’s network in connection with protest activity. EFF, November 2025.

What prevents this system from being used to identify people engaged in lawful, sensitive activities?

Do restrictions cover outside users and indirect searches as well as local employees?
Who approves exceptions and verifies a genuine criminal basis independent of protected activity?
Would residents know if those protections were weakened?

17. A vehicle match is not proof of who was driving

Vehicles are borrowed, rented, sold, and shared. A correct plate read may identify the wrong person; a misread plate or outdated alert can add another error. The meaningful safety measure covers the whole path from a camera observation to an enforcement action.

The Institute for Justice found at least 27 cases since 2018 of innocent people stopped, detained, or jailed because of license plate reader errors. In nearly two thirds of them, officers drew guns before realizing the mistake. Institute for Justice, July 2026.

What prevents an uncertain match from becoming someone else’s traffic stop, accusation, or arrest?

What corroboration is required before officers act?
How many related stops involved a wrong vehicle, stale alert, or mistaken association?
How are errors corrected in reports and records already shared elsewhere?

18. Having audit logs is not the same as detecting abuse

A log can record an improper search without anyone recognizing it. Automated flags may help, but ordinary-looking activity still needs scrutiny. As the ACLU observes, finding some misuse does not establish how much misuse a system catches. ACLU analysis.

What evidence shows that our oversight would catch an improper search before a victim discovers the harm?

Who independently reviews searches, exports, and vendor access?
How are cases selected for review, and are the underlying justifications checked?
How long are logs retained, and can the department obtain the records it needs from every relevant provider?
If officials cite no complaints, how would residents know they had been searched improperly?

The evidence needed to justify the expense

19. A useful lead does not establish the value of the entire program

A camera can help solve a case. Residents can acknowledge that and still ask how often it changes an outcome, whether another investigative method would have supplied the same information, and whether the overall benefit justifies the collection.

The strongest success story cannot answer those questions on its own.

Across all the cases credited to the ALPR system, how often did it provide a material lead investigators did not already have?

How does the department distinguish a new lead from corroboration or incidental use?
Will it report distinct cases rather than repeated searches or multiple events from one investigation?
Will it separate alerts, confirmed matches, stops, arrests, charges, and completed outcomes?

20. A decline in crime does not identify its cause

Crime can change alongside staffing, enforcement initiatives, reporting practices, and wider regional trends. Comparing the period before installation with the period after it cannot, by itself, isolate the cameras’ contribution.

If leaders credit ALPR surveillance with reducing crime, what analysis separates its effect from everything else that changed?

Did the evaluation account for prior trends, comparison areas, and other interventions?
Was it conducted independently of the vendor and the program’s operators?
If its effect has not been isolated, will officials qualify the claim before using it to justify expansion?

21. Grant funding is still public money

A grant can pay an initial bill while leaving the community with renewals, staff time, training, audits, and other ongoing costs. The public deserves a full account of the commitment and the alternatives that were considered.

What are we paying for the additional benefit this program actually delivers?

What is the full annual and multiyear cost, including expenses outside the vendor invoice?
What funding replaces the grant when it ends?
What is the cost per documented case receiving a material new lead, with the calculation and its limitations published?
How did that spending compare with additional investigative capacity or targeted prevention?

22. Public numbers should let residents check public claims

Camera counts, contract totals, and activity reports answer different questions. A rolling hit count cannot stand in for solved cases. A contract amount is not necessarily an annual cost. Figures help residents evaluate a program only when their definitions, dates, and supporting records are available.

Why should residents accept conclusions they cannot independently check?

Will agencies publish dated inventories distinguishing ALPR and video cameras, operational and pending devices, and agency-owned and regional systems?
Will they reconcile contracts, amendments, payments, and funding sources?
Will they publish historical activity reports, outcome definitions, and audit summaries?
Where specific deployment details are withheld, will they explain the scope and release the remaining information needed for public oversight?

Whether the public can change course

23. Changing vendors needs to change the substance

Replacing one provider with another may change important protections. It can also leave the underlying collection, retention, and sharing largely intact. A different brand deserves evaluation against the same public-interest questions, with any claimed improvement demonstrated in the contract and the operating system.

If leaders replace Flock with Axon or another provider, which surveillance risks are actually reduced?

What changes in the data collected, hosting, administrator access, sharing, retention, and deletion?
Are the stronger protections binding and independently verifiable, or simply marketing claims?
What happens to records and copies held under the previous arrangement?
Has ending or reducing ALPR surveillance been evaluated alongside buying a replacement?

24. Today’s assurances need to survive tomorrow’s leadership

A policy can be revised. A feature can be activated. A future official may have different priorities. Residents need to know which protections require a public decision to change and which can be weakened without one.

What prevents the surveillance approved today from becoming something broader tomorrow?

Who can expand sharing, retention, search capabilities, or access to new data sources?
Do free trials and software updates require review when they expand surveillance capabilities?
Which protections are enforceable, and what consequences follow a breach?
What would cancellation require for collection, equipment, accounts, retained data, and existing copies?

25. A review must allow for a decision to stop

If every success supports expansion, every failure calls for an upgrade, and every unanswered question is deferred until after renewal, the program has no meaningful test. The people approving it should state what evidence would change their minds.

What would have to happen for our leaders to reduce or end this program?

What measurable benefits and enforceable safeguards are conditions of renewal?
What failure would trigger suspension, and who has the authority to act?
Will leaders pause expansion and new commitments until independent findings and the applicable safeguards are public?
When will residents get a public decision, with written reasons and a real option to end the program?

The decision belongs in public

Residents should not have to demonstrate a future abuse before asking leaders to justify creating the conditions for it. The officials authorizing collection are responsible for explaining the need, identifying the limits of their control, and showing that the protections work.

Those answers should be available before the next expansion or renewal, while the community still has a meaningful choice.

If our leaders cannot establish the benefit, verify the safeguards, or explain where their control ends, what justifies asking residents to accept the risk?

Source note: The linked Flock statements illustrate vendor-specific terms and claims; they do not establish the practices of Axon or any other provider, or independently verify an agency’s implementation. Online terms may differ from a particular agency’s signed agreement. The questions do not allege that a particular community’s records have been improperly accessed or disclosed. Any demand’s validity, scope, and available challenges depend on its legal basis. Sources checked September 13, 2026.