DEFLOCK: Cities and States Are Fighting Back and Winning. Here’s The Law That Makes Flock Cameras A Felony.
A Note From the Author
What follows is a summary of how license plate surveillance cameras were installed across the country without public consent, the cities and states that have fought back and won, and what a law that ends the practice would contain. After the summary come instructions for contacting your representatives, written so the minimum action takes about two minutes. After the instructions comes the full text of the model legislation. Most of its provisions already exist in laws that states have passed or formally proposed, including Washington’s Driver Privacy Act, Colorado’s warrant requirement for sharing data with federal agencies, Illinois’s per-violation damages structure, and the criminal penalty Texas applies to officials who conduct public business in unlawfully closed meetings. The provision that exists nowhere yet is the felony for installing the cameras without public consent. The document ends with a library of free resources for anyone who wants to organize locally, followed by the reference list.
The small raised numbers that appear throughout are called superscripts. Each superscript points to a numbered source in the reference list at the end of this document, so you can check every factual claim against the reporting, statutes, and court records it came from.
There is a fair chance that a small camera on a pole near your home photographs every license plate that passes it. Flock Safety operates more than 100,000 automated license plate reader cameras across 49 states, and its network scans roughly 20 billion plates per month.¹ In most of the cities where those cameras operate, no elected body ever voted to install them. A police chief or a city manager signed a contract, often a no-cost trial that required no budget approval, and residents learned the cameras existed after they were already recording.
The record of what happens next is now extensive. Local police ran more than 4,000 immigration-related searches through Flock’s network on behalf of federal agencies, according to reporting by 404 Media.² Mountain View, California terminated its contract after an investigation found roughly 600,000 searches of its data in a single year by more than 250 agencies the city had never approved.³ A class action filed in February 2026 alleges that out-of-state and federal agencies searched the San Francisco Police Department’s Flock database more than 1.6 million times in seven months.⁴ Flock has installed cameras without required permits in at least five states, and two state transportation agencies barred it from new installations.⁵ It has made false statements to city councils about what its systems do,¹ and in February 2026 it rewrote its standard contract terms to make cancellation harder even when a council votes against approval.⁶
The public response so far has been cancellation. More than 50 cities have ended their contracts since late 2024.⁷ In the same period, roughly 800 cities signed new ones.⁷ Cancellation works one council at a time, and it happens only after the cameras are installed and the data has already left the jurisdiction. Every state law passed so far, including Washington’s Driver Privacy Act, regulates how the data can be used after the cameras exist.⁷ No law anywhere attaches a consequence to the person who decides to install them without asking the public. The model legislation at the end of this article makes that decision a crime. It does six things.
First, it requires public consent before deployment. No government agency may install license plate reader cameras, including free trials, pilot programs, and donated cameras, without an ordinance passed by recorded vote after at least two public hearings noticed 30 days in advance. The hearing notice must disclose the camera locations, the vendor, the full contract, the data collected, the retention period, and every entity that will have access.
Second, it makes unauthorized deployment a felony. An official who knowingly installs or authorizes these systems without that ordinance faces up to five years in prison. Concealing the system, lying to the council about it, or continuing to operate it more than 30 days after written notice raises the maximum to ten years. Conviction forfeits the office and disqualifies the person from holding public office for ten years, and public funds may not pay the fines.
Third, it gives the state attorney general direct authority to prosecute, so enforcement does not depend on a county prosecutor deciding whether to charge officials that prosecutor works with every day.
Fourth, it makes the company pay. A vendor that installs cameras without first receiving a certified copy of the authorizing ordinance owes every driver it scanned $1,000 per scan, or $5,000 per scan if the violation was willful. One camera records thousands of vehicles per day, so the liability for a single unauthorized installation passes one million dollars within days. The vendor also owes the state $10,000 per camera per day, must delete all data collected, and loses eligibility for public contracts in the state for five years.
Fifth, it regulates the systems the public does approve. Data may not be shared with federal agencies or out-of-state entities without a warrant. It may not be used for immigration enforcement, for surveillance of health care facilities or protests, or for any officer’s personal purposes. It must be deleted within 30 days, and every search must be logged in a public audit record. Willful violation of these rules is also a felony.
Sixth, it lets residents enforce it. Any person whose plate was scanned can sue, and a winning plaintiff collects attorney fees. Systems already operating get 180 days to obtain public authorization or shut down and be removed.
The penalty grades have precedent. Federal law, 18 U.S.C. § 2511, makes intercepting a single phone conversation a felony punishable by up to five years.⁸ Texas has made it a jailable offense since 1967 for officials to knowingly conduct public business in an unlawfully closed meeting.⁹ Illinois grades official misconduct as a Class 3 felony.¹⁰ The per-scan damages structure copies the Illinois Biometric Information Privacy Act, which sets $1,000 to $5,000 per violation¹¹ and produced a $650 million settlement from Facebook.¹² If intercepting one conversation is a five-year felony, deploying a network that records the movements of every driver in a city without authorization can be graded the same or higher.
What You Can Do
The minimum action takes about two minutes, and here is exactly how to do it.
First, find the people who represent you. For state legislators, go to openstates.org, type in your home address, and it returns your state representative and your state senator with their phone numbers and email addresses. Your state legislature’s own website has the same lookup, usually under a link named “Find My Legislator” or “Who Represents Me.” For city council, search “[your city] city council members” and the city’s website will list each member’s name, district, email, and phone number. If the cameras in your area belong to a county sheriff rather than a city police department, your county commissioners approve that budget, and the county website lists them the same way.
Second, send the message or make the call. Use this structure and fill in the blanks with your own facts:
I’m a [your job, your role, or however you describe yourself] living in [your neighborhood or city], and I care about this because [your reason, in one sentence]. I do not want license plate reader cameras operating here without a public vote, and I want officials and vendors who install them without one to face real penalties. Please support legislation that requires public consent before any deployment.
Filled in, it reads like this: “I’m an electrician living on the east side of town, and I care about this because my work van gets photographed a dozen times a day and I never agreed to that. I do not want license plate reader cameras operating here without a public vote, and I want officials and vendors who install them without one to face real penalties. Please support legislation that requires public consent before any deployment.”
The blanks are the point. Legislative offices record identical form messages as a single campaign. A message that opens with who you are, where you live, and why you care gets recorded as an individual constituent contact, and individual contacts are the number legislators see. If you call instead of writing, a staffer will answer, you say the same four sentences, they record your position, and the call ends in under a minute. You do not need to argue with anyone.
A short message from many people does more than a long message from a few. If every reader does only this, it is enough.
If you want to do more, here are the next steps in order of effort.
1. Send this article, with the model act below, to your state legislators and ask them to introduce it or sign on as co-sponsors. A template email follows.
2. Send it to your county Democratic central committee or your legislative district organization and ask them to adopt the endorsement resolution below at their next regular meeting. Party endorsements matter because legislators read them as a measurement of primary-election sentiment in their own district.
3. Find out whether your city already has these cameras. The crowdsourced map at deflock.org shows known locations.¹³ Whether or not it shows cameras near you, file a public records request with your police department for any ALPR vendor contract, the current data-sharing configuration, and the complete network audit log of searches run against your city’s data. The audit log is the document that has caused city councils across the country to cancel, because it lists federal and out-of-state searches the council never approved.¹
4. Speak at a council meeting if your city has cameras. State three things during public comment: the contract was signed without the process this act requires, you are requesting the network audit, and you are asking the council to adopt the consent requirement as a local ordinance.
5. Coordinate with existing campaigns. The ACLU organizes state by state under the name Get the Flock Out,¹⁴ and more than 50 cities have already canceled.⁷ Your officials would not be the first to act.
6. Report your results where other residents of your district will see them. Each public endorsement makes the next one easier to get.
Template Email to a State Legislator
Subject: Request to sponsor the Automated License Plate Surveillance Consent and Accountability Act
Dear [Representative / Senator] [Last Name],
I live in your district, in [city]. Attached is model legislation requiring public consent before any government in [STATE] installs automated license plate reader cameras, making it a felony for an official to install them without that consent, and imposing per-scan financial penalties on any vendor that installs them without verifying authorization.
More than 50 cities nationwide have canceled contracts with Flock Safety after audits showed federal agencies and out-of-state police searching local data without authorization. [STATE] residents are in that network right now. Existing laws regulate the data after the cameras exist. This bill regulates the decision to install them.
Will you introduce this bill or sign on as a co-sponsor? I am available by phone or email to discuss it, and I will follow up within two weeks.
[Full name]
[Street address]
[Phone number]
Endorsement Resolution for a Local Democratic Organization
Resolved, that the [County] Democratic [Central Committee / Party] endorses the Automated License Plate Surveillance Consent and Accountability Act; calls on the [STATE] Legislature to enact it; calls on every Democratic legislator representing any portion of [County] to sponsor or co-sponsor it; and directs the Chair to transmit this resolution and the full text of the act to each of those legislators within 14 days of adoption.
Model Act Text
The full act follows. Bracketed text marks the items a sponsor adapts to state code: felony classifications, the open meetings citation, and formatting. Everything else is ready to introduce.
AN ACT relating to public consent requirements for automated license plate recognition systems; establishing criminal penalties for unauthorized deployment; establishing civil penalties for vendors; creating a private right of action; and prescribing data protection requirements.
SECTION 1. SHORT TITLE.
This act may be cited as the Automated License Plate Surveillance Consent and Accountability Act.
SECTION 2. LEGISLATIVE FINDINGS.
The legislature finds that:
(a) Automated license plate recognition systems record the location, direction of travel, date, and time of every vehicle that passes them and retain that information in searchable databases, creating a record of the movements of persons who are suspected of no crime.
(b) A single private vendor operates more than 100,000 such cameras in the United States and processes approximately 20 billion plate scans per month across a shared national network.
(c) Governing bodies in multiple states have discovered, through audits and investigative reporting, that data collected in their jurisdictions was searched by or transferred to federal agencies and out-of-state agencies without local authorization, including thousands of immigration-related searches conducted through local law enforcement accounts.
(d) One municipality discovered roughly 600,000 searches of its data in a single year by more than 250 agencies it had never approved, and litigation in another state alleges that out-of-state and federal agencies searched one city’s data more than 1.6 million times in seven months.
(e) Vendors of these systems have installed cameras without required permits, made false statements to governing bodies concerning system capabilities and data sharing, reinstalled cameras after being ordered to remove them, and revised standard contract terms to restrict the ability of governing bodies to terminate.
(f) Deployment decisions are frequently made without public notice, without a recorded vote, and through no-cost trial programs that receive no procurement review, so residents learn that the systems exist only after they are operating.
(g) Existing law in this state and others regulates the use and retention of data after collection but attaches no personal consequence to the decision to deploy such systems without public consent.
(h) Federal law, 18 U.S.C. § 2511, classifies the unauthorized interception of a single wire communication as a felony punishable by imprisonment for up to five years. A system that records the movements of every vehicle in a jurisdiction warrants penalties graded at or above that standard.
(i) Public consent, obtained through noticed hearings and a recorded vote of elected representatives, is the minimum lawful condition for the operation of mass surveillance systems in a free state.
SECTION 3. DEFINITIONS.
As used in this act:
(a) “Automated license plate recognition system” or “ALPR system” means one or more cameras, together with associated hardware, software, or services, that automatically capture images of license plates, vehicles, or vehicle characteristics and convert them into machine-readable or searchable data. The term includes systems provided as a service and access to any shared or networked database of such data.
(b) “Deploy” means to install, activate, operate, connect to a shared data network, or obtain ongoing access to data from an ALPR system.
(c) “Authorizing ordinance” means an ordinance or resolution adopted by recorded vote of the governing body of the jurisdiction after no fewer than two public hearings, each noticed at least 30 days in advance in accordance with [cite state open meetings law], where the published notice and agenda materials for each hearing include: the number of cameras and their locations or location criteria; the identity of the vendor and the complete contract, including cost; the categories of data to be collected; the retention period; every entity that will have access to the data or the network; and the audit provisions.
(d) “Governing body” means the elected legislative body of a county, city, town, or other political subdivision, or, for a state agency, [the legislature].
(e) “Public officer or public employee” means any elected official, appointed official, or employee of the state or a political subdivision.
(f) “Vendor” means any person or entity that sells, leases, donates, installs, operates, or provides an ALPR system or access to ALPR data as a service.
(g) “No-cost deployment” means any deployment provided as a trial, pilot, demonstration, grant-funded program, or donation, or otherwise without expenditure of public funds.
(h) “Plate capture” means each instance in which an ALPR system records a license plate, vehicle image, or vehicle characteristic and converts it into data.
SECTION 4. PUBLIC CONSENT REQUIRED.
(1) No agency of the state or of a political subdivision may deploy an ALPR system without an authorizing ordinance.
(2) A material change to an authorized deployment, including any new data-sharing recipient, any new system capability, any increase in the number of cameras, or any amendment to the vendor contract, requires a new authorizing ordinance adopted by the same procedure.
(3) An authorizing ordinance expires two years after adoption unless renewed by the same procedure, following publication of a report stating the number of plate captures, every search performed, and every entity that accessed the data during the authorization period.
(4) The complete vendor contract, the system’s data-sharing configuration, and all audit logs are public records and are not exempt from disclosure as trade secrets or proprietary information.
SECTION 5. CRIMINAL PENALTY FOR UNAUTHORIZED DEPLOYMENT.
(1) A public officer or public employee who knowingly deploys, installs, authorizes, or executes a contract or agreement for an ALPR system, including any no-cost deployment, without an authorizing ordinance is guilty of a felony punishable by imprisonment for up to five years, a fine of up to $10,000, or both [insert corresponding state felony classification].
(2) The offense is a felony punishable by imprisonment for up to ten years, a fine of up to $20,000, or both [insert corresponding state felony classification], if the officer or employee:
(a) concealed the deployment from the governing body or the public;
(b) made a false or misleading statement to the governing body or the public regarding the system’s existence, capabilities, data collection, or data sharing; or
(c) continued operation of the system more than 30 days after receiving written notice of noncompliance from the attorney general, the governing body, or a court.
(3) The attorney general has concurrent original jurisdiction to investigate and prosecute violations of this section.
(4) Conviction under this section constitutes malfeasance in office. The office or position is forfeited upon conviction, and the person is disqualified from holding public office in this state for ten years.
(5) No public funds and no insurance purchased with public funds may be used to pay a fine imposed under this section or to indemnify a person convicted under this section.
(6) It is not a defense to a prosecution under this section that the system was provided at no cost or that no public funds were expended.
SECTION 6. VENDOR DUTIES AND CIVIL PENALTIES.
(1) A vendor shall not install or activate an ALPR system for an agency of this state or a political subdivision, and shall not connect any such agency to a shared data network, before receiving a certified copy of the authorizing ordinance. This duty applies regardless of the vendor’s knowledge or intent.
(2) A vendor that violates subsection (1), or that operates a system after the authorization expires or is revoked, is liable to each person whose vehicle was recorded during the unauthorized period for statutory damages of $1,000 per plate capture, or $5,000 per plate capture if the violation was willful or reckless.
(3) A vendor in violation is additionally liable to the state for a civil penalty of $10,000 per camera per day of unauthorized operation.
(4) Within 30 days of receiving notice of a violation, the vendor shall permanently delete all data collected during the unauthorized period and file a sworn certification of deletion signed by an officer of the company. Failure to do so incurs an additional civil penalty of $10,000 per day.
(5) A vendor found in violation of this section is barred from entering into any contract with this state or any of its political subdivisions for five years.
(6) Any contract for an unauthorized deployment is void and unenforceable. Any contract provision that restricts a governing body’s ability to terminate when it declines to approve or fund a deployment is void. Any provision requiring arbitration of claims arising under this act is unenforceable.
SECTION 7. DATA PROTECTION REQUIREMENTS FOR AUTHORIZED SYSTEMS.
(1) No ALPR data collected in this state may be shared with, transferred to, or made searchable by any federal agency or any out-of-state entity except pursuant to a warrant or court order.
(2) No ALPR system or its data may be used for immigration investigation or enforcement; for the surveillance of reproductive health care facilities, gender-affirming health care facilities, or persons seeking or providing such care; for the surveillance of activity protected by the First Amendment; or for any personal purpose of an officer or employee, including locating or monitoring a person with whom the officer or employee has a personal relationship.
(3) ALPR data shall be permanently deleted no later than 30 days after collection unless it is retained as evidence in a specific investigation pursuant to a warrant or court order.
(4) Every search of ALPR data shall be logged with the identity of the person searching, the date and time, and the stated purpose. Audit logs are public records, with plate numbers redacted.
(5) A willful violation of this section is a felony punishable by imprisonment for up to five years, a fine of up to $10,000, or both [insert corresponding state felony classification], and gives rise to the remedies in Section 6(2) and Section 8.
SECTION 8. PRIVATE RIGHT OF ACTION.
(1) Any person whose vehicle was recorded in violation of this act may bring a civil action for the statutory damages provided in Section 6, together with injunctive and declaratory relief.
(2) Any resident of a jurisdiction in which a violation occurs may bring a civil action for injunctive and declaratory relief.
(3) A prevailing plaintiff shall recover reasonable attorney fees and costs.
(4) An action under this section must be commenced within three years of the date the violation was discovered or reasonably should have been discovered.
(5) No agreement to arbitrate applies to claims arising under this act.
SECTION 9. ATTORNEY GENERAL ENFORCEMENT.
The attorney general may bring civil actions to recover the penalties in Section 6, may seek injunctive relief, and has the concurrent criminal jurisdiction provided in Section 5(3).
SECTION 10. RELATION TO LOCAL LAW.
This act establishes minimum requirements. A political subdivision may adopt stricter requirements, including prohibiting ALPR systems entirely.
SECTION 11. EXISTING SYSTEMS.
(1) An agency operating an ALPR system on the effective date of this act has 180 days to obtain an authorizing ordinance under Section 4 or to cease operation and complete removal of the system within 30 additional days.
(2) Operation beyond the deadlines in subsection (1) constitutes unauthorized deployment for all purposes of Sections 5 and 6, and the unauthorized period runs from the deadline.
(3) Data collected before the effective date without an authorizing ordinance shall be permanently deleted within 60 days of the effective date unless retained as evidence pursuant to a warrant or court order.
SECTION 12. SEVERABILITY.
If any provision of this act or its application to any person or circumstance is held invalid, the remainder of the act and its application to other persons or circumstances are not affected.
SECTION 13. EFFECTIVE DATE.
This act takes effect [immediately / 90 days after adjournment].
The Activist Library: Free Resources
Every resource below is free to use.
– DeFlock (deflock.org). A crowdsourced map of automated license plate reader locations. Check it to find the cameras near you, and add any you find that are missing.
– Have I Been Flocked (haveibeenflocked.com). A searchable collection of Flock audit logs obtained through public records requests, showing who searched which networks and the reasons they gave.
– Get the Flock Out (aclu.org/campaigns-initiatives/get-the-flock-out). The ACLU’s state-by-state campaign page, with local contacts, toolkits, and a record of which cities and states have acted.
– State of Surveillance (stateofsurveillance.org). Independent reporting that tracks Flock contract cancellations, lawsuits, and legislation, free to read without a paywall.
– Atlas of Surveillance (atlasofsurveillance.org). The Electronic Frontier Foundation’s database of surveillance technology in use by law enforcement agencies, searchable by city and county.
– Open States (openstates.org). Look up your state legislators and track bills in all 50 states.
– MuckRock (muckrock.com). A public records platform where released documents, including thousands of pages of Flock contracts and audit logs, are readable at no cost.
– The Existentialist Republic’s organizing materials, including the E.A.R.R. civic engagement booklets and other model legislation, at [insert link].
—
References
1. State of Surveillance, “30+ Cities Have Canceled Flock Safety Contracts. The List Keeps Growing.” May 19, 2026. https://stateofsurveillance.org/news/flock-safety-cancel-wave-30-cities-alpr-surveillance-contracts-2026/
2. Jason Koebler and Joseph Cox, “ICE Taps into Nationwide AI-Enabled Camera Network, Data Shows,” 404 Media, May 27, 2025. https://www.404media.co/ice-taps-into-nationwide-ai-enabled-camera-network-data-shows/
3. Emily Margaretten, “City Council terminates Mountain View’s license plate camera contract,” Mountain View Voice, February 25, 2026. https://www.mv-voice.com/city-government/2026/02/25/city-council-terminates-mountain-views-license-plate-camera-contract/
4. KTVU, “Class action lawsuit alleges Flock license plate readers violate CA law and privacy of residents,” February 2026. https://www.ktvu.com/news/class-action-lawsuit-alleges-flock-license-plate-readers-violate-ca-law-privacy-residents
5. Thomas Brewster, “This $4 Billion Car Surveillance Startup Says It Cuts Crime. But It Likely Broke The Law.” Forbes, February 27, 2024. https://www.forbes.com/sites/thomasbrewster/2024/02/27/flock-safety-surveillance-broke-state-law/
6. American Civil Liberties Union, “Municipalities: Beware of Changes in Flock’s Legal Terms if You’re Using or Considering License Plate Readers,” April 2026. https://www.aclu.org/news/privacy-technology/tracking-alpr-cameras/flocks-terms-and-conditions
7. Tech Times, “Flock Safety Crosses 100,000 Cameras as 53 Cities Cancel Over Unauthorized Federal Data Access,” June 29, 2026. https://www.techtimes.com/articles/319317/20260629/flock-safety-crosses-100000-cameras-53-cities-cancel-over-unauthorized-federal-data-access.htm
8. 18 U.S.C. § 2511.
9. Texas Government Code § 551.144.
10. 720 ILCS 5/33-3 (Illinois official misconduct statute).
11. 740 ILCS 14/20 (Illinois Biometric Information Privacy Act, damages provision).
12. In re Facebook Biometric Information Privacy Litigation, 522 F. Supp. 3d 617 (N.D. Cal. 2021) (final approval of $650 million class settlement).
13. DeFlock, crowdsourced map of automated license plate reader locations. https://deflock.org
14. American Civil Liberties Union, “Get the Flock Out” campaign. https://www.aclu.org/campaigns-initiatives/get-the-flock-out
No comments:
Post a Comment