An ALPR camera photographs every vehicle that passes it, not just the ones police are looking for. Each pass gets logged with the plate number, vehicle make, model, color, and any distinguishing features, plus the date, time, and exact location (EFF, earlier this year).

Behind the scenes, every plate gets checked instantly against "hotlists," curated lists tied to stolen vehicles, missing persons, or gang suspects. The check happens regardless of whether there's a hit, and the scan gets stored either way (EFF, three months ago).

Think of it less like a single traffic camera and more like a nationwide network of tollbooths that logs your car's passage every time, whether or not you owe a toll. Virginia alone has at least 159 law enforcement agencies using ALPRs, 139 of them through Flock, according to the state police's own 2025 accounting (VCIJ, three weeks ago).

That gap between pitch and architecture shows up constantly in practice. Flock markets the system around narrow goals like recovering stolen cars. But Buford City Schools in Georgia, a district of roughly 6,000 students, ran more than 375 ALPR searches for school-residency verification between January 2025 and March of this year, more than half of every search the district's officers logged in that stretch (EFF, earlier this year). Cameras sold as a stolen-car tool ended up checking whether families actually lived inside a school zone.

Access is the part almost nobody outside the police department seems to fully understand, including the officials who approved the contracts in the first place. Most agencies choose to share their camera data broadly, often folding it into a nationwide search pool, which means a single city's cameras can be searched hundreds of thousands of times a month by departments elsewhere in the country (EFF, earlier this year).

Bridgewater, Virginia, shows what that sharing can look like in practice. VCIJ reported that data from the town's five Flock cameras had been searched more than 7 million times by outside agencies nationwide, including federal agencies running immigration checks, before Virginia banned out-of-state data sharing. The town manager stonewalled reporters' questions about the number, writing in an internal email that he wasn't eager to talk to a reporter about it and would rather "sit tight" than respond. Only after VCIJ published the figure did town officials start asking Flock the same questions the newsroom had already asked (VCIJ, three weeks ago).

Immigration enforcement adds another layer. Agencies can opt into the FBI's "Immigration Violator" hotlist, a list populated exclusively by U.S. Immigration and Customs Enforcement and built on administrative warrants, meaning warrants issued by ICE agents without judicial review. EFF's public-records requests turned up agencies with that setting enabled even where the department's own transparency page lists immigration enforcement as a prohibited use, Sparks Police Department in Nevada among them (EFF, three months ago).

Local officials often can't get straight answers either. Alexandria's mayor, Alyia Gaskin, emailed the city manager in June 2025 asking how many cameras the city operated, whether anyone outside the police department could pull the footage, and whether outside agencies or federal partners could reach data from the city's 67-camera network. She added that fellow council members had asked the same questions and gotten no response (VCIJ, three weeks ago). Records from Norfolk show a similar pattern in reverse: after that city's police chief pressed Flock for a straight answer about a reported data exposure, a company representative sent back a set of scripted talking points and told him to forward the message to residents essentially unchanged (VCIJ, three weeks ago).

Flock recently shortened its standard retention window from 30 days to 7, telling customers that roughly nine out of ten searches happen in that first week regardless of the longer window. Cases that need more time get "Evidence Mode," which the company says preserves data tied to a specific case number rather than letting it age out after seven days; agencies can still layer on their own longer retention rules on top of that (ACLU, last month).

Lebanon's mayor, Mark Messer, has a specific reason not to take that 30-day figure at face value. He pointed to reports that Flock had offered the city of Sheboygan, Wisconsin, five years of historical data, which undercut his confidence that the retention period Lebanon had agreed to was ever the real number in practice (WVXU, last week).

Configuration changes worried him just as much as retention did. Messer cited a case in Mountain View, California, where the city reportedly discovered Flock had switched on nationwide search access without local knowledge, exactly the scenario he said Flock wouldn't rule out for Lebanon, a city that has kept nationwide search disabled since it first signed on (WVXU, last week). He also asked, without getting an answer, whether the database could be hacked and whether Flock could detect if an image had been altered (WVXU, last week).

Lebanon's police chief pushed back on the framing at the same meeting. Every search requires a case number and gets audited, he said, and the department has found no evidence any officer has ever misused the system; Lebanon, he added, was among the first cities to adopt what Flock calls a "model" policy with built-in safeguards (WVXU, last week). Flock says it has made a comparable tool, "Audit Assistance," standard across all its customers and claims the feature flags abnormal search behavior, though the company's own evidence for that claim amounts to noting that reports of officer misuse rose after the tool launched (ACLU, last month).

Neither claim settles the other. A case-number requirement and an audit tool describe what the system is designed to catch, not proof that it always does. Lebanon's council ultimately voted to shut off and cover its cameras immediately, though a separate motion to terminate the Flock contract outright failed 4-3; instead the city gave itself seven business days to determine whether it can exit the agreement without paying roughly $60,000 for the final year (WVXU, last week).

Once a camera network exists, it tends to get used for more than its original purpose. Beyond school-residency checks, EFF found at least five agencies running ALPR searches tied to employment background checks and 26 agencies pulling records over noise complaints, in some cases searching more than 6,000 camera networks nationwide over a single loud muffler or house party (EFF, earlier this year).

Misuse by individual officers has surfaced in multiple states, too. Officers in Texas, Georgia, the Carolinas, Wisconsin, and Florida have faced accusations of abusing Flock data, including one Florida officer who reportedly used the system to track an ex-girlfriend, according to reporting from 404 Media cited by VCIJ (VCIJ, three weeks ago).

An effectiveness problem sits underneath the privacy problem. Norfolk, Newport News, and Virginia Beach all told VCIJ they don't track how Flock data actually factors into criminal cases, even as Flock's own internal guidance urges agencies to justify the cost by comparing it against "unresolved crime," arguing a single recovered vehicle can exceed a camera's annual cost (VCIJ, three weeks ago). A Virginia resident who filed records requests over the issue put it plainly to VCIJ: agencies can't credibly claim the cameras work while declining to track the data that would prove it.

The two sides of this debate aren't really arguing about the same thing. The Electronic Frontier Foundation's position is that ALPR mass surveillance shouldn't exist at all, that no tweak to a settings menu removes the underlying danger, because the danger is the constant tracking itself and not any single misuse of it (EFF, last month). Police departments and Flock, by contrast, tend to point to local benefits, audit trails, and procedural safeguards as evidence the system can be managed responsibly. Both things can be true at once: the safeguards exist on paper, and the surveillance still reaches far past its stated purpose.

A federal judge rejected a Fourth Amendment challenge to Norfolk's Flock system earlier this year, ruling against a 2024 lawsuit brought by the Institute for Justice that argued continuous plate tracking amounts to a warrantless search (VCIJ, three weeks ago). That ruling closes one case, not the underlying question. Institute for Justice attorney Michael Soyfer told VCIJ that police departments routinely sign these contracts with no council vote or mayoral oversight at all, often after little more than reading Flock's marketing materials and calling another department that already runs the cameras (VCIJ, three weeks ago).

Virginia Commonwealth University criminal justice professor Brad Lehmann, a former police officer, said the scale of what these networks became caught even law enforcement off guard. Departments weren't thinking about mass surveillance on this level when they signed up, he told VCIJ, and most simply didn't have the capacity to fully vet the technology before deploying it (VCIJ, three weeks ago).

Lebanon resident Lauren Wolf pressed her council to slow down before it looks at any replacement system. She wants concrete answers on who can reach the data, where it travels once collected, whether it gets passed along further, and how long the system holds onto it, before another dollar of public money goes toward the technology (WVXU, last week). Those are the same questions worth putting to any local government running these cameras, no matter what the sales pitch promises.