20 Billion Scans a Month: The Camera Network Watching Every Car

The invisible camera network

Every time you drive past a Flock Safety camera, it captures your license plate, the make, model, and color of your vehicle, and distinguishing characteristics like bumper stickers, roof racks, tinted windows, and body damage. This happens whether you are a suspect in a crime or not. The data is stored for a minimum of 30 days and in many jurisdictions much longer [1].

Flock Safety, founded in 2017 and valued at $7.5 billion as of its 2025 funding round, operates Automated License Plate Reader (ALPR) cameras in more than 5,000 communities across the United States. The company processes approximately 20 billion license plate scans per month [2]. To put that in perspective, there are roughly 290 million registered vehicles in the US. That means the average car is scanned roughly 70 times per month.

Flock is not the only ALPR vendor. Motorola Solutions (through its Vigilant subsidiary), Rekor Systems, and others operate competing networks. But Flock has the largest footprint and the most aggressive expansion strategy, targeting homeowner associations, private businesses, and small-town police departments with low monthly subscription fees.

What the cameras actually capture

Flock cameras and modern ALPR systems go beyond reading license plates. Their computer vision systems capture and catalog [3]:

• License plate number and state
• Vehicle make, model, and year (identified by body shape, emblems, and proportions)
• Vehicle color
• Distinguishing features: bumper stickers, decals, roof racks, bike racks, trailer hitches, tinted windows, aftermarket modifications
• Body damage: dents, scratches, missing hubcaps, broken lights
• Direction of travel and timestamp
• Driver and passenger visibility (though Flock claims it does not use facial recognition, the raw images often capture faces through windshields)

This means that even if you remove or cover your license plate, the system can identify your vehicle by its physical characteristics alone. Flock calls this "Vehicle Fingerprint" technology and markets it as a feature [4].

The EFF investigation: 12 million searches by 3,900 agencies

In 2024 and 2025, the Electronic Frontier Foundation (EFF) conducted a comprehensive investigation into ALPR usage across the United States using public records requests. The findings were alarming [5]:

• 3,900+ law enforcement agencies had access to Flock Safety's ALPR network
• 12 million searches were conducted against the database in the period studied
• Searches were conducted for offenses ranging from homicide to unpaid parking tickets
• Agencies routinely ran bulk searches against the entire database, not targeted searches for specific suspects
• No consistent audit logs existed to track who searched for what and why
• Several agencies shared access credentials among officers, making individual accountability impossible

The investigation also found that agencies in states with ALPR restrictions routinely violated those restrictions. In San Francisco, which has local ordinances limiting surveillance technology use, the police department conducted 1.6 million ALPR searches, many of which appeared to violate the city's own policies [6].

Protest surveillance and immigration enforcement

ALPR data has been used for purposes far beyond solving car thefts and hit-and-runs. Documented cases include [7]:

Protest surveillance. Law enforcement agencies have used ALPR data to identify vehicles near protest locations, building lists of attendees at political demonstrations. During the 2020 protests, multiple agencies queried ALPR databases to track vehicles traveling to and from protest sites.

Immigration enforcement. Despite sanctuary city and sanctuary state laws prohibiting local law enforcement from cooperating with federal immigration agencies, ALPR data has been shared with ICE and CBP. The data flows through fusion centers and federal databases, circumventing local restrictions. A vehicle identified near a known gathering place for undocumented workers can trigger an immigration investigation without any local officer directly cooperating with ICE.

Domestic disputes. Officers have used ALPR databases for personal reasons, tracking the vehicles of ex-partners, neighbors in disputes, and personal acquaintances. Without proper audit controls, these abuses are difficult to detect and rarely prosecuted.

Insurance fraud investigations. Private entities with ALPR access (including repo companies and private investigators) have used the data to track vehicle movements for insurance companies.

60 cameras found exposed online

In a 2024 security assessment, researchers discovered approximately 60 Flock Safety cameras that were accessible over the internet with no authentication whatsoever [8]. These exposed cameras allowed anyone to:

• View live camera feeds showing passing vehicles
• Access stored license plate data
• Query the camera's local database of captured plates
• Modify camera settings including alert triggers

The exposure was caused by cameras deployed on networks without proper segmentation, combined with default configurations that did not require authentication for the management interface. Flock addressed the issue after disclosure, but the incident raised serious questions about the security of the broader network.

If the cameras watching everyone are themselves unsecured, the surveillance infrastructure becomes a target for stalkers, criminals, and foreign intelligence services who want to track the movements of specific individuals.

Communities fighting back

As awareness of ALPR surveillance has grown, more than 30 communities across the United States have voted to cancel their Flock Safety contracts or reject proposed deployments [9]:

• Piedmont, California voted unanimously to remove all Flock cameras after community outcry over privacy concerns
• Lexington, Massachusetts rejected a proposed Flock deployment after a contentious town meeting debate
• Lakeway, Texas canceled its contract citing insufficient evidence that the cameras reduced crime
• Indian River Shores, Florida removed cameras after residents raised Fourth Amendment concerns
• Multiple HOAs in Florida, Georgia, and Texas voted to terminate contracts after members learned the scope of data collection

The common thread: once residents understand what ALPR cameras actually collect and how long the data is retained, support drops sharply. Flock's sales strategy deliberately targets small decision-making bodies (HOA boards, city councils) where a handful of people can approve a deployment that affects thousands.

Where the law stands

The legal status of ALPR surveillance is fragmented [10]:

No federal regulation exists specifically governing ALPR technology. The Fourth Amendment's application to ALPR data remains unsettled. The Supreme Court's 2018 *Carpenter v. United States* decision held that accessing historical cell phone location data requires a warrant, and legal scholars argue the same logic should apply to ALPR data that tracks vehicle movements over time.

State laws vary widely:

• New Hampshire bans the use of ALPR systems except for active law enforcement investigations and requires data deletion within three minutes
• Maine requires a warrant for ALPR data retention beyond 21 days
• California has retention limits but enforcement is weak
• Utah requires data deletion after 30 days unless connected to an active investigation
• Most states have no specific ALPR laws at all

Local ordinances in cities like San Francisco, Oakland, and Somerville, Massachusetts, require community approval for surveillance technology purchases, but compliance varies.

What you can do

Check if your community uses Flock. Search your city or HOA name plus "Flock Safety" to find press releases or council meeting minutes about deployments.

Attend city council and HOA meetings. ALPR deployments are often approved in routine consent agendas with minimal public comment. Your presence and questions can force a real discussion.

Request your data. Under state consumer privacy laws (CCPA in California, VCDPA in Virginia, etc.), you may have the right to request what ALPR data has been collected on your vehicle. Contact Flock Safety directly at privacy@flocksafety.com.

Support organizations fighting ALPR overreach. The Electronic Frontier Foundation, ACLU, and Surveillance Technology Oversight Project (S.T.O.P.) all actively challenge ALPR deployments and advocate for stronger regulation.

Know the retention periods. If your jurisdiction has a data retention limit, request confirmation that the limit is being enforced. File public records requests for audit logs showing data deletion compliance.

Consider the broader implications. ALPR networks create a comprehensive record of vehicle movements across an entire region. Even if you trust your current local government, this infrastructure will still exist under the next administration, and the one after that. Data collected today can be searched retroactively for purposes that do not yet exist.

Twenty billion scans per month. That is the scale of the system watching every car in America. And most people have never heard of it.

Sources

1. Flock Safety, "How Flock Safety Works," company documentation, 2025
2. TechCrunch, "Flock Safety Raises $275M at $7.5B Valuation," 2025
3. Electronic Frontier Foundation, "Automated License Plate Readers: A Threat to Privacy," updated 2025
4. Flock Safety, "Vehicle Fingerprint Technology," product documentation
5. Electronic Frontier Foundation, "EFF Investigation: ALPR Usage Across 3,900 Law Enforcement Agencies," 2025
6. San Francisco Examiner, "SFPD Conducted 1.6 Million License Plate Reader Searches," 2024
7. ACLU, "Automatic License Plate Readers: Moving Beyond Cars," 2024
8. TechCrunch, "Dozens of Flock Safety Cameras Found Exposed Online Without Password," 2024
9. Vice Motherboard, "Communities Are Canceling Their Flock Safety Contracts," 2025
10. Brennan Center for Justice, "Automated License Plate Readers: Legal Status and Policy Recommendations," 2024