Are Flock Cameras Legal? State Rules and Court Limits

Flock cameras can be used lawfully, but the rules depend on who operates them, where they operate, and how the resulting records are used. State ALPR statutes regulate different activities, while court decisions address particular constitutional claims. A camera purchase does not resolve those separate questions.

See the state comparison · Explore the cited laws

Information reviewed September 11, 2026.

Jurisdiction scope: This guide addresses US Flock license plate reader systems, with identified state-law examples and federal court decisions. It does not treat every Flock product as an ALPR or supply one rule for every state. The state-by-state ALPR comparison includes all 50 states and the District of Columbia.

What determines whether a Flock deployment is lawful?

The useful starting point is the activity being evaluated. Installing a camera, collecting plate images, searching stored records, retaining those records, and giving another organization access are distinct acts. For example, California separates an operator's privacy and security responsibilities from access logging and the additional obligations of public agencies. Its rules appear in Civil Code §§1798.90.51, 1798.90.52, and 1798.90.55.

The operator's identity matters too. California's definitions distinguish an ALPR operator from an end-user and include specific exclusions; the defined term “person” can encompass private entities and public agencies. Those definitions explain why a police department, a contractor, and a business accessing a database cannot automatically be analyzed as the same actor. See Civil Code §1798.90.5.

This guide uses the following questions to organize those distinctions:

These are research questions, not a substitute for the governing law. They also help separate this topic from ordinary security video. For the technology overview and related topics, see the ALPR laws hub and surveillance camera laws.

How long does Flock keep license plate data?

Flock's published materials describe a default, customer-specific settings, and investigative preservation. Its Evidence Policy, dated August 12, 2026, states a 30-calendar-day standard unless a customer's agreement specifies otherwise. The policy also says that expired LPR data cannot be restored after deletion. Those are the company's representations about its services, not a statutory retention period for every jurisdiction.

The company's August 13, 2026 announcement describes a seven-day recommendation and default, together with an Evidence Mode for preserving selected investigative data. It expressly says existing customers will keep their current approved retention periods and describes Evidence Mode as a forthcoming rollout. The announcement therefore does not establish that every installed camera or customer account switched to seven days.

When assessing a particular deployment, the relevant materials include its current agreement, the agency's published policy, and the applicable state retention rule. A company's general announcement cannot identify the configuration of a named customer's account. Likewise, the presence of a preservation feature does not establish that preserving a particular record satisfies state law.

Montana illustrates the distinction between a default and an exception: MCA §46-5-118 generally limits covered police plate data to 90 days but permits specified preservation requests and warrants. The preservation-request procedure requires identified cameras, plates, times, investigative grounds, and case information. A generic statement that the data “might be useful” is not a description of that statutory procedure.

How do state laws change the answer?

State rules can regulate authorized uses, privacy policies, searches, storage, sharing, vendor behavior, and oversight. A state-law permission for one purpose cannot be assumed to authorize every other purpose. Conversely, a prohibition with express exceptions cannot be reduced to a headline announcing that all cameras are banned. The following examples illustrate different legal structures; they do not replace the complete state comparison.

California: public policies and documented access

Civil Code §1798.90.51 requires covered operators to maintain reasonable security safeguards and a written public usage and privacy policy. The required topics include authorized purposes, authorized users and training, monitoring, sharing, responsibility for the system, accuracy measures, and retention and destruction.

Under §1798.90.52, access records identify the time, query information, user and relevant affiliation, and purpose. Uses must remain within the policy's authorized purposes. This makes the difference between possessing a database and having authority to conduct a particular search especially important.

Maryland: police use and vendor restrictions

Maryland Public Safety §3-509 requires a legitimate law-enforcement purpose for using captured plate data. Historical data belongs to the agency, cannot be sold, and is subject to limits on vendor access and uploads, including an express allowance for the Maryland Coordination and Analysis Center database.

The same section requires operational procedures, an audit process, privacy safeguards, personnel controls, and breach reporting. Annual reporting addresses matters including requests, releases, unauthorized uses, and completed audits. These are substantive police-data requirements; describing Maryland's law as merely a transportation provision would miss them.

Montana: exceptions to the public-highway restriction

MCA §46-5-117 begins with a restriction on state and local agencies using plate readers on public highways, then supplies exceptions. The police exception requires a public written policy, annual auditing, access records, and other safeguards. Listed police purposes include stolen vehicles, certain wanted or missing-person matters, warrants, and specified crime investigations.

The statute also says a positive reader match alone does not establish reasonable suspicion for a vehicle stop. It requires independent reasonable suspicion or the specified visual and other confirmation. The exception and its conditions both matter when answering whether a Montana police deployment is permitted.

What have courts decided about Flock and location searches?

Court decisions need to be read with their facts, procedural posture, and the conduct challenged. A ruling about one government's camera network is not a nationwide approval of all collection or searches. Nor does a decision about another technology automatically decide an ALPR case. These distinctions are particularly important when comparing the Norfolk litigation with the Supreme Court's later Google Location History decision.

The Norfolk district-court decision

In Schmidt v. City of Norfolk, No. 2:24-cv-00621, opinion filed January 27, 2026, the Eastern District of Virginia granted summary judgment to the defendants. The court allowed the plaintiffs to challenge collection and storage but found they lacked standing to challenge database queries on the record presented.

The constitutional analysis addressed the proved capabilities of Norfolk's system, including gaps in the vehicle observations. It did not decide that every ALPR network can collect unlimited location histories or that every database query is permissible. An opening brief filed April 13, 2026 identifies Fourth Circuit appeal No. 26-1227.

Chatrie concerns a different data source

In Chatrie v. United States, No. 25-112, decided June 29, 2026, the Supreme Court held that acquiring the Google Location History at issue was a Fourth Amendment search. It vacated the judgment and remanded questions about the warrant's validity. The decision did not adjudicate Flock cameras or establish a universal ALPR warrant rule.

The distinction between deciding that government conduct is a search and deciding whether that search is lawful remains essential. Chatrie's remand left warrant questions for further consideration rather than resolving them simply by identifying a search. Its location-data reasoning provides context for the broader debate, but an ALPR claim still requires attention to the challenged system and governing authority.

How can residents find the rules for a local deployment?

Start with the documents that govern the specific operator. A city meeting record concerns authorization and public participation; an agency policy describes operational rules; an agreement identifies contractual terms; and an access log addresses actual queries. Those documents answer different questions. In California, Civil Code §1798.90.55(a) requires an opportunity for public comment at a regularly scheduled governing-body meeting before a public agency implements its program.

Useful materials to look for include:

• The agency's current ALPR usage and privacy policy, with its revision date.
• The governing body's agenda, staff report, meeting record, or deployment proposal.
• The contract and amendments addressing storage, access, sharing, and termination.
• Published oversight reports or descriptions of how improper access is investigated.

This list identifies research leads rather than promising public access to every underlying plate record. Maryland, for example, separately excludes ALPR information from disclosure under its Public Information Act while requiring annual reporting under Public Safety §3-509(d) and (e). A published report and an individual's raw travel records are different materials.

Watch out: A vendor's statement that customers control their data is not permission to share it without legal limits. California's Civil Code §1798.90.55(b) limits a public agency's transfers to another public agency and only as otherwise permitted by law, with a clarification for hosting and towing services.

Frequently asked questions

This guide provides general legal information about identified US jurisdictions as reviewed on September 11, 2026. It is not legal advice. Consult a lawyer licensed in the relevant jurisdiction about a particular deployment, search, dispute, or case.

Last updated: September 11, 2026. State examples reflect the identified versions reviewed; the dated court filings and company statements retain their stated scope.