Your license plate was scanned this morning. Time-stamped, location-tagged, stored in a database searchable by police departments across the country — plus federal agencies like ICE and the DEA. No warrant. No notice. No vote by your city council. Flock Safety‘s network of more than 100,000 cameras captures billions of plate reads monthly, and most of those cameras arrived through “no-cost trials” signed by police chiefs or city managers without a single public hearing. Think of it like a surveillance app that quietly upgrades to full-price surveillance once your data is already in the system. Since early 2025, at least 30 to 50 localities have canceled Flock contracts — and a proposed model law called DEFLOCK aims to make unauthorized deployment a felony, not a footnote.
How Flock Got Everywhere Without Anyone Voting On It
Flock’s rapid spread relied on permit shortcuts, bypassed hearings, and a centralized database nobody’s elected officials ever formally approved.
Reporting has documented Flock cameras illegally strapped to Department of Transportation infrastructure without permits in multiple states, resulting in installation bans from at least two state transportation agencies. Contracts routinely bypassed budget hearings, signed at the police-department or city-manager level before residents knew cameras existed. Meanwhile, Flock’s centralized platform allowed out-of-state and federal agencies to secretly tracking users local data at will — access no elected body ever authorized.
Courts took notice. A Norfolk, Virginia circuit court ruled that collecting location data from the city’s 172 Flock cameras constituted a warrantless search under the Fourth Amendment. The Massachusetts Supreme Judicial Court warned that enough cameras across enough locations can invade a reasonable expectation of privacy. Yet every statute currently on the books regulates data after collection. Nothing holds the official who pressed “go” personally accountable.
“State lawmakers must pass comprehensive LPR legislation,” ACLU analysts have argued, pointing directly to that accountability gap.
What DEFLOCK Actually Does
The Automated License Plate Surveillance Consent and Accountability Act closes the gap current laws leave wide open, targeting the deployment decision itself.
DEFLOCK requires a public authorizing ordinance — two hearings, 30-day notice, recorded vote — before any ALPR deployment, including free pilots. Any public official who knowingly bypasses that process commits a felony carrying up to five years. Deception or defiance bumps the maximum to ten years, plus office forfeiture and a 10-year bar on holding public office. Public funds cannot cover fines or indemnify convicted officials.
Vendors face equally serious consequences:
- $1,000 per plate scan — $5,000 if the violation is willful
- $10,000 per camera per day in civil penalties to the state
- Prohibition on sharing data with federal agencies, ICE, or surveillance of reproductive health facilities and First Amendment activity
That structure mirrors Illinois’ Biometric Information Privacy Act, which produced a $650 million settlement with Facebook, proving per-scan damages work as a real deterrent. Even for systems that clear the public-consent bar, the bans above apply. Any affected resident can sue, with attorney fees covered, and arbitration clauses are void.
The Legal Precedents That Make This Possible
DEFLOCK functions like a building code — requiring permits before the first camera goes up, not lawsuits after the structure collapses.
This framework borrows from proven statutory architecture:
- Federal wiretap law, 18 U.S.C. § 2511 — makes intercepting a single communication a felony punishable by five years
- Texas Government Code § 551.144 — criminalizes conducting public business in secret meetings
- Illinois’ 720 ILCS 5/33-3 — grades certain official misconduct as a Class 3 felony
DEFLOCK applies that same logic to mass location tracking.
Every existing ALPR statute — Washington’s 21-day retention cap under the Driver Privacy Act, Massachusetts’ proposed 14-day deletion rule under H.3755 — regulates data use. DEFLOCK regulates the decision to deploy. Existing systems get 180 days to obtain authorization or shut down. Without structural deterrents like these, ALPR networks quietly become normalized infrastructure — and the no-cost-trial playbook gets recycled for whatever home security systems arrives next.
