A shopper pulls into a Lowe’s parking lot in Ohio. Before the engine’s off, a small camera on a pole has already read the license plate, cataloged the car’s color, make, and that faded marathon sticker on the bumper. Everything gets logged to a searchable database. This is Flock Safety’s automated license plate reader system—ALPR for short—installed at retailers across Ohio, feeding vehicle data to police. Sometimes for theft investigations. Sometimes, according to Fortune’s reporting, for immigration enforcement. Sometimes via a surveillance app built to track targets covertly.
How Flock’s Cameras Actually Work
These aren’t ordinary security cameras—they’re AI-powered vehicle profiling systems that scan every car that passes.
Flock’s cameras capture plate numbers plus vehicle make, model, color, and physical markers like dents, roof racks, and bumper stickers. A car can be identified even when the plate is obscured. All of that data feeds into centralized, searchable databases networked nationwide. Think of it as Spotify Wrapped for your car’s movements—except no one asked for consent and law enforcement can browse the playlist.
Here’s what’s actually happening:
- Home Depot and Lowe’s share data from hundreds of Flock cameras with police, according to 404 Media’s investigation
- Ohio agencies’ ALPR search logs frequently list vague justifications—”investigation,” “other,” bare numeric codes—offering almost no transparency into actual use
- Dayton suspended all 72 city-operated Flock cameras after outside agencies ran thousands of immigration-related searches against its database, which officials called “egregious violations,” per Fortune
- Flock lets commercial customers opt into sharing databases with law enforcement—many do, creating a blended private-public surveillance network among the broader pattern of tech scandals that have exploited user data
- Vehicle sightings remain searchable for roughly 30 days after each trip, per the Atlas of Surveillance project
What Retailers Say vs. What Investigators Found
Corporate talking points center on shoplifting prevention while omitting the full scope of data sharing.
Retailers frame ALPR deployment as loss prevention. Some, like Meijer, claim they only release data during active criminal investigations. But investigative reporting from 404 Media shows Home Depot and Lowe’s are deeply integrated into Flock’s shared networks. Corporate statements consistently omit retention timelines, sharing scope, and any safeguards against immigration enforcement use.
“Our biggest concerns lie with government use, but we are also deeply worried about unregulated and unfettered access by government and law enforcement to data first obtained via non-government sources,” the ACLU of Ohio’s legislative director told The American Prospect.
Dayton’s response was dramatic—trash bags over cameras, program frozen. Shoppers at Home Depot don’t get that option. No legislation currently requires retailers to disclose ALPR use, retention periods, or data-sharing practices. The real question isn’t whether anyone did anything wrong. It’s whether a database somewhere is quietly assembling a record of where you were, when, and how often—without you ever knowing, much like cases of secretly tracking users without any disclosure or consent.
