San Francisco Police Audit: Flock License Plate Data Improperly Searched for Federal Agencies (2026)

San Francisco Police Audit Finds Flock License Plate Data Was Improperly Searched for Federal and Out-of-State Agencies

A San Francisco Police Department compliance audit released in mid-June 2026 found that a regional intelligence center ran roughly 299 searches of the city's Flock automated license plate reader network over about a year on behalf of federal and out-of-state agencies, sharing that California law prohibits. The chief revoked the center's access pending review.

Information last verified on June 21, 2026. This is a developing story; we update it as the record changes.

Status: SFPD has disabled the regional center's access and opened an internal review; no enforcement action or court ruling has been announced as of June 21, 2026. Flock Safety has publicly denied that federal agents directly accessed the system.

Jurisdiction scope: This article addresses California's restrictions on sharing automated license plate reader data under SB 34 and the SFPD audit that surfaced apparent violations. It does not resolve any individual's claim and is not legal advice. For the broader framework, see California surveillance camera laws and surveillance camera laws by state.

What Happened

During a routine compliance review, the San Francisco Police Department found that the Northern California Regional Intelligence Center, a regional fusion center known as NCRIC, had granted the Western States Information Network access to SFPD's Flock automated license plate reader, or ALPR, data. According to the department, NCRIC gave the network's watch center access during overnight hours without SFPD's knowledge, and WSIN analysts then ran roughly 299 searches over about a year for outside agencies.

Police Chief Derrick Lew said the searches were conducted on behalf of agencies including the Drug Enforcement Administration, the IRS, and the Bureau of Alcohol, Tobacco, Firearms and Explosives, along with state agencies in Oregon and Washington. California law bars a local agency from sharing ALPR data with federal or out-of-state agencies, so those queries fall outside what SB 34 permits. SFPD framed the volume as about 0.005 percent of inquiries over the period, but the legal problem is the category of recipient, not the count.

Upon discovering the searches, Chief Lew turned off NCRIC's access to SFPD's ALPR system and started an internal review. NCRIC and WSIN access to the network remains disabled. Flock Safety, the vendor that operates the cameras, publicly denied that federal agents directly accessed San Francisco's system, a framing that does not address whether a fusion center ran searches on a federal agency's behalf.

What the Law Actually Says

California's rules for license plate reader data come from SB 34, enacted in 2015 and effective January 1, 2016, now codified at Civil Code section 1798.90.5 and following sections. SB 34 sets privacy and security requirements for any California agency that collects, stores, uses, or shares ALPR data, and it restricts who may receive that data.

The operative limit is in Civil Code section 1798.90.55. A public agency may not sell, share, or transfer ALPR information "except to another public agency, and only as otherwise permitted by law." The statute's definition of "public agency" reaches state and local agencies, including local law enforcement. It does not include out-of-state agencies or federal agencies. The California Department of Justice made that reading explicit in a 2023 information bulletin to law enforcement, advising that SB 34 does not authorize California agencies to share ALPR data with federal or out-of-state law enforcement, and that doing so is unlawful.

The San Francisco audit describes exactly the conduct that bulletin addressed, this time routed through a fusion center rather than a direct agency-to-agency transfer. Whether access flows directly or through an intermediary like NCRIC or WSIN, the recipients identified by SFPD (federal agencies and out-of-state agencies) sit outside the category of permitted recipients under section 1798.90.55. That is why the chief treated the searches as improper and cut off access while the department reviews how the arrangement was set up.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The audit illustrates a gap between what a data-sharing statute says on paper and how networked surveillance systems actually move information. SB 34 draws a clean line: California agencies may share ALPR data only with other California public agencies. The San Francisco findings show how that line can be crossed without a single California officer deciding to hand data to the DEA or IRS. A regional fusion center held access, extended it to a multistate network, and analysts at that network ran queries for outside agencies. Each hop can look routine to the people making it, yet the end result is the kind of out-of-jurisdiction sharing the statute was written to prevent.

For readers, the significance is that the legal protections around license plate data depend on access controls and audits, not just on the text of the law. SB 34 has prohibited federal and out-of-state sharing since 2016, and the California Department of Justice reinforced that in 2023, yet the conduct still occurred and was caught only on a compliance review. The remedy SFPD has announced, revoking access and reviewing the arrangement, addresses the immediate channel. It does not by itself answer how the access was granted overnight without the department's knowledge, which is the governance question the internal review will have to reach.

We are not predicting any enforcement outcome or how a court would treat these facts. The narrower point is that a compliance audit, not litigation, surfaced apparent violations of a statute that has been on the books for a decade, and that fusion centers and shared camera networks are where the practical limits of state ALPR law are now being tested.

How This Affects You

If your vehicle passes a Flock or similar ALPR camera operated by a California agency, SB 34 is the statute that governs how that record may be stored and shared. As a general matter, California agencies may share that data with other California public agencies, but not with federal or out-of-state agencies. The San Francisco audit shows that compliance is not automatic and that improper sharing can happen through regional networks rather than direct transfers.

California residents who want to understand an agency's practices can look for the ALPR usage and privacy policy that SB 34 requires agencies to adopt and publish. None of this is individualized legal advice, and whether any particular search violated the law is a fact-specific question that the department's review, and potentially other proceedings, will address. If you are outside California, your state may follow different rules, because ALPR statutes vary widely and many states impose fewer restrictions on sharing.

For the broader legal landscape, including the federal case law courts are applying and how ALPR statutes vary by state, see Automated License Plate Reader (ALPR) Laws Explained.

This is general legal information, not legal advice. It covers California's SB 34 limits on sharing automated license plate reader data and the SFPD audit that surfaced apparent violations, and it reflects sources verified on June 21, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Sources

• SB 34 (2015), An act to add Title 1.81.23 to Part 4 of Division 3 of the Civil Code (Chaptered text), California Legislature: https://www.leginfo.ca.gov/pub/15-16/bill/sen/sb_0001-0050/sb_34_bill_20151006_chaptered.html
• California Department of Justice, Information Bulletin on Automated License Plate Reader data sharing (2023-DLE-06): https://oag.ca.gov/system/files/media/2023-dle-06.pdf
• California Civil Code section 1798.90.5 et seq. (Automated License Plate Reader systems): https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.23.&part=4.

Related articles

• California surveillance camera laws
• Surveillance camera laws by state
• California recording laws
• Federal appeals court weighs Norfolk's Flock camera network
• Westchester license plate reader lawsuit

---

Last updated: 2026-06-21. This is a developing story; details verified as of 2026-06-21.

Frequently Asked Questions

What did the San Francisco police audit find?

It found that the Northern California Regional Intelligence Center had given the Western States Information Network access to SFPD's Flock license plate reader data, and that WSIN analysts ran about 299 searches over roughly a year on behalf of outside agencies, including federal and out-of-state agencies. California law does not permit that sharing.

Does California law allow sharing license plate data with federal agencies?

No. Under SB 34 (Cal. Civ. Code section 1798.90.55), a public agency may share ALPR data only with another public agency. The statutory definition of 'public agency' does not include federal or out-of-state agencies, and the California Department of Justice confirmed that reading in a 2023 bulletin.

What is SB 34?

SB 34 is California's 2015 law, effective January 1, 2016 and codified at Civil Code section 1798.90.5 and following, that sets privacy and security requirements for automated license plate reader data and limits who may receive it.

What did SFPD do in response?

Police Chief Derrick Lew turned off the regional center's access to SFPD's ALPR system and opened an internal review. That access remains disabled. The department described the improper searches as a small fraction of total inquiries.

Is this a court ruling against the police or the camera vendor?

No. The audit is a compliance finding, not a judgment. It identifies conduct that appears to violate SB 34, but no penalty, settlement, or court ruling has been announced as of June 21, 2026. Flock Safety has denied that federal agents directly accessed the system.