Are Flock Cameras Legal? State Rules and Court Limits

Yes, Flock license plate cameras can be used lawfully in the United States, but state law can limit who runs them: Maine allows plate readers only for listed government uses, and New Hampshire restricts them to law enforcement officers. In January 2026 a federal court in Virginia granted summary judgment to the City of Norfolk on a Fourth Amendment challenge to its Flock cameras, a ruling tied to that system's record that the plaintiffs have appealed to the Fourth Circuit. State ALPR statutes regulate different activities, while court decisions address particular constitutional claims. A camera purchase does not resolve those separate questions.

See the state comparison · Explore the cited laws

Information reviewed September 11, 2026.

Jurisdiction scope: This guide addresses US Flock license plate reader systems, with identified state-law examples and federal court decisions. It does not treat every Flock product as an ALPR or supply one rule for every state. The state-by-state ALPR comparison includes all 50 states and the District of Columbia.

What determines whether a Flock deployment is lawful?

The useful starting point is the activity being evaluated. Installing a camera, collecting plate images, searching stored records, retaining those records, and giving another organization access are distinct acts. For example, California separates an operator's privacy and security responsibilities from access logging and the additional obligations of public agencies. Its rules appear in Civil Code §§1798.90.51, 1798.90.52, and 1798.90.55.

The operator's identity matters too. California's definitions distinguish an ALPR operator from an end-user and include specific exclusions; the defined term “person” can encompass private entities and public agencies. Those definitions explain why a police department, a contractor, and a business accessing a database cannot automatically be analyzed as the same actor. See Civil Code §1798.90.5.

This guide uses the following questions to organize those distinctions:

These are research questions, not a substitute for the governing law. They also help separate this topic from ordinary security video. For the technology overview and related topics, see the ALPR laws hub and surveillance camera laws. For what Flock cameras capture and how to check whether your town uses them, see What are Flock cameras?.

How long does Flock keep license plate data?

Flock's published materials describe a default, customer-specific settings, and investigative preservation. Its Evidence Policy, dated August 12, 2026, states a seven (7) calendar-day standard retention period unless law or the customer's agreement requires otherwise. The policy also says that expired LPR data cannot be restored after deletion. Those are the company's representations about its services, not a statutory retention period for every jurisdiction.

The company's August 13, 2026 announcement describes a seven-day recommendation and default, together with an Evidence Mode for preserving selected investigative data. It expressly says existing customers will keep their current approved retention periods and says Evidence Mode would roll out in the coming weeks. A September 1, 2026 Flock post adds that the new seven-day default applies only to new law enforcement customers, while private-sector customers keep the terms established for their accounts. The announcement therefore does not establish that every installed camera or customer account switched to seven days.

When assessing a particular deployment, the relevant materials include its current agreement, the agency's published policy, and the applicable state retention rule. A company's general announcement cannot identify the configuration of a named customer's account. Likewise, the presence of a preservation feature does not establish that preserving a particular record satisfies state law.

Montana illustrates the distinction between a default and an exception: MCA §46-5-118 generally limits covered police plate data to 90 days but permits specified preservation requests and warrants. The preservation-request procedure requires identified cameras, plates, times, investigative grounds, and case information. A generic statement that the data “might be useful” is not a description of that statutory procedure.

How do state laws change the answer?

State rules can regulate authorized uses, privacy policies, searches, storage, sharing, vendor behavior, and oversight. A state-law permission for one purpose cannot be assumed to authorize every other purpose. Conversely, a prohibition with express exceptions cannot be reduced to a headline announcing that all cameras are banned. The following examples illustrate different legal structures; they do not replace the complete state comparison.

California: public policies and documented access

Civil Code §1798.90.51 requires covered operators to maintain reasonable security safeguards and a written public usage and privacy policy. The required topics include authorized purposes, authorized users and training, monitoring, sharing, responsibility for the system, accuracy measures, and retention and destruction.

Under §1798.90.52, access records identify the time, query information, user and relevant affiliation, and purpose. Uses must remain within the policy's authorized purposes. This makes the difference between possessing a database and having authority to conduct a particular search especially important.

Maryland: police use and vendor restrictions

Maryland Public Safety §3-509 requires a legitimate law-enforcement purpose for using captured plate data. Historical data belongs to the agency, cannot be sold, and is subject to limits on vendor access and uploads, including an express allowance for the Maryland Coordination and Analysis Center database.

The same section requires operational procedures, an audit process, privacy safeguards, personnel controls, and breach reporting. Annual reporting addresses matters including requests, releases, unauthorized uses, and completed audits. These are substantive police-data requirements; describing Maryland's law as merely a transportation provision would miss them.

Montana: exceptions to the public-highway restriction

MCA §46-5-117 begins with a restriction on state and local agencies using plate readers on public highways, then supplies exceptions. The police exception requires a public written policy, annual auditing, access records, and other safeguards. Listed police purposes include stolen vehicles, certain wanted or missing-person matters, warrants, and specified crime investigations.

The statute also says a positive reader match alone does not establish reasonable suspicion for a vehicle stop. It requires independent reasonable suspicion or the specified visual and other confirmation. The exception and its conditions both matter when answering whether a Montana police deployment is permitted.

What have courts decided about Flock and location searches?

Court decisions need to be read with their facts, procedural posture, and the conduct challenged. A ruling about one government's camera network is not a nationwide approval of all collection or searches. Nor does a decision about another technology automatically decide an ALPR case. These distinctions are particularly important when comparing the Norfolk litigation with the Supreme Court's later Google Location History decision.

The Norfolk district-court decision

In Schmidt v. City of Norfolk, No. 2:24-cv-00621, opinion filed January 27, 2026, the Eastern District of Virginia granted summary judgment to the defendants. The court allowed the plaintiffs to challenge collection and storage but found they lacked standing to challenge database queries on the record presented.

The constitutional analysis addressed the proved capabilities of Norfolk's system, including gaps in the vehicle observations. It did not decide that every ALPR network can collect unlimited location histories or that every database query is permissible. An opening brief filed April 13, 2026 identifies Fourth Circuit appeal No. 26-1227. On September 8, 2026, the Fourth Circuit docket shows the appeal tentatively calendared for oral argument during the court's December 8-11, 2026 session. On September 15, the City of Norfolk's counsel told the court they are unavailable for that entire session and available in January and March, so the argument date may change.

Chatrie concerns a different data source

In Chatrie v. United States, No. 25-112, decided June 29, 2026, the Supreme Court held that acquiring the Google Location History at issue was a Fourth Amendment search. It vacated the judgment and remanded questions about the warrant's validity. The decision did not adjudicate Flock cameras or establish a universal ALPR warrant rule.

The distinction between deciding that government conduct is a search and deciding whether that search is lawful remains essential. Chatrie's remand left warrant questions for further consideration rather than resolving them simply by identifying a search. Its location-data reasoning provides context for the broader debate, but an ALPR claim still requires attention to the challenged system and governing authority.

What if an HOA, apartment complex, or business installs the cameras?

Not every Flock installation is a police installation. A homeowners association, a condominium board, an apartment owner, a place of worship, or a retail business can buy the same cameras, and that changes which rules are in play. Three separate questions organize the analysis: whether the state's ALPR statute reaches non-governmental operators, what the community's own governing documents authorize, and what happens to the data afterward.

Flock's own Evidence Policy, dated August 12, 2026, describes both markets: "The Flock LPR camera can be used by law enforcement as well as private neighborhoods or businesses. Customers may choose to share their data with law enforcement so that regardless of the owner/purchaser, law enforcement is still able to help solve crime."

Which state ALPR statutes reach private operators

Some ALPR statutes are built around law enforcement agencies. Others regulate any person, and a few make private use unlawful outside a list of exceptions. The examples below come from the current statutory text; the state-by-state ALPR comparison covers the remaining states.

California's definitions do the work. "Person" means "any natural person, public agency, partnership, firm, association, corporation, limited liability company, or other legal entity," and an ALPR operator is "a person that operates an ALPR system," subject to a transportation-agency exclusion (Civil Code §1798.90.5(c), (e)). An association or business that runs the cameras therefore carries the §1798.90.51 duties: reasonable security safeguards plus a usage and privacy policy that is "available to the public in writing, and, if the ALPR operator has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site." Accessing or providing access to the information triggers the §1798.90.52 access record. An entity that only uses someone else's system carries parallel end-user duties under §1798.90.53.

Arkansas is stricter on its face and was rewritten in 2025. Under §12-12-1803(a) it is "unlawful for an individual, partnership, corporation, limited liability company, association, or the State of Arkansas, its agencies, and political subdivisions to use an automatic license plate reader system" except as subsection (b) allows. Act 668 of 2025, approved April 16, 2025, added subsection (b)(4) for "a private landowner, private leaseholder, or commercial business" using a reader "for the purpose of promoting public safety, deterring crime, and monitoring access to private property owned or leased by" that party, including ingress and egress on a private road it owns. The same act set a 60-day retention limit for those private users in §12-12-1804(a)(1), barred them from selling, trading, or exchanging captured plate data "for any commercial purpose" apart from a contractual asset-protection processor also capped at 60 days in §12-12-1804(e), required statistics compiled every six months and reported to the Legislative Council on request in §12-12-1805(c), and allowed the Attorney General to enforce the subchapter under the Deceptive Trade Practices Act in §12-12-1807(c).

Maine's prohibition is general. 29-A M.R.S. §2117-A(2) provides that "[e]xcept as otherwise provided in subsection 3, a person may not use an automated license plate recognition system," with exceptions in subsection 3 for the Department of Transportation, State Police commercial vehicle screening, and state, county, or municipal law enforcement agencies; subsection 6 makes a violation a Class E crime. New Hampshire's RSA 261:75-b opens by providing that the use of plate scanning devices "is restricted to local, county, and state law enforcement officers," on the conditions the section then lists. Minnesota defines the regulated device to include "a device that is owned or operated by a person who is not a government entity to the extent that data collected by the reader are shared with a law enforcement agency" (Minn. Stat. §13.824, subd. 1(b)), so a private feed enters that statute at the point it reaches police.

Utah runs the other way, which is why the operator's identity has to be identified first. As amended effective October 14, 2025, §41-6a-2003(1) provides that, except as provided in Subsection (2), "a governmental entity may not use an automatic license plate reader system," and the listed uses include regulating the use of a parking facility and "controlling access to a secured area." The companion section addresses data a governmental entity obtains "from a nongovernmental entity pursuant to a warrant" (§41-6a-2004(4)(b)(i)). Other sections of the same part do reach a private user: §41-6a-2005(1) directs "[a] person or governmental entity using an automatic license plate reader system" to preserve captured plate data for 14 days on a qualifying written request, §41-6a-2005(5) provides that a governmental entity "may obtain, receive, or use captured plate data from a nongovernmental entity only" under a warrant or the statute's disclosure-order procedure, and §41-6a-2006 makes "[a] person who knowingly or intentionally uses, obtains, or discloses captured license plate data in violation of this part" guilty of a class B misdemeanor.

Many states have no ALPR statute at all. There the question moves to general law: the governing documents, contract, trespass and tort principles, and any camera or recording statute. Compare the state pages for California surveillance camera laws and Arkansas surveillance camera laws.

What the Fourth Amendment does and does not decide

The Fourth Amendment restrains government conduct. In Burdeau v. McDowell, 256 U.S. 465 (1921), the Supreme Court said the Amendment's "origin and history clearly show that it was intended as a restraint upon the activities of sovereign authority, and was not intended to be a limitation upon other than governmental agencies" (at 475). A private association acting on its own behalf is not a governmental agency, so a Fourth Amendment claim is not the instrument that governs its camera purchase.

A plate in traffic is also exposed to view. United States v. Knotts, 460 U.S. 276 (1983) held that monitoring a beeper signal while following a vehicle on public roads was not a search, reasoning that "[a] person traveling in an automobile on public thoroughfares has no reasonable expectation of privacy in his movements from one place to another" (at 281). Knotts addressed government surveillance, and the Court reserved a separate question: "if such dragnet-type law enforcement practices as respondent envisions should eventually occur, there will be time enough then to determine whether different constitutional principles may be applicable" (at 284).

Private liability, where it exists, has come from statutes rather than the Fourth Amendment. In Bartholomew v. Parking Concepts, Inc. (2026) 118 Cal.App.5th 438, the First Appellate District held that "the collection and use of license plate information, without implementing the statutorily required policy governing this collection and use, constitutes such harm" under §1798.90.54, and reversed the order sustaining the demurrer as to that cause of action, remanding it for further proceedings. The same opinion observed that the ALPR Law "does not impose specific substantive requirements on private entities' collection and use of ALPR data" and instead "vests private entities that collect and use ALPR information with wide leeway to determine what to do with this data." On February 27, 2026 the court modified the opinion and denied rehearing, adding that it expressed "no opinion as to whether collecting and maintaining ALPR information with a usage and privacy policy that does not include every component identified in section 1798.90.51, subdivision (b)(2) would also cause such harm." Parts II and III of that opinion, which address the unfair competition claim and the state constitutional privacy claim, were not certified for publication, and California Rules of Court, rule 8.1115(a) provides that an opinion not certified for publication "must not be cited or relied on by a court or a party in any other action."

In Mata v. Digital Recognition Network, Inc. (July 20, 2026, D084781), the Fourth Appellate District affirmed summary judgment for a private ALPR company that had adopted a policy containing the seven required items and linked it on its website, holding that "[b]ased on the plain text, standing under the ALPR statute requires actual harm." Both decisions construe the same statute on different records, and the appellate history of each should be checked before relying on it.

Where an association's authority comes from

A board's power over a shared entrance or private street comes from the governing documents and the state's homeowners association or common interest statute, not from the vendor. California's Civil Code §4350 provides that "[a]n operating rule is valid and enforceable only if" it is in writing, "within the authority of the board conferred by law or by the declaration, articles of incorporation or association, or bylaws," not in conflict with governing law or those documents, adopted in good faith and in substantial compliance with the article, and "reasonable." A rule about "[u]se of the common area or of an exclusive use common area" falls within §4355(a)(1), which routes it through §4360: general notice with the text of the proposed rule change at least 28 days ahead, a decision at a board meeting "after consideration of any comments made by association members," and notice of the change within 15 days. Subdivisions (a) and (d) of that section allow an emergency rule change without the 28-day notice, effective for 120 days and not readoptable on the same basis, if the board determines an immediate change is required to address an imminent threat to public health or safety or an imminent risk of substantial economic loss to the association.

Florida states the source of authority directly. Under §720.303(1), "[t]he powers and duties of an association include those set forth in this chapter and, except as expressly limited or restricted in this chapter, those set forth in the governing documents," and §720.303(2)(b) gives members "the right to attend all meetings of the board," including "the right to speak at such meetings with reference to all designated items."

Whether a particular camera program rests on a board rule, a membership vote, or an amendment to the declaration is a governing-document question first, and the answer differs by state and by community.

What Flock's documents say about sharing with police

Flock's published position is that the customer, not Flock, controls the data. The Evidence Policy states that "Flock customers own all data they generate through use of Flock's services and control how it is used and shared," that data requests "must be directed to those customers," and that Flock "is not the proper recipient of your request." Its Data Ownership page, dated August 21, 2026, quotes section 4.1 of the customer terms and conditions: "As between Flock and Customer, all right, title, and interest in and to Customer Data belong to and are retained by Customer." That page also says sharing beyond operating the service requires the customer's direction, and that all sharing is "off" by default.

Retention follows the same structure. The Evidence Policy states a standard retention period of "seven (7) calendar days from the date of capture" that "applies to all customer data, unless otherwise specified in the individual customer's agreement," and says that expired LPR data "is permanently deleted and irretrievable."

Those are the vendor's descriptions of its own contracts and services, not statements of law, and they point a resident toward the community's own documents: if the customer holds the sharing decision, the community's agreement and policy are what answer whether a scan reaches a police database. State law can add a step the contract does not mention. Arkansas, for example, provides that a governmental entity "may only compel the release of captured plate data" from a user under §12-12-1803(b)(2), (b)(3), or (b)(4) "through a valid subpoena" (§12-12-1804(d)(3)), which addresses compelled release rather than a customer's voluntary sharing.

Documents a resident can ask for

• The operator's ALPR usage and privacy policy, in states that require one. California requires it in writing for the public and, for an operator with a website, conspicuously posted on that site (§1798.90.51(b)(1)).
• The association's contract. In California, "[e]xecuted contracts not otherwise privileged under law" are association records under §5200(a)(4) that the association must make available for inspection and copying by a member under §5205(a). In Florida, "[a] current copy of all contracts to which the association is a party" is an official record under §720.303(4)(a)9., and §720.303(5)(a) sets inspection within 10 business days of a written request.
• The board's record of the decision: the notice of the proposed rule change, the agenda, and the minutes of the meeting where the program was approved.
• The police side, with realistic expectations. Where a department holds ALPR records, several states shield the records rather than opening them. Utah treats captured plate data maintained by a governmental entity as "a protected record" under its records act (§41-6a-2004(1)(a)), and Maine makes retained ALPR data "confidential" (§2117-A(4)). A request is likelier to produce a policy, a contract, or an audit summary than another driver's travel history.

California's general privacy statute fits less neatly than it first appears. The CCPA defines a "business" as an entity "organized or operated for the profit or financial benefit of its shareholders or other owners" that also meets a revenue, volume, or revenue-share threshold (Civil Code §1798.140(d)(1)), so a nonprofit association ordinarily sits outside that definition. The ALPR Law's own civil action under §1798.90.54, which allows "[a]ctual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500)," is the California provision aimed at operators and end-users.

How can residents find the rules for a local deployment?

Start with the documents that govern the specific operator. A city meeting record concerns authorization and public participation; an agency policy describes operational rules; an agreement identifies contractual terms; and an access log addresses actual queries. Those documents answer different questions. In California, Civil Code §1798.90.55(a) requires an opportunity for public comment at a regularly scheduled governing-body meeting before a public agency implements its program.

Useful materials to look for include:

• The agency's current ALPR usage and privacy policy, with its revision date.
• The governing body's agenda, staff report, meeting record, or deployment proposal.
• The contract and amendments addressing storage, access, sharing, and termination.
• Published oversight reports or descriptions of how improper access is investigated.

This list identifies research leads rather than promising public access to every underlying plate record. Maryland, for example, separately excludes ALPR information from disclosure under its Public Information Act while requiring annual reporting under Public Safety §3-509(d) and (e). A published report and an individual's raw travel records are different materials.

Watch out: A vendor's statement that customers control their data is not permission to share it without legal limits. California's Civil Code §1798.90.55(b) limits a public agency's transfers to another public agency and only as otherwise permitted by law, with a clarification for hosting and towing services.

Frequently asked questions

This guide provides general legal information about identified US jurisdictions as reviewed on September 11, 2026. It is not legal advice. Consult a lawyer licensed in the relevant jurisdiction about a particular deployment, search, dispute, or case.

Last updated: September 11, 2026. State examples reflect the identified versions reviewed; the dated court filings and company statements retain their stated scope.

Frequently Asked Questions

Are Flock cameras legal in every state?

There is no single vendor-wide permission covering every activity. California, Maryland, and Montana illustrate different rules for operators, police uses, access, retention, and oversight. The state comparison identifies the authority and scope of each entry.

Can an HOA, apartment complex, or business install Flock cameras?

That depends on the state's ALPR statute and on the community's governing documents. California treats any person operating an ALPR system as an ALPR operator with security and public-policy duties. Arkansas makes private use unlawful except for listed purposes, including an exception added by Act 668 of 2025 for a private landowner, private leaseholder, or commercial business, with a 60-day retention limit. Maine and New Hampshire limit use to listed government users.

Does the Fourth Amendment limit an HOA's license plate cameras?

Burdeau v. McDowell describes the Fourth Amendment as a restraint on sovereign authority rather than a limitation on other than governmental agencies. Limits on a private camera program come from state statutes, the governing documents, and the contract instead.

Can a private neighborhood share its plate scans with police?

Flock's Evidence Policy states that customers own the data and control how it is shared, and that requests go to the customer rather than to Flock. Arkansas provides that a governmental entity may compel release from a listed private user only through a valid subpoena. Minnesota's definition reaches a non-government device to the extent its data are shared with a law enforcement agency.

Can a resident see the association's camera contract?

It depends on the state's records statute and the governing documents. California lists executed contracts as association records that must be made available to a member for inspection and copying. Florida lists a current copy of all association contracts as an official record, with inspection within 10 business days of a written request.

Does Flock delete every customer's data after seven days?

No. Flock's August 13, 2026 announcement expressly preserves existing customers' approved periods. The agreement, current local policy, applicable law, and any valid preservation process matter.

Did the Norfolk case approve every ALPR search?

No. The January 27, 2026 district opinion resolved the challenged collection and storage on its record; the plaintiffs lacked query standing.

Did Chatrie decide whether Flock cameras are constitutional?

No. Chatrie addressed Google Location History acquisition and remanded warrant-validity questions. It was not an ALPR decision.

Can a Flock alert alone justify a stop in Montana?

MCA §46-5-117 says a positive match alone does not establish reasonable suspicion. It requires independent suspicion or the specified visual and other confirmation.

Where can I compare my state's rules?

The linked ALPR laws by state page includes a section for every state and DC, distinguishing verified rules, limited provisions, future effective dates, and unresolved questions.