Flock Makes Its Audit Tooling Mandatory, and Its Retention Cut Optional

Flock Safety announced a set of privacy, security and accountability changes for its automated license plate reader network on August 13, 2026, including making its previously optional Audit Assistance feature required and recommending that customers cut the default retention period for routine ALPR data from 30 days to seven ^[1][2][3]. The two halves of that announcement have different weight: the audit and query-authorization controls become part of the platform, while the retention reduction is described as a recommendation to customers ^[3][2].

The mandatory side is the more interesting engineering commitment. Audit Assistance is designed to flag abnormal search behavior and lock the user out until an administrator reviews the activity ^[4]. Law-enforcement searches will require a case code, and emergency overrides will be automatically flagged for review ^[5]. Flock is also adding mandatory multi-factor authentication, an independent security review, a coordinated vulnerability disclosure program and offense-based sharing controls that let an agency decide which categories of cases another jurisdiction may use to search its cameras ^[6][7]. The Associated Press separately reported that many controls that were previously optional will become mandatory, and that customers will keep the ability to preserve data as evidence under a case number ^[8]. Business Insider and The Verge described the same retention, audit and case-code changes ^[9]. Records tied to active investigations are preserved through a new Evidence Mode ^[2].

On retention, the arithmetic is straightforward: seven days instead of 30 removes 23 days from the routine window, roughly a 77 percent reduction ^[10]. It is also the one piece that a customer can decline, since Flock says customers own the data and set local policies ^[11]. That is the tell. A vendor does not make abnormal-search lockouts a hard requirement unless it has concluded that unreviewable query logs are now a product defect rather than a compliance checkbox for the buyer to handle.

The pressure behind that conclusion is documented. AP reported that more than 50 agencies or jurisdictions had canceled, suspended, rejected or deactivated Flock systems since the start of 2026, citing a tracker maintained by the activist group DeFlock ^[12]. AP also reported recent cases in which officers or other police employees were accused of searching for friends, relatives or romantic partners ^[13]. Those are exactly the failures that per-search case codes and lockouts are shaped to catch, which is the pattern: misuse gets fixed at the authorization layer only after it costs contracts.

What the changes do not do is settle the underlying dispute. The reporting does not establish that platform guardrails resolve the legal and policy argument over warrantless vehicle tracking, and critics quoted by AP argued that vendor controls are not a substitute for judicial review or local democratic oversight ^[14][15]. Retention is one variable among several: search authorization, cross-agency access, emergency exceptions, preservation rules and who actually reads the audit logs determine how far vehicle-location data travels ^[16].

Watch whether the seven-day recommendation becomes an enforced default or stays a toggle most agencies leave at 30, whether emergency-override flags and abnormal-search lockouts are reviewed by anyone outside the agency that generated them, and how offense filtering behaves when two jurisdictions disagree about what counts as a qualifying offense.