Product7 distinct publishers3 min readPublished Updated
The licence plate reader company is making most of its new safeguards mandatory on 1 January, after its chief executive conceded that optional abuse controls sat unused at two-thirds of agencies.
The Product Desk · Product desk
Compiled by The Product DeskSomething wrong?How this is made
Flock Safety is cutting the default holding period for licence plate reads from 30 days to seven, and making most of the package its chief executive Garrett Langley published on 13 August mandatory for law enforcement customers on 1 January [1][3][4]. The consequential part is not the number. It is the concession underneath it: the company that spent a year offering abuse controls as free options now says the options were the problem [11][12].
The retention cut removes 23 days of history, about 77 percent of the default window [26]. Flock's stated justification is its own telemetry: officers finish more than 90 percent of searches without a full plate within a week [5]. A feature called Evidence Mode, rolling out in the coming weeks, lets detectives preserve specific data for active investigations, and is free for customers "who adopt the seven-day window" [6]. That phrasing is worth reading twice. A default is not a ceiling, and the free tooling is framed as an inducement to accept the shorter period rather than a consequence of it [6].
The adoption numbers explain the shift to compulsion. Audit Assistance, which flags abnormal activity for administrator review and can suspend access automatically pending that review, launched 16 weeks ago as a free option [8][9]. Roughly a third of agencies had switched it on [8], meaning about two-thirds had not [27]. According to Ars Technica, one Georgia sheriff's office turned the tool on and then arrested three officers who were separately using Flock cameras to stalk acquaintances, and Flock says identification of abuse "predictably went up" at agencies that activated it [16][17]. Case codes followed the same arc: introduced as an option in July 2025, resisted as a requirement, now required [10][11]. Langley told Engadget it was "such an obvious way to curb abuse" and that "we got this one wrong" [12].
The requirement has a hole in it. MIT Technology Review reports that Flock will not verify the case numbers officers enter, so the control is a paper trail rather than a gate [13]. That matters because the paper trail is what the automated auditing reads.
The pressure came from documented harm, not from a product roadmap. The Washington Post counted nearly 50 instances of officers charged or accused of unauthorised use, most of them tracking current or former partners or family members [14]. Savannah Police Department dismissed six employees this month, four of them officers, after finding the searches through Flock's voluntary audit function [15]. Langley told CBS News, of a woman who said the technology was used to stalk her, "I apologize. It kills me that she went through that" [28].
Critics are not persuaded that instrumentation is the fix. The ACLU called the measures retreads of inadequate safeguards while allowing the shorter retention window may be a step in the right direction, and wants an independent evaluator, saying there is "no evidence that the tool works consistently" [19][18]. Robert Frommer of the Institute for Justice told the Associated Press it was "window dressing that doesn't address the fundamental problem", because officers still decide who gets searched and when [20].
Three things to watch. Whether the Bishop Fox security review summary, due in September, is specific enough to check [21]. Whether Flock publishes lockout and false-positive rates for Audit Assistance, or lets an outside evaluator do it [18]. And what the transparency portals at more than 1,500 agencies actually show as retention periods after 1 January, since that is the only public record of whether the new default held [23][3].
Ranked by verification strength, evidence, and original report placement.
Flock Safety chief executive Garrett Langley set out the privacy and accountability package in a post on Flock's own blog on 13 August.
Audit Assistance flags abnormal activity for an administrator to review. It launched 16 weeks ago and more than a third of customers now use it; it becomes compulsory for every law enforcement customer by the end of the year. Ars Technica reports it has been available as an optional free feature since April and that only a third of agencies had opted in.
A related Proactive Lockout suspends access automatically when user activity meets defined criteria for abnormal behaviour, and the suspension can only be lifted by administrator review.
Under the case codes requirement, officers must attach a records management code to a search before running it, with emergency bypasses flagged for review.
Flock introduced case codes as an option in July 2025, and Langley told Engadget he had resisted making them a requirement.
Langley said of case codes: "This is such an obvious way to curb abuse", and added that "we got this one wrong".
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Announcement well documented, effect not verified
Three independent publishers report the same package with dated commitments, named features, quoted concessions and specific incident tallies, and much of it is first-party disclosure from Flock's own post that outlets checked against AP, CBS and Verge interviews. What is not evidenced is efficacy: the only proof offered for the abuse-detection tool is the vendor's own assertion, the case-number gate is explicitly unverified, and the independent Bishop Fox summary has not published.
Platform widely deployed, safeguards barely taken up
The underlying network is large and measurable: more than 120,000 cameras across 49 states, about 6,000 law enforcement customers, more than 1,500 transparency portals. Adoption of the safeguards at issue is the opposite: the abuse-detection tool reached only about a third of agencies in roughly 16 weeks as an opt-in, case codes were optional for a year, and the compulsory phase is prospective (end of year for the audit tool, 1 January for most privacy changes). Countervailing adoption pressure is also on record with more than 50 jurisdictions cancelling, suspending or rejecting contracts since January.
Reform framing runs ahead of demonstrated effect
The announcement is presented as a substantive accountability reset, and parts of it are concrete and dated. But the central deterrent claims are unproven or structurally weak: the vendor asserts abuse identification rose without publishing data, the mandatory case number is not verified, so the gate logs rather than authorises, enforcement dates fall after publication, and two separate critics independently characterise the package as window dressing that leaves search decisions with officers rather than judges. The retention cut is the least inflated element, since it is a default change with a stated usage-data rationale that even the ACLU allowed may be a step in the right direction.
Vendor acting under commercial and reputational pressure
Incentives are visible on every side and reported, not inferred. Flock announces after documented abuse cases, a chief executive apology on CBS News, a prior apology for calling privacy campaigners terrorists, and more than 50 jurisdictions cancelling, suspending or rejecting contracts since January, against a $500m run rate and a $8.3bn valuation that depend on agency retention. The controls are also first-party self-regulation announced on the company's own blog with a self-commissioned security review. Counterparties have their own stakes: the ACLU and the Institute for Justice are advocacy organisations pressing for independent evaluation and warrant requirements.
Facts solid, outcomes open
The factual spine (dates, features, uptake figures, incident counts, critic statements) is consistent across three publishers and partly first-party, so confidence in what was announced is high. Confidence in consequence is moderate: no independent efficacy data exists, one publisher's contribution is a short newsletter item, several figures come from single-sourced reporting of AP, Bloomberg, CBS and Verge interviews, and the mandates and security review summary all fall after the reporting window.
product
Flock's case-number rule is an honour system, and the company says it never checks2 distinct publishers
build
Flock cut retention to seven days and published the number that made 30 indefensible1 distinct publisher
product
Flock wants a privacy-safety compromise. The 46 misuse cases are an access-control bug.1 distinct publisher
build
WIRED reconstructed Flock's person-search guardrails from files served before login1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
arstechnica.com
1 article · August 13, 2026
fastcompany.com
1 article · August 14, 2026
gizmodo.com
1 article · August 13, 2026
techcrunch.com
1 article · August 13, 2026
technologyreview.com
1 article · August 14, 2026
thenextweb.com
1 article · August 14, 2026
theverge.com
1 article · August 13, 2026