Flock Cut Retention to Seven Days. Your Town Still Holds the Real Switch

A camera beside the road photographs your car. It records the plate, time, place, direction of travel, and details such as the vehicle’s colour. You were not stopped. Nobody accused you of anything. Your trip still became a searchable record.

On 13 August 2026, Flock Safety announced that it would shorten its recommended default storage period for automated license plate reader data from 30 days to seven. The company also promised mandatory case codes for police searches, automatic lockouts for suspicious use, finer controls over searches by outside agencies, and a new way to preserve records linked to active investigations. (Flock Safety)

Some of those changes are useful. Seven days exposes less of your past than 30 days, provided the old records really disappear. A search tied to a real case leaves a better trail than a blank text box. An officer who repeatedly searches one person should meet a lockout rather than an audit months later.

But the announcement leaves the decisive switches where they were. Existing customers keep their current retention periods. Local agencies can choose longer storage. They decide who gets access, which searches are permitted, and what happens after an alert. Flock supplies the network and its defaults; your town, county, state, and courts still decide whether the camera becomes a narrow investigative tool or a map of ordinary life.

That distinction matters because a default is a suggestion written in software. A privacy rule is an enforceable limit.

What Flock changed on 13 August

Flock’s announcement arrived after documented misuse, public pressure, and cancelled or suspended contracts. The Associated Press reported on 13 August that thousands of law enforcement agencies in 49 states can search and share data across Flock’s network. The same report noted that dozens of cities and agencies had ended relationships with the company amid concern about immigration searches and unauthorised tracking. (Associated Press)

The clearest change concerns time. Flock says new deployments will use a recommended default retention period of seven days rather than 30. The company says more than 90 percent of searches made without a complete plate happen within a week. For investigations that need older records, a coming feature called Evidence Mode will let detectives preserve selected data in cold storage when it is tied to an active investigation. Existing customers will keep the periods already approved in their jurisdictions unless they choose to change them. (Flock Safety)

The second change concerns sharing. A city will be able to allow outside agencies to search its camera data for selected offence types while blocking others. Flock gives the example of allowing searches for a stolen vehicle, missing person, or violent crime while refusing searches connected to immigration enforcement. That is more precise than a single switch that shares everything or nothing.

The third change concerns misuse by authorised users. Flock says every law enforcement customer must adopt its Audit Assistance feature by the end of 2026. The feature looks for abnormal search activity. A planned proactive lockout will suspend a user when activity meets Flock’s criteria, pending review by an administrator. The company says more than one-third of customers had voluntarily enabled Audit Assistance before the announcement.

Flock also says case codes will become mandatory for every law enforcement search by the end of 2026. An emergency search can bypass the requirement, but that bypass should be flagged for review. The idea is simple: a person with access must connect the search to work the agency can identify later.

There are security changes too. Flock says it made multi-factor authentication mandatory at the beginning of August 2026, retained Bishop Fox for an independent security review whose summary it plans to publish in September, and is opening a coordinated vulnerability disclosure programme. Those measures address account and product security. They do not answer the separate question of whether a properly authenticated search should have happened.

The distinction between security and authority is easy to miss. Multi-factor authentication can stop someone who stole a password. It cannot stop an officer with a valid account from searching for an ex-partner unless policy, detection, review, and consequences work together. Encryption can protect stored location records from an outsider while leaving an authorised agency free to search millions of innocent trips.

Flock deserves credit for moving optional checks toward mandatory use. The company’s chief executive told The Verge that only about one-third of agencies had enabled Audit Assistance while it was voluntary. A control that sits unchecked in a settings panel protects nobody. (The Verge)

The useful question now is how much these controls constrain the system once they meet local practice.

One plate becomes a history of movement

An automated plate reader performs a small act many times. It photographs passing vehicles, reads visible plate characters, adds the camera’s location and time, and stores the result. A single record says little: one car passed one point at one moment. A network turns those points into routes.

Imagine four cameras around a town. One sits near the motorway exit, one outside a shopping district, one beside the hospital, and one on the road leading to a place of worship. A plate seen at the exit at 18:02, near the hospital at 18:17, and on the return road at 19:41 now describes a trip. Repeat the process for days and the database starts to show routines, associations, work patterns, and absences from home.

Flock’s scale makes sharing as important as any individual camera. The Associated Press described thousands of agencies in 49 states able to search and share data across jurisdictions as of 13 August 2026. A local council may think it bought a few cameras to find stolen cars. Network access can turn those local observations into answers for an officer hundreds of miles away.

That reach helps explain the appeal to police. A child reported missing in one county may pass a camera in another. A car linked to a violent crime can be found without officers manually asking every neighbouring department to check footage. Speed has real value in those cases.

The same reach changes the privacy cost. Everyone who drives past the camera supplies the raw material, including people unconnected to any investigation. Search comes later. Collection happens first.

This is the central design choice. Traditional suspicion asks investigators to identify a person or vehicle and then seek records relevant to that inquiry. A plate-reader network records the population’s movements so an investigator can travel backward in time after a target appears. Flock’s seven-day proposal narrows that backward window, but it keeps the collect-first structure.

Seven days can reveal plenty. A reporter may meet a source twice in a week. A worker may attend a union meeting. A patient can visit an oncology clinic, addiction service, fertility centre, or mental-health provider. A person escaping abuse may drive to a shelter or lawyer. The plate says nothing about purpose, yet place and timing can make a strong suggestion.

The data can also be wrong without the camera misreading a single character. A registered owner may not be the driver. A borrowed car, rental, shared household vehicle, mechanic’s test drive, or recently sold vehicle can connect the record to the wrong person. Flock says an alert should be treated as a lead and visually confirmed by an officer. That is a sound instruction, but practice depends on the officer slowing down when the system has already supplied a confident answer.

The privacy problem therefore has two parts. First, the system creates a searchable location history for people who are not suspects. Second, investigators may treat a record about a vehicle as a conclusion about a person. Shorter storage helps with the first. Training and corroboration help with the second. Neither one solves the other.

Why seven days is better and still optional

Retention periods change the amount of life available for retrospective search. Thirty days can show a monthly appointment, a recurring weekend visit, or the days someone was away. Seven days removes most of that older history. If deletion is real, complete, and applied across copies, the reduction is meaningful.

The word “default” carries most of the uncertainty. Flock states that existing customers will keep their current, democratically approved retention periods. Customers adopting the seven-day recommendation can use Evidence Mode without extra cost. Every community continues to choose the period that fits its strategy. (Flock Safety)

Your town may therefore remain on 30 days after the headline says seven. A neighbouring town may choose 60. Records preserved as evidence may live far longer. Data exported to another case system may follow another schedule altogether. A vendor default does not tell you what is happening where you drive.

Evidence Mode needs close attention because exceptions shape a retention rule. The ACLU said on 13 August that the change could be positive if the feature preserves only records that investigators identify as evidence in a specific active case. It warned that broad preservation of everything returned by a search could retain substantial location data about people and vehicles under no suspicion. (ACLU)

Those are different systems wearing the same label. In the narrow version, an investigator identifies one relevant record, records the case, and preserves that item. In the broad version, a wide search can freeze every result, including innocent vehicles that happened to pass nearby. The public announcement does not provide enough implementation detail to know which version every customer will receive.

Deletion also has edges. A record may exist in the primary Flock database, an evidence store, a downloaded report, an agency’s records system, a screenshot, a case file, a backup, or data received by another agency. A seven-day deletion rule should say which copies it covers, who can export data, whether export is logged, and how long recipients may retain it. Otherwise, the shortest timer governs only the easiest copy to see.

A serious local policy should answer those questions in writing. It should set a maximum period rather than repeat the vendor’s current default. It should define what qualifies for preservation, require a named case, limit the records preserved, and set a later review or deletion date. It should prohibit an administrator from quietly extending storage without a public decision.

Forty-eight hours, seven days, and 30 days are policy choices with different costs. The ACLU continues to recommend 48 hours. Flock recommends seven days. A town should justify whatever period it adopts against actual investigative use, rather than keeping data because storage is cheap. If more than 90 percent of partial-plate searches happen within a week, as Flock says, that fact argues against retaining the entire population’s records for a month by habit.

Retention limits work because information that no longer exists cannot be searched by a curious officer, exposed in a breach, demanded by another agency, or repurposed by a later administration. Deletion is a security control with political staying power. It removes temptation along with data.

Case codes and audit tools record use after collection

A case code creates friction. Before searching, an officer must connect the action to an identifiable investigation. A supervisor or auditor can later ask whether that case existed, whether the searched vehicle was relevant, and whether the scope made sense. Blank curiosity becomes harder to hide.

The code does not prove the search was lawful. A person can enter an unrelated case, choose a convenient offence, or use an emergency override. The ACLU points to earlier search-purpose controls that users could satisfy with vague or false text, including entries such as “investigation” and “hehehe.” Flock later replaced open text with a menu, but a menu still depends on the user choosing honestly. (ACLU)

A real case identifier is stronger than a reason typed from memory because an auditor can compare it with another system. That comparison must actually happen. If the case code field accepts any string, or if nobody samples searches against case files, it becomes paperwork attached to the same access.

Audit Assistance tackles a different failure. It looks for patterns that may signal abuse, such as repeated searches involving one person. Flock says the system will proactively lock users out when their activity meets defined criteria. That can interrupt harm earlier than a quarterly review of thousands of log entries.

Pattern detection has blind spots. An officer who makes one improper search may not look abnormal. Several officers can distribute searches. A legitimate but unusual investigation may trigger a lockout, while routine misuse blends into the baseline. Flock has not publicly described every signal, and publishing the full detection logic could help users avoid it.

Independent evaluation can test effectiveness without handing out an evasion manual. An evaluator can examine known abuse cases, create controlled scenarios, measure false positives and missed misuse, and report whether agencies respond to alerts. The ACLU says the tool has not received that kind of independent effectiveness review. Arrests or discipline following some alerts show that the system can find abuse; they do not reveal how much abuse it misses.

The local administrator matters too. Flock says a suspicious user will be locked out pending administrator review. If the administrator works beside the user, faces pressure to restore access, or lacks authority to investigate a senior officer, the software has passed the decision back into the same institution. A strong process sends alerts to an independent internal-affairs unit, inspector general, privacy officer, or external oversight body and records the outcome.

Ask what happens after the red flag. Who receives it? How quickly must they review it? Can the user be restored without a written reason? Does the person whose plate was improperly searched receive notice once an investigation permits it? Are misuse findings reported publicly in aggregate? A detection system earns trust through the path from alert to consequence.

Case codes and anomaly detection are valuable controls. They make misuse more expensive and leave evidence. They should be treated as the inner layer, where authorised access can still go wrong. The outer layer asks whether the database should hold the trip and whether the agency should be allowed to search it in the first place.

Local sharing controls need law behind them

Flock’s offence filtering could let one city share data for a homicide investigation while blocking an outside agency’s immigration search. That is better than all-or-nothing network access. It gives a council a way to translate some community rules into the platform.

A category selected by the searching agency remains a claim. If “violent crime” opens the data, the system needs a way to catch someone who labels another purpose as violent crime. Case-code checks, audits, sanctions, and recipient agreements have to support the dropdown. The technical switch can express a rule; it cannot supply honesty.

Sharing also creates a jurisdiction problem. Residents may win a strict policy at home while their journeys pass cameras owned by towns with weaker rules. Their local police may refuse an immigration query, yet another agency may obtain similar sightings from neighbouring systems. A vehicle moves across boundaries more easily than privacy law does.

The Associated Press reported that thousands of agencies can search and share Flock data across jurisdictions. Flock says customers own their data and decide who can access it. Both facts can be true. Local ownership inside a national search network means each owner controls one set of doors, while a searcher may find another route through another owner.

Contracts and memoranda of understanding should therefore name recipients and purposes. A blanket phrase such as “law enforcement use” gives away the decision. Good language prohibits onward sharing, requires the recipient to follow the origin agency’s rules, sets deletion deadlines, allows audits, and ends access after violations. The public should be able to see the agreement before the connection goes live.

Emergency access deserves a narrow definition. A missing child, immediate threat to life, or fleeing violent suspect can justify speed. An emergency override should record who used it, what facts created the emergency, which records were returned, and when a supervisor reviewed the decision. A monthly public report can show counts without exposing an active case.

Warrants supply an independent decision before historic location data is searched. EFF’s 13 August response restated its position that police should obtain a warrant signed by a judge to search historic plate-reader data about specific vehicles. (Electronic Frontier Foundation) A case code is an internal label. A warrant puts the basis and scope before someone outside the investigating agency.

The legal requirements vary by jurisdiction, and litigation over location records continues. A local government does not have to wait for the broadest possible court ruling before protecting residents. It can require a warrant by policy, with a documented emergency exception and later judicial review. Procurement is power. A council can put limits into the contract before cameras appear on poles.

Flock’s chief executive told The Verge that he now accepts more responsibility for product guardrails while still preferring lawmakers to make key decisions. That combination points to the right division of labour. Vendors should prevent obvious abuse by default. Democratic institutions should set durable limits that bind this vendor, its competitors, and whatever product replaces them.

What the announcement does not prove

A product announcement describes planned behaviour. It does not show how every agency has configured the product, whether old data was deleted, how alert reviewers respond, or whether outside searches match their stated purpose. Those facts require records and tests.

As of 14 August 2026, several changes are scheduled to roll out over the coming weeks or by the end of 2026. Flock says Audit Assistance and case codes will become mandatory for law enforcement customers by year end. Evidence Mode is also forthcoming. Claims about their effects should remain future tense until deployment can be observed.

The seven-day setting will not automatically replace every existing customer’s period. Flock says so directly. A person reading only the headline may believe a 30-day local database shrank overnight when no local vote or configuration change occurred.

The announcement also does not establish independent accuracy for Audit Assistance. Flock reports that misuse identification increased among customers using it. The company has not published the denominator needed to know what proportion of abuse it detects. The planned Bishop Fox review concerns product security, according to Flock’s post; the announcement does not say that review will measure civil-liberties outcomes or the effectiveness of misuse detection.

Offence filters do not prove that blocked categories cannot be relabelled. Case codes do not prove that the linked case justified the plate search. Evidence Mode does not yet reveal the exact boundary around preserved records in every deployment. Multi-factor authentication does not constrain valid users.

None of this makes the changes worthless. It tells us where verification belongs. Treat the new controls as testable claims. Ask for the local setting, the written policy, the audit result, the sharing list, and the exception count. Privacy survives through evidence rather than confidence in a dashboard.

The incentives deserve attention as well. A surveillance vendor earns money when agencies buy and keep its system. A police department gains investigative convenience from more data and wider access. The ordinary driver bears most of the privacy cost and rarely receives a notice, invoice, or chance to opt out. Good rules correct that imbalance by forcing the buyers to justify collection in public.

A future executive can reverse a company policy. A competitor can offer fewer restrictions. An agency can switch products while keeping the same appetite for data. A statute, ordinance, court order, or binding contract outlasts a settings update and follows the public institution rather than the vendor’s brand.

The standard should be simple: collect less, keep it briefly, search it only for a specific lawful purpose, require outside approval for historic tracking, log every access, and make misuse visible. Product controls can implement pieces of that standard. They cannot choose it for us.

What to ask your town this week

You do not need access to Flock’s internal systems to find the local privacy boundary. The contract, policy, council minutes, camera list, sharing agreements, retention setting, and audit records are usually held by a public body. The exact records law and exemptions depend on where you live, but the questions travel well.

Start with the agency named on camera notices, a council procurement page, or a public transparency portal. Ask for current records rather than marketing material. Date the request, save the response, and compare policy with configuration.

1. Find the actual retention setting. Ask how many days plate reads remain searchable today, on 14 August 2026, and whether the agency plans to adopt Flock’s seven-day recommendation. Request the written policy and a screenshot or configuration export showing the live value. Ask whether exported records, Evidence Mode, backups, and recipient copies use the same deletion rule.

2. Map every route out. Request the list of agencies and private entities that can search local camera data, plus every agreement governing that access. Ask whether your agency participates in national or statewide lookup, whether recipients can share results onward, and which offence categories remain enabled. A count without names hides the trust boundary.

3. Demand a rule for historic searches. Ask whether officers need a warrant, court order, supervisor approval, case code, or only an account. If the agency relies on emergency access, request the definition of emergency and the later review procedure. Push for a warrant requirement with a narrow, recorded emergency exception.

4. Test the case-code control. Ask whether the code must match a case in the records system, whether invalid strings are rejected, and how often auditors compare searches with case files. Request counts for searches without a valid case, emergency overrides, failed checks, and disciplinary referrals. A required box means little if any text opens it.

5. Follow Audit Assistance to its human owner. Ask when the agency enabled the feature, who receives alerts, what triggers an automatic lockout, who can restore access, and whether restoration requires a written reason. Request aggregate numbers for alerts, lockouts, confirmed misuse, cleared users, and unresolved reviews. Ask whether an independent body receives the same information.

6. Ask what happens after a bad match. Request policy and training for visual confirmation, registered-owner assumptions, stops based on alerts, and correction of inaccurate records. Ask how a person can challenge a record or learn that misuse affected them. The camera’s plate read should remain a lead until other evidence supports action.

7. Put the limits into law and contract. A council resolution can disappear into guidance. An ordinance and procurement terms can set maximum retention, warrant requirements, prohibited uses, public reporting, audit access, breach notice, deletion on contract termination, and penalties for misuse. Require those terms from every plate-reader vendor so replacement does not erase the safeguards.

The answers should be public before renewal. If officials cannot say how long the data lives, who searches it, or who reviews abuse, they are not ready to operate a location database. Pause expansion until they can.

Technical readers can help by turning vague claims into tests. Compare the published sharing list with audit-log recipient fields. Sample case codes against case-system records under proper oversight. Verify that expired records disappear from normal search and preserved evidence carries a scope and deletion date. Review emergency overrides for patterns. Publish methods and aggregate findings without exposing victims or active investigations.

Journalists and community groups should resist a familiar trap: arguing only about whether Flock is good or bad. The sharper story names the current configuration. Thirty days or seven? Local search or national sharing? Warrant or login? Independent audit or self-review? Those facts show residents what the system can cause.

If your threat model includes source protection, protest activity, immigration exposure, reproductive care, or an abusive partner with institutional access, assume roadside sightings can be joined until local evidence shows otherwise. Route choices may reduce some observations, but nobody can reliably avoid a dense camera network while living an ordinary life. The durable remedy is collective: fewer cameras, shorter storage, narrower sharing, warrants, and accountable use.

Defaults can help, law must hold

Flock’s 13 August changes move several controls in the right direction. A seven-day recommendation is better than 30 days. Mandatory case codes are better than optional codes. Automatic lockouts are better than logs nobody reads. Granular sharing controls are better than opening every search to every connected agency.

Each improvement has an edge. Seven days remains optional for existing customers. Evidence Mode can create a new store whose scope needs definition. A case code can be false. An audit tool can miss abuse. An offence filter can trust a misleading label. An administrator can restore access.

That is why the local rule matters more than the vendor’s promise. Your town chooses the retention period. It signs the sharing agreements. It decides whether a warrant is required, who reviews alerts, and whether the public sees the results. State and national lawmakers can set a floor that prevents one town’s weak rules from becoming everyone else’s side door.

The camera sees a plate. The network remembers a journey. The law should decide, before the search, when anyone is allowed to reconstruct it.

If you want security and privacy explained without the panic, join the newsletter on this site. One email per month.

Sources

• Flock Safety: Flock Updates Privacy, Accountability, Security, and Transparency Safeguards, accessed 2026-08-14
• Associated Press: Surveillance tech company Flock announces platform changes amid public backlash, accessed 2026-08-14
• The Verge: Flock CEO: ‘We got this one wrong’, accessed 2026-08-14
• American Civil Liberties Union: Despite ‘New’ Updates, Flock’s Creepy Cameras Remain Major Civil Liberties Threat, accessed 2026-08-14
• Electronic Frontier Foundation: Too Little, Too Late: Flock Admits Their Technology Needs Reforms, accessed 2026-08-14