I wrote to Flock's privacy contact to opt out of their domestic spying program
A California resident tried to use state privacy law to force Flock Safety, a networked license-plate camera company, to delete records of their movements, and was told only Flock’s government and HOA customers “own” and control that data. Commenters debate whether Flock can really claim to be a mere service provider like AWS, given that it designs the surveillance system, aggregates and indexes the data, and enables cross‑agency sharing that resembles data brokerage. The exchange highlights a broader gap between privacy laws on paper and how large-scale commercial surveillance operates in practice, raising questions about legal accountability, data ownership, and the erosion of anonymity in public spaces.
Legal status of Flock’s role and data “ownership”
- Many commenters say Flock is positioning itself as a CCPA “service provider” (similar to a GDPR processor): its customers (cities, HOAs, etc.) are the “owners/controllers” of ALPR data, so deletion/opt‑out requests must go to them, not Flock.
- Others argue this is a legal fiction: Flock owns and leases the hardware, operates the cloud platform, indexes and analyzes license plates, and facilitates cross‑agency search, so it is exercising real control and should bear privacy obligations.
- California has a specific ALPR statute and separate data broker rules; some argue Flock qualifies as a data broker because it enables paid access to pooled PII, others say contracts and statutory definitions likely shield it.
- Government entities often have exemptions or different regimes under CCPA‑like laws, further complicating deletion rights.
Comparisons to other services
- Defenders analogize Flock to AWS, Google Cloud, or Sendgrid: infrastructure providers can’t practically or legally delete customer data just because a data subject asks.
- Critics respond that Flock is unlike generic storage: it deliberately parses, indexes, and links PII (plates, time, location) and markets “nationwide search” as a feature, more like an adtech or surveillance network than S3.
Is license plate/location data “personal information”?
- Some claim photos of a car in public aren’t clearly “personal information” or are “publicly available.”
- Others point to CCPA language covering information that can reasonably be linked to a person/household, arguing plate+time+location clearly qualifies, similar to IP addresses, especially when aggregated into movement profiles.
Privacy, surveillance, and civil liberties concerns
- Strong concern that Flock enables de‑facto mass location tracking and cross‑jurisdictional searches (e.g., abortion enforcement, protest tracking), approaching the effect of GPS tracking.
- Several see Flock’s “customers own the data” framing as a way to duck both privacy laws and constitutional constraints on government surveillance.
- Some argue current laws are toothless in practice: data subjects can’t even discover which entity to contact, AGs rarely act, and exemptions for law enforcement swallow rights.
What to do about it
- Suggestions include: complaints to state AGs, EFF and similar groups, targeted litigation, new legislation (state ALPR bills, stronger data broker rules), and pressure on municipalities to cancel contracts.
- A few comments advocate vandalizing cameras; others implicitly treat that as illegal and focus on legal, political, and community organizing routes instead.