Published Thursday, August 13, 2026 at 04:40 PM PT
BLUF: Law enforcement technology vendor Flock has reduced its default ALPR (Automatic License Plate Reader) data retention window from 30 days to 7 days and acknowledged its surveillance technology requires additional reforms. EFF characterizes these changes as insufficient (“Too Little, Too Late”). No new requirements to address the core issue—blanket vehicle tracking of civilian movements—have been implemented. Departments using Flock should review their current data retention policies and confirm compliance with local privacy ordinances.
DETAILS:
Flock, a widely deployed ALPR platform used by U.S. law enforcement agencies, has altered its default optional retention period for ALPR data from 30 days to 7 days in response to reform pressure.
The Electronic Frontier Foundation reports this change represents an acknowledgment by Flock that its technology “needs reforms,” but characterizes the adjustment as inadequate to address systemic surveillance concerns.
Flock previously deployed an “Audio Distress Detection” feature (described as voice distress analysis) which the company has since ended following public criticism.
The change is limited to the default setting—departments remain able to extend retention periods beyond 7 days at their discretion, and no enforcement mechanism preventing longer retention is described in available material.
EFF’s broader critique (unconfirmed in full text) appears to focus on the permissiveness of ALPR technology itself rather than data retention alone.
IMPACT:
Law enforcement agencies using Flock remain able to retain license-plate-derived vehicle location data for law-abiding civilians with minimal accountability and no legal trigger requirement.
Even at 7-day retention, agencies can maintain continuous tracking profiles of routine civilian movements (commutes, medical visits, houses of worship, etc.) within that window.
Departments in states or localities with weak ALPR oversight statutes are not materially constrained by Flock’s change; their policies determine actual retention practice.
RECOMMENDED ACTIONS:
If your jurisdiction uses Flock: review the current data retention policy and confirm whether it limits retention to 7 days AND restricts usage to warranted investigations. If retention exceeds 7 days or permits bulk querying without individualized suspicion, escalate to privacy counsel.
Document current Flock configuration; if this is a public safety agency, FOIA the retention policy and query log for the last 12 months to verify actual practice.
Do NOT assume Flock’s default change reflects a privacy commitment. Defaults are often reversed under agency pressure when no legal restriction exists.
STATUS: Confirmed via EFF reporting. Full extent of Flock’s stated reforms not available in provided material; flagged as incomplete.
SOURCES:
EFF Deeplinks: “Too Little, Too Late: Flock Admits Their Technology Needs Reforms”
EFF Deeplinks: “Victory! Flock Ends Rollout of Audio ‘Distress Detection’”
Recent high-severity events at publish time:
