Flock Safety's Invisible Net: One Private Company Tracks Millions of Americans With Zero Federal Law

A $3.5 billion startup has quietly built the largest private license plate surveillance network in American history. It spans 5,000+ cities, feeds data to ICE and the FBI, and operates under almost no legal restraint. In 34 states, there are literally no laws governing how this data can be used, shared, or sold.

Every time you drive down a street in Clark County, Nevada, there is a 1-in-2 chance a camera operated by a company called Flock Safety has already photographed your license plate, logged the make, model, and color of your vehicle, recorded the timestamp and GPS coordinates, and uploaded all of it to a cloud database accessible by law enforcement agencies across the country.

In Clark County alone, there are at least 200 of these cameras. In neighboring Washoe County, at least 180 more. The company operates networks in over 5,000 cities across the United States. Founded in 2017 in Atlanta, Flock Safety is valued at approximately $3.5 billion. It has signed contracts with cities and counties often with no public discussion, sometimes without any council vote at all.

And in 34 states - including Nevada - there is not a single law on the books governing how this surveillance data can be used, stored, or shared with other agencies, including federal immigration enforcement.

A new investigation published by The Nevada Independent in partnership with the Associated Press documents in sharp detail what privacy advocates have been warning about for years: a private company has effectively constructed a national vehicle surveillance grid, and the government has done almost nothing to regulate it.

What Flock Safety Actually Does

Flock Safety makes what it calls "automated license plate readers" - ALPRs in industry parlance. The hardware is relatively simple: a pole-mounted camera with optical character recognition software that can read license plates at traffic speeds. What makes Flock different from older ALPR technology is the software layer behind it.

Each camera feeds into Flock's cloud platform, which cross-references plates against multiple databases simultaneously: stolen vehicle records, outstanding warrants, immigration watchlists, and user-created "hot lists" that individual agencies can customize. When a plate matches, the officer monitoring the system gets an alert in near real time.

But the alert is only the surface feature. The deeper function is historical search. Any officer with access to the system can query where a specific vehicle has been seen - across every Flock camera in the network, not just their own jurisdiction. In practice, this means a detective in Las Vegas can run a plate through the system and see that the same vehicle was photographed in Sparks, Nevada, and Flagstaff, Arizona, over the past 30 days.

The data Flock captures per pass includes the license plate number itself via OCR, the vehicle make, model, and color, the precise timestamp, the GPS coordinates of the camera, the direction of travel, and the unique camera ID that permanently ties the observation to a specific geographic location. Combined with historical data, this creates something functionally equivalent to a travel log - a detailed record of where someone's car has been and when.

"My sense of people in Nevada is that they're very skeptical of the government and they value their freedom and liberty. I think license plate readers - on a very philosophical and fundamental level - really harm that." - Dave Maass, Director of Investigations, Electronic Frontier Foundation, as quoted by AP News, March 2026

Flock's pitch to law enforcement is straightforward: it helps solve crimes. Sparks Police Chief Chris Crawforth told local media the technology helps "identify suspects in a much more timely fashion." Las Vegas Metropolitan Police called it a "wonderful investigative tool." Law enforcement agencies across the country report using ALPR data to solve burglaries, recover stolen vehicles, and track suspects.

None of that is wrong. The question privacy advocates are asking is something different: what happens to the data when it's not being used to solve a specific crime?

The Regulation Vacuum: 34 States Have Zero Laws

The National Conference of State Legislatures tracks ALPR legislation across the country. As of March 2026, only 16 states have implemented any legislation addressing the use of license plate reader cameras. Of those 16, only five explicitly prohibit their use by anyone other than law enforcement. That leaves 34 states - including Nevada, Texas, and Florida, three of the most populated states in the country - with no legal framework for this technology at all.

Nevada is a revealing case study. At least five cities and counties in the state have signed agreements with Flock Safety in the past three years. Clark County has at least 200 cameras. Washoe County has at least 180. The Las Vegas Metropolitan Police Department entered its agreement without any public discussion whatsoever, according to the AP investigation.

State legislators told reporters they simply cannot keep up. Assemblywoman Selena Torres-Fossett said it "hard for lawmakers to legislate what doesn't currently exist" - a phrase that reveals the fundamental problem: by the time legislators begin drafting bills, the infrastructure is already everywhere.

Nevada Assemblyman Skip Daly, described as a vocal critic of state AI use, said he was "incredibly concerned" but unclear whether he would introduce a bill. Current Nevada law prohibits using photographic or digital equipment to gather evidence for civil or traffic citations, but provides sweeping exceptions for law enforcement - meaning Flock's operation falls into a gap where it is not prohibited but also not regulated.

Brandon Bunce, a Las Vegas IT professional who began speaking at Clark County Commission meetings to protest the cameras, articulated the core problem with stark clarity:

"It's a classic case of tech accelerating ahead of governance. It's Nevada's next gold rush - a completely unregulated gold rush at our expense." - Brandon Bunce, Las Vegas resident and privacy advocate, as quoted by AP News, March 2026

The ICE Connection - and Why It Matters More Now

The surveillance vacuum becomes a direct civil rights concern when layered against the current political reality: the Trump administration has significantly accelerated immigration enforcement operations, and ICE - Immigration and Customs Enforcement - has moved aggressively to access any data tools available to it.

Assemblywoman Torres-Fossett said she was "particularly concerned" about Flock cameras being used for immigration enforcement, noting that to her knowledge no state law currently prohibits such use. This is not a hypothetical concern. Documents obtained through public records requests in other states show ICE has accessed Flock data as part of immigration operations.

Earlier this month, BLACKWIRE reported on ICE and DHS deploying drones and Flock cameras in Minneapolis to surveil activists and immigrant communities. That story focused on specific operations. What the Nevada AP investigation reveals is structural: the entire network is potentially accessible to federal agencies, and no legal mechanism prevents it.

Flock's own contract language is typically vague on this question. Agreements with local agencies generally specify that data can be shared "for law enforcement purposes," a definition broad enough to include federal immigration enforcement. Some contracts explicitly authorize sharing with "other law enforcement partners."

The privacy implication is significant. An undocumented immigrant who drives to work, to a medical appointment, or to church leaves a trail in Flock's system - every journey logged, timestamped, geolocated. If ICE queries a plate or vehicle description, that data is there. And in most states, the person whose movements are being tracked has no legal right to know it happened, no right to contest it, and no mechanism to have it deleted.

How Flock Became Inescapable: The Business Model

Understanding why Flock Safety grew so fast requires understanding its business model, which is cleverly designed to make municipal adoption almost frictionless. The company does not charge large upfront hardware costs. Instead, it operates on a subscription model: cities pay an annual fee (typically ranging from $2,500 to $4,000 per camera per year depending on contract terms and volume) and receive cameras, installation, maintenance, and access to the cloud platform as a bundled service.

For cash-strapped police departments, this is appealing. There is no capital budget request required, no procurement tender for hardware, and no IT department needed to maintain servers. It slots neatly into operational budgets. Several cities have used federal Department of Justice grants to fund Flock deployments, effectively routing federal money into building a private surveillance network.

The network effect amplifies the value proposition. A single city's cameras are useful but limited. But because Flock operates the same platform across thousands of cities, any one agency can query plate history across the entire network. A suburban police department in Sparks, Nevada, gains instant visibility into data from Las Vegas, from Phoenix, from Denver - everywhere Flock has a footprint. The more cities join, the more powerful every single agency's access becomes. This creates a self-reinforcing cycle of adoption.

Flock's rapid growth has attracted significant venture capital attention. The company raised $150 million in a 2021 Series D round and was reportedly valued at approximately $3.5 billion by late 2023. Investors include Tiger Global Management and Andreessen Horowitz. The company's revenue model - recurring subscription fees from thousands of government clients - is extremely sticky. Once a police department's workflows are integrated with Flock, canceling is operationally disruptive.

For investors, the long-term play is obvious. Flock has constructed critical law enforcement infrastructure across thousands of jurisdictions. That is not just defensible revenue - it is strategic leverage. The company that owns the surveillance layer of American law enforcement holds structural power that goes far beyond its current product line. Future upsells could include facial recognition integration, drone connectivity, AI behavioral analysis, or expanded data licensing to federal agencies.

Brandon Bunce, the Las Vegas privacy advocate, identified this dynamic with precision. The data farmed from companies like Flock, he told AP, is "digital gold" to investors. "It's a completely unregulated gold rush at our expense."

The Legislative Battlefield: Where Guardrails Are Being Fought

The regulatory void is not universal. A handful of states have moved to impose meaningful guardrails, and their efforts reveal what is possible - and how hard industry lobbies against it.

New Mexico is the most recent and significant example. In February 2026, the New Mexico Legislature passed a bill specifically designed to curb Flock overreach. Under the new law, police agencies cannot share ALPR data with out-of-state or third-party agencies unless they can affirmatively confirm that the data will not be used for federal law enforcement purposes that conflict with state law - including prosecuting abortions that are legal in New Mexico, infringing civil liberties, or purposes prohibited by the state constitution. The bill was signed into law and takes effect this summer.

The New Mexico law was driven by the ACLU-NM and represents a model others may follow. Its logic is explicit: the state's surveillance infrastructure should not be weaponized by federal agencies against its own residents. The specific carve-out around abortion enforcement reflects awareness that states are now in direct conflict with federal enforcement priorities in multiple domains simultaneously.

Arizona came close to passing SB1111 in January 2026, which would have required regular audits of ALPR searches, mandatory training, and strict access controls for the Flock system. The bill failed narrowly, reportedly after significant lobbying from law enforcement associations who argued the oversight requirements would slow their response times.

Illinois, the first state to pass comprehensive biometric privacy legislation, has applied its BIPA framework to some ALPR contexts - though legal challenges remain ongoing over whether license plate data constitutes biometric information. Virginia passed a law in 2020 requiring that publicly-operated cameras be registered in a state database, providing at least some transparency about where cameras exist, if not what is done with the data.

What these states have in common is the presence of organized, well-funded digital rights advocacy groups pushing legislators to act. Where that capacity does not exist - which is most of the country - the default is inaction, and Flock's cameras keep going up.

The Second-Order Effects No One Is Talking About

The debate around Flock Safety typically focuses on specific cases: did this camera help catch this burglar, did this data help ICE locate this immigrant. That framing misses the more important structural question, which is about what pervasive surveillance does to a society independent of any specific enforcement action.

Mass surveillance creates a chilling effect. When people know - or even suspect - that their movements are being logged, they modify their behavior. People who attend political demonstrations may think twice about driving to the event. Domestic abuse survivors staying with friends may avoid driving near their former home. Patients seeking reproductive healthcare in a state where it remains legal may worry about their vehicle being spotted on the road. The effect on behavior is not hypothetical - it is empirically documented in the academic literature on surveillance and self-censorship.

The data retention question compounds this. Flock's contracts with municipalities specify data retention periods that vary widely - from 30 days to two years depending on the jurisdiction. Some federal agencies, once they have queried and cached data from Flock, may retain copies under their own records schedules, which can extend significantly longer. There is currently no mechanism for a private citizen to determine whether their vehicle's travel data is being held by a federal agency, let alone to contest or delete it.

There is also the aggregation problem. Individual data points in the Flock system are benign in isolation: a car was at this intersection at 2:15pm on Tuesday. But the aggregation of months of such data for a single vehicle constitutes what courts have increasingly recognized as a fundamentally different kind of surveillance. In Carpenter v. United States (2018), the Supreme Court ruled that the government needs a warrant to access seven days or more of historical cell-site location data - precisely because aggregated location data reveals "the privacies of life" in a way that a single observation does not. The Flock question is whether the same logic applies to plate reader data, and whether law enforcement is currently circumventing the spirit of Carpenter by using ALPR databases that have no warrant requirement attached.

Dave Maass at EFF, who has been tracking the issue for years, is blunt about his frustration with Nevada specifically. The state's 2019 data privacy bill - drafted to give consumers some control over their information - was, in his words, "watered down to such an extent that it really applies to nobody." Maass observes that Nevada has a strong libertarian streak and an instinctive skepticism of government power that ought to make ALPR regulation politically palatable across party lines. And yet the cameras keep going up.

Brandon Bunce, who identifies as a former libertarian Republican now independent, said he has only been able to build opposition coalition members on the political left - "which is super weird to me because I thought the right would be against this sort of thing." His framing is sharper than most elected officials: "It's not a left versus right thing. This is a company making billions off of our data."

What Meaningful Regulation Would Actually Look Like

Flock Safety, for its part, has responded to criticism by pointing to its own internal audit logs - the existence of which became the basis for the public transparency site haveibeenflocked.com, which allows users to search whether their jurisdiction has a Flock system and view some audit data. The company argues that transparency tools give the public insight into how the data is used.

Privacy advocates counter that voluntary industry transparency is not a substitute for legal accountability. The distinction matters: an audit log that Flock chooses to make available can also be made unavailable. A law that requires disclosure cannot be quietly removed. The question of who controls the transparency mechanism is not a minor procedural detail - it is the entire ballgame.

What would meaningful federal ALPR legislation actually require? Legal scholars and digital rights advocates have outlined a clear framework. First, it would mandate retention limits - most proposals suggest a maximum of 30 days for plates that do not match any active investigation, with automatic deletion after that window. Second, it would require a warrant or judicial order for any retrospective historical query beyond 24 hours, aligning the standard with the Carpenter ruling's logic. Third, it would prohibit data sharing with federal agencies for purposes unrelated to the original collection purpose - meaning data collected to solve local burglaries cannot be shared with immigration enforcement without a separate legal process. Fourth, it would require annual public reporting on every agency that queries the system, what they searched for, and why. Fifth, and critically, it would establish a private right of action - allowing individuals to sue agencies or companies that misuse their data.

Arizona's failed SB1111 incorporated some of these elements. The New Mexico law addresses the inter-agency sharing problem. But no federal bill currently exists that would apply these standards nationwide. Congress has held hearings on ALPR technology. It has not produced legislation.

The reason is not mystery. Law enforcement associations lobby aggressively against restrictions on data tools. Technology companies like Flock employ their own lobbyists. The specific agencies that benefit most from the current regime - federal immigration enforcement, in particular - have every political incentive to keep the regulatory void intact.

Daly, the Nevada assemblyman, offered a prediction that sounds like a warning: "I do believe there is a clash coming with privacy rights over all this. How exactly that gets done, where the line is, I'm sure will be a source of a lot of income for lobbyists."

That clash is already here. It is playing out in courtrooms, in state legislatures, and in the quiet conversations happening in city council chambers across the country where residents are discovering, for the first time, that their city signed a contract to track their vehicles - and nobody asked them about it.

The Flock Moment

What makes the Flock Safety story genuinely important is not that it represents a new kind of threat. It represents the maturation of a familiar pattern: a private company deploys surveillance infrastructure faster than democratic institutions can respond, establishes deep integration with government clients, and then uses that integration as leverage against regulation. By the time the public conversation catches up, the cameras are already everywhere.

Flock is not the first company to do this. It will not be the last. But it is operating at an unprecedented scale, with an unprecedented level of integration with law enforcement infrastructure, at an unprecedented political moment in which the federal government is actively seeking to use every available data tool against people it wants to find.

The company itself has not done anything illegal. It is selling a product that law enforcement agencies are choosing to buy, under contracts that meet existing legal requirements. The failure is structural: the legal requirements are inadequate, the oversight mechanisms are absent, and the democratic processes that should govern surveillance technology deployment are being bypassed or ignored.

Dave Maass at EFF has been watching this unfold for years. His assessment is not optimistic. Nevada, he says, has "been bad on fighting stuff" when it comes to tech privacy. But he also believes the political dynamics are shifting - slowly, in fits and starts, driven by residents like Brandon Bunce who show up at county commission meetings and refuse to let the subject die.

"Sooner or later," Skip Daly told AP, "people will wake up to it."

The question is whether they wake up before the infrastructure becomes truly inescapable - before the cameras are dense enough, the data old enough, and the government contracts entrenched enough that dismantling the system becomes functionally impossible regardless of what any law says.

In Clark County, Nevada, there are already 200 cameras. And not a single law governing them.