Claims against the record

Some of what Flock tells cities has held up. Some of it was false when the company said it, and Flock has admitted as much in writing. A United States Senator has concluded that "Flock deceived its law enforcement customers." Contract promises the company made in December were deleted in February. This page sets specific claims beside specific documents, and where a claim survives, we say so.

How to read this page

Each item below is a claim Flock or its supporters make, followed by what the primary record shows. We have tried to state each claim in the form Flock actually uses rather than a strawman version, and we have included the claims that hold up.

This page is the one most worth checking against its sources, because it is the one where we could most easily be unfair. So a note on method: we describe a statement as false only where a document establishes it was false, and we attribute intent only where the speaker or a public official has characterized it. Everywhere else we quote Flock and let the reader draw the conclusion. That restraint is not softness. It is what makes the section below hard to dismiss.

1. "Flock does not have any relationship with DHS"

We put this first because it is the one claim on this page that is not a matter of interpretation. Flock told its police customers something untrue, a Senate oversight inquiry established that it was untrue, and Flock conceded it.

The claim. To reassure state and local police worried that plate data could be used by federal immigration authorities, Flock assured them it did not provide access to the Department of Homeland Security. Senator Ron Wyden's October 16, 2025 letter to CEO Garrett Langley records the assurance and its purpose:

to address concerns that license plate data might be abused by federal immigration authorities, Flock has assured its state and local law enforcement customers that the company does not provide access to the Department of Homeland Security (DHS). Sen. Ron Wyden, letter to Flock CEO Garrett Langley, October 16, 2025¹

What was actually true. Flock had given four federal agencies access to its system. Wyden's letter states the finding and Flock's own confirmation of it:

Officials from Flock subsequently confirmed to my office in September that the company provided access to CBP, Homeland Security Investigations (HSI), the Secret Service, and the Naval Criminal Investigative Service as part of a pilot earlier this year. Flock told my office that during the pilot, which has now ended, CBP and HSI conducted approximately 200 and 175 searches respectively. Sen. Ron Wyden, October 16, 2025¹

The Senator's characterization, in his words. We are quoting it rather than paraphrasing, because the word he chose is stronger than any we would use ourselves:

With this representation about DHS access to Flock data, Flock deceived its law enforcement customers. Sen. Ron Wyden, October 16, 2025¹

And Flock's own admission. This is the part that removes the argument. Flock did not dispute the finding. It confirmed it, in language quoted directly in the letter:

Flock also confirmed that it misled its state and local law enforcement customers, telling my office that "due to internal miscommunication, customers were inaccurately informed that Flock did not have any relationship with DHS, while pilot programs with sub-agencies of DHS were briefly active." Flock Safety to Sen. Wyden's office, quoted in his October 16, 2025 letter¹

Read that sentence for what it concedes and for what it does not. It concedes the customers were misinformed. It attributes the cause to "internal miscommunication" — a phrase that assigns the error to a process rather than to a person, and that no outside party can verify. What is verifiable is the sequence: the denial was made, the pilots existed, and the correction came only after a Senator's office asked.

Then it happened a second time. Four months later, after Illinois' Secretary of State audited 12 agencies and found Flock had let U.S. Customs and Border Protection reach Illinois plate data in violation of state law, Langley issued a statement conceding the same category of failure again:

some of our public statements inadvertently provided inaccurate information Flock Safety CEO Garrett Langley, quoted by NBC Chicago⁶

and, more bluntly:

We clearly communicated poorly. Garrett Langley⁶

Verdict: false when stated, and admitted to be false by the company. A Deer Park council member does not have to decide whether Flock intended to mislead. The relevant fact is narrower and worse: the assurance most likely to matter to this city — who else can see our data — is an assurance this vendor has already given inaccurately, twice, and corrected only under outside pressure.

2. "You own your data"

The claim. Customers own 100 percent of the data their cameras collect. Flock has made versions of this statement in marketing materials for years.

What the contract said in December 2025:

As between Flock and Customer, all right, title and interest in the Customer Data, belong to and are retained solely by Customer. Customer hereby grants to Flock a limited, non-exclusive, royalty-free, irrevocable, worldwide license to use the Customer Data and perform all acts as may be necessary for Flock to provide the Flock Services to Customer. Flock does not own and shall not sell Customer Data. Flock Safety Terms and Conditions, December 2025, § 4.1 (emphasis added)²

What the contract says now:

As between Flock and Customer, all right, title, and interest in and to Customer Data belong to and are retained by Customer. Customer hereby grants to Flock a limited, non-exclusive, royalty-free, irrevocable, perpetual, worldwide license to (a) use and disclose Customer Data to provide the Flock Services; and (b) use Customer Data to support and improve Flock's products and services. Flock Safety Terms and Conditions, February 16, 2026, § 4.1 (emphasis added)³

The ownership sentence survives. The no-sale sentence does not. The word "perpetual" is added, and clause (b) — a license to use customer data to improve Flock's products — is new.

Notice what that combination does. "You own your data" is the sentence Flock still says out loud, and it is still true. The sentence that gave the ownership claim its practical force — the promise not to sell — is the one that was quietly removed from the contract while the marketing line stayed the same. A city that hears "you own your data" in 2026 is hearing a true statement that means materially less than it did in December 2025, and nothing in the sentence itself signals the change.

Meanwhile Flock's customer-facing privacy page continues to answer the ownership question with assurances of local control — "Our customers control their own data," "Access is controlled locally, not by Flock," "Every search is recorded and tied to a specific user" — and offers no promise about sale at all.⁷ The only reference to selling on the page is the boilerplate "Do Not Sell My Personal Information" link in its footer.

Verdict: technically true, and stripped of the guarantee that made it meaningful. A city does still own its data. It has also granted a perpetual worldwide license over that data, and the contractual promise not to sell it has been deleted.

3. The February 16, 2026 rewrite

This is treated separately because it is frequently described in circulating materials, and we want the description to be accurate. It is also the clearest documented pattern on this page: a set of specific customer protections that existed in one version of Flock's contract and do not exist in the next.

Flock replaced its customer terms on February 16, 2026. A machine-generated comparison against the December 20, 2025 version reports 147 changes — 96 replacements, 21 insertions, and 30 deletions — with the document growing from 12 to 15 pages.⁸

Read that table as a list of things Flock told customers in writing in December and stopped telling them in February. It promised not to sell customer data; that promise is gone. It promised training images would be de-identified, kept separate, and "never sold or shared with third parties"; that entire section is gone. It agreed that its liability caps would not shield it for gross negligence or willful misconduct; that carve-out is gone. Each deletion moves risk from the vendor to the city, and each one was made to a document most customers never re-read after signing.

The direction is uniform. We looked for a single change in the February terms that increased Flock's obligations to a customer, and we did not find one.

The last two rows are the ones a Deer Park council member should read twice.

The Georgia arbitration clause means that if Deer Park has a dispute with Flock, the forum is arbitration under Georgia law, not an Ohio court. A city that wants to sue over a data breach is contracting away its home forum.

The non-appropriation clause speaks directly to Deer Park's situation. Ohio municipalities routinely rely on non-appropriation to exit multi-year obligations — it is the standard mechanism by which a council declines to fund something next year. This clause says that route "shall not be based on discretionary budget decisions." Deer Park funded year one with a one-time $14,000 from the courts and never identified a source for year two.^9,10 A clause narrowing non-appropriation is a clause narrowing Deer Park's exit.

4. "Only law enforcement can access the data"

The claim. Access is restricted to sworn law enforcement for legitimate investigations.

The record. The restriction to law enforcement has generally held. The failures have been about which law enforcement.

• Illinois' Secretary of State audited 12 agencies and found Flock had allowed U.S. Customs and Border Protection to access Illinois plate data in violation of state law, and ordered access shut off.⁶
• Flock's own CEO acknowledged the company "didn't create distinct permissions and protocols in the Flock system to ensure local compliance for federal agency users," and that "some of our public statements inadvertently provided inaccurate information."⁶
• Mountain View found federal access to one camera's data through a setting "enabled without MVPD's permission or knowledge."¹¹
• Cleveland's safety director reported immigration authorities had accessed city data without the city's knowledge, and told council: "We are no longer involved in a national lookup."¹²

Verdict: true as stated, and engineered to be misleading in effect. The data did go to law enforcement. It went to federal law enforcement agencies that local officials had not authorized and did not know about, through settings on the vendor's side of the system. For a city where residents include immigrants, that distinction is the whole question — and it is the distinction the sentence is built to obscure.

The accountability claim, and what an audit can actually see

Flock's answer to all of this is the audit trail. Its CEO's own statement makes the promise expansive:

To underscore accountability, every single search conducted in the Flock LPR system is saved in an audit report. … This is part of our commitment to transparency and accountability from the beginning of the design process. Garrett Langley, Flock Safety, June 19, 2025⁴

The same statement deploys that audit capability as proof of innocence. Responding to reporting that a Texas officer had searched with a reason referencing abortion, Flock wrote:

Following this event, Flock conducted an audit of all searches conducted on Flock LPR and found not a single credible case of law enforcement using the system to locate vulnerable women seeking healthcare. Garrett Langley, Flock Safety, June 19, 2025⁴

That sentence describes less than it appears to. The ACLU's Jay Stanley put the limit precisely:

What they mean is that they found not a single case where a law enforcement officer had logged an abortion search as such. Jay Stanley, American Civil Liberties Union, October 31, 2025⁵

The audit searches a free-text field that the officer being audited filled in. It cannot see a search whose stated reason was "investigation." Wyden's letter establishes that more than 14 percent of 11.4 million nationwide searches gave exactly that — the single word "investigation," no case number — and that Flock neither requires a case-specific reason nor prohibits generic ones.¹ An audit of that field is an audit of what officers chose to write down.

And Flock's promised fix was found not to work. In the same June 2025 statement, the company announced a filter as a solution:

we released a new feature to automatically flag and exclude any search of Illinois camera data with terms that indicate an impermissible purpose. This proactive measure significantly reduces the risk of misuse, whether intentional or inadvertent. Garrett Langley, Flock Safety, June 19, 2025⁴

Wyden's office extended that same filter to Oregon by agreement in July 2025, then examined it. The finding:

subsequent oversight by my office revealed that these filters are easy to circumvent and do not meaningfully protect the privacy of Oregonians. Sen. Ron Wyden, October 16, 2025¹

The privacy protection that Flock promised to Oregonians … is meaningless when law enforcement officials provide generic reasons like "investigation" or "crime." Likewise, Flock's filters are meaningless if no reason for a search is provided in the first place. Sen. Ron Wyden, October 16, 2025¹

A filter that reads the reason field cannot catch an officer who leaves the reason field vague, and the company selling the filter knows how the field works. Wyden's letter also records something a council should weigh directly: Flock offered customers an opt-in case-number requirement under which employees of those agencies would not be required to document any reason at all when searching other agencies' data — and removed that option on August 18, 2025, the day before telling his office about it, "shortly after receiving questions about it from my office."¹

Set against the accountability promise is the company's own account of its role, as its chief communications officer put it to the press:

it is not Flock's job to police the police. Flock's chief communications officer, quoted by Sen. Wyden, October 16, 2025¹

Wyden's conclusion — his characterization, and he is a party with a stated position — is that "Flock has built a dangerous platform in which abuse of surveillance data is almost certain," and he recommends that "local elected officials can best protect their constituents from the inevitable abuses of Flock cameras by removing Flock from their communities."¹

And in one documented case the viewers were not law enforcement at all. In April 2026 a Dunwoody, Georgia resident's open records request showed Flock's own sales staff had viewed live feeds from private cameras at the Marcus Jewish Community Center of Atlanta — the fitness studio, the swimming pool, and, as the Atlanta Journal-Constitution described it, "the gymnastics area where children practice."^15,16

The mechanism matters, and it cuts in both directions. These were not Flock cameras. They were the community center's own private security cameras, linked into the Dunwoody Police Department's Flock network through Flock's Camera Connect service, which lets a business share live feeds with police.¹⁷ Flock did not install a camera in a children's gym. Flock employees reached inside one that a police network had been given access to.

Mayor Lynn Deutsch said Flock officials told her the employees were using the cameras "as part of a sales demonstration for another law enforcement agency," and that the city's own agreement "prohibits Flock from using Dunwoody's network of cameras for demonstrations."¹⁷ Her reaction, quoted: "concerned and perplexed," then "I'm very frustrated and angry."^17,15 Flock spokesperson Holly Beilin said the company "sent a letter of apology to MJCCA."¹⁶ Council renewed anyway, unanimously, on April 13, 2026 — a master services agreement, a $15,000 Flock911 contract, and a $200,000 drone agreement — over what the AJC described as "loud boos and chants of 'shame.'"^16,15 The renewed agreement drops the provision that had allowed Flock to use city cameras for demonstrations.¹⁶

5. "The system is secure"

The claim. Flock's platform and devices are secure, and the company is a responsible actor on security.

The record. Both halves of this are documented and both belong here.

Against the claim: the National Vulnerability Database lists 15 Flock Safety records, including two rated 9.8 of 10.¹⁸ Members of Congress reported to the FTC in November 2025 that the platform did not require multi-factor authentication and that more than 35 accounts were found with stolen passwords.¹⁹ 404 Media documented Flock Condor cameras reachable over the internet without authentication.²⁰

For the claim: Flock registered those CVEs itself through MITRE and has pledged to CISA's Secure By Design initiative.²¹ A vendor that files its own vulnerability disclosures is behaving better than one that suppresses them, and we will not pretend otherwise.

Verdict: mixed, and the disclosure conduct is genuinely to Flock's credit. Full detail, including Flock's response quoted at length, is on the security page.

6. "Cameras reduce crime"

The claim. Flock cites customer testimonials and case studies attributing crime reductions to its cameras.

The record. There is very little independent measurement, in either direction, and we are not going to overstate this.

What exists: Oak Park, Illinois is the only jurisdiction the Institute for Justice found publishing routine ALPR reports.²² Its oversight committee concluded:

With a total of two stops and approximately 2.1 investigative searches per day over this reporting period, it is clear that no statistically significant crime prevention or resolution is realized by using the Flock Safety ALPR System here in Oak Park. Oak Park Citizen Police Oversight Committee semi-annual report²³

And the qualification that must accompany it: the same report credits those two stops with 4 arrests and 2 firearms recovered, and the committee's "no evidence whatsoever" language refers to the police department declining to supply outcome data to its own oversight body.²³ It is a finding about missing information as much as about missing results.

Verdict: unproven on both sides. Flock has not published peer-reviewed evidence that its cameras reduce crime. We cannot show they do not. What we can show is that almost nobody measures, and that Deer Park is among those not measuring — its council has received one yes-or-no statement in fourteen months.²⁴

The honest framing for a council member is not "the cameras don't work." It is: you are being asked to renew without evidence either way, and the vendor's contract is the only document in this transaction that is precisely drafted.

7. "We are one of the few agencies without this"

The claim. This one is local. Deer Park's own minutes record the rationale for the November 2024 funding vote as: "We are one of 10-15 agency's that do not have this program."⁹

The record. It was accurate in November 2024, and adoption in Hamilton County is real. But it has aged badly as a reason to renew in 2026, because the direction of travel reversed:

• NPR reported in February 2026 that more than 30 U.S. cities had cancelled Flock contracts since early 2025.²⁵ By May 2026 the San Francisco Standard's tally had reached more than 80 jurisdictions in 28 states, 39 of them in that year's first five months.²⁶
• Cambridge, Massachusetts terminated for a "material breach of our trust and the agreement."²⁷
• Oak Park, Illinois exercised its contract's termination provision by board motion on August 5, 2025.²⁸
• Mountain View, California disabled all 30 cameras and terminated.²⁹
• Cleveland renewed only after cutting the term to six months and imposing warrant requirements, a 25 percent penalty clause, and a fusion-center ban.³⁰
• Dayton, Ohio suspended its program after finding roughly 7,100 immigration-related search requests in its own data, then covered all 72 cameras with trash bags.^31,32
• The Los Angeles Police Department let its contract expire over "serious concerns around civil liberties and civil rights issues."³³
• Marion, Ohio is weighing an ordinance banning the technology inside city limits.³⁴

Verdict: true when said, obsolete as an argument. "Everyone has it" was a reason to buy in 2024. In 2026 the more relevant list is the cities that bought and then left, and why.

8. "It's a static picture of a car"

The claim. Flock's chief executive, Garrett Langley, describing the product on television on July 23, 2026, after the LAPD dropped it:

The technology is really simple. A car drives by, we take a picture. It's a static picture of a car, and then we read the license plate. That's what the technology is — it's actually not that complicated, it's pretty simple. Garrett Langley, Flock Safety CEO, to ABC7 Los Angeles, July 23, 2026³⁵

The record. For the fourteen months before that interview, Flock marketed live video on the same devices. Its own blog post of June 9, 2025 promised that "All existing Flock LPRs will soon stream live video and capture clips with a free, optional software update," on the "same lens, same angle and field-of-view as the LPR," and that "Fixed live video is coming to all LPR cameras, free by end of 2025."³⁶ Marketing aimed at small departments in February 2026 said "Every LPR read is paired with a video clip."³⁷ Langley himself told Forbes in June 2025 that officers could "just open up the five nearest cameras in real time and say, here's what's happening right now."³⁸ A launch post headed "LPR Cameras Can Become Video Cameras" has been deleted from Flock's site; we quote it only through the reporting that preserved it.³⁹

Flock's answer, which is substantive. The company says this was "not a broad rollout" — five pilot agencies, LAPD not among them — and that in March 2026 it "discontinued the feature for law enforcement agencies," which "provided live video only and did not include recording or stored-video playback."³⁹

Verdict: the narrow claim about Deer Park's cameras today is consistent with the record; the description of "the technology" is not. On the evidence, no one can pull video from Deer Park's nine plate readers, and we say so on the how-it-works page rather than leaving room for a reader to infer otherwise. What the interview describes as the whole of the technology, though, is a capability the company shipped by cloud update to hardware identical to Deer Park's, and can ship again. The full sequence, with Flock's statement quoted in its entirety, is here.

What we are not claiming

Stated plainly, because a page like this is only useful if its limits are visible:

• We are not claiming Deer Park's data has been sold, breached, or accessed by federal agencies. We have no evidence of any of that.
• We are not claiming Flock's cameras perform facial recognition.
• We are not claiming Flock tracks Bluetooth, Wi-Fi, or radio signals. That capability is a real product, but it belongs to Leonardo, a competitor, and the claim is routinely misattributed to Flock. We set out the actual document.
• We are not claiming Deer Park operates anything other than plate readers. No video cameras, no audio detection, no drones. Only the nine ALPRs are documented.⁴⁰
• We are not claiming the Flock patent's demographic-classification language is running in Deer Park. We explain why not.
• We are not claiming the cameras have produced no public safety benefit. Deer Park's chief has said they help with hit-skip reports, and we take that at face value.²⁴

The argument does not need any of those. It rests on what is documented: a contract nobody has seen, from a vendor that deleted its no-sale clause and moved disputes to Georgia arbitration, governing nine cameras with no published policy, no retention limit, no audit, and no performance data.^3,13,40