Flock Safety cuts default license-plate data retention to seven days, adds 'Evidence Mode' and new search limits

Flock Safety, one of the largest U.S. vendors of automated license plate reader systems, said Thursday it will shorten the default retention period for newly stored camera data from 30 days to seven and add new controls on how police search that information, a notable response to growing scrutiny of historical vehicle-location databases.

In an Aug. 13 post titled “Flock Updates Privacy, Accountability, Security, and Transparency Safeguards,” CEO Garrett Langley said the company will also introduce an “Evidence Mode” to preserve specific data tied to active investigations, require case codes for all law enforcement searches by the end of the year, and make its Audit Assistance misuse-detection feature mandatory for all law enforcement customers by year’s end. Flock also said it will add proactive lockouts for activity that meets defined criteria for abnormal behavior and offense filtering so customers can limit which outside agencies or offense types can search their cameras.

“Flock is cutting default data retention to seven days, making misuse detection mandatory for every customer, and inviting the rest of the industry to meet the same standard,” Langley wrote.

The changes are meaningful, but limited. Flock said existing customers will keep their current “democratically approved” retention periods rather than being moved automatically to seven days. The company said customers that adopt the new seven-day recommendation will get Evidence Mode at no cost, while Evidence Mode itself is expected to roll out “in the coming weeks.” Flock also said customers “retain ownership and control of their data.”

The announcement lands as Flock faces broader pressure over its police surveillance tools. The Associated Press reported Thursday that more than 50 agencies or jurisdictions have canceled, suspended, rejected or deactivated Flock contracts or cameras, citing the DeFlock tracker. Flock has said in press materials that it has more than 12,000 customers, giving the policy shift weight well beyond any single city or police department.

Automated license plate readers, or ALPRs, are cameras that capture vehicle sightings and store searchable records that can include a plate number, time, location and vehicle descriptors. In Flock’s networked system, participating agencies can search those records across jurisdictions. That has made the policy debate less about where cameras are mounted than about how long the data is kept and who can query a person’s past movements after the fact.

Flock framed the shorter default as a practical change based on usage patterns. “Our analysis shows that over 90% of searches without a full plate are done within a week. Evidence Mode, which will roll out in the coming weeks, addresses the exceptional cases that take longer,” Langley wrote.

Still, the company’s new guardrails do not resolve the larger legal dispute over whether police should need court approval to search historical ALPR data. The Electronic Frontier Foundation has said police should, at minimum, need a warrant signed by a judge to search historical records for specific vehicles. The AP reported that civil-liberties groups and legal scholars said Flock’s reforms may not answer those constitutional questions.

That debate is already playing out in court. In November 2025, the Electronic Frontier Foundation and the American Civil Liberties Union sued San Jose in SIREN and CAIR-CA v. San Jose, challenging warrantless retrospective ALPR searches by police. Public materials tied to that case cite 261,711 retrospective searches by San Jose police between June 5, 2024, and June 17, 2025.

The policy change also follows a year that has included documented misuse cases involving officers in Georgia, where some officers were fired, arrested or investigated over alleged improper searches.

Flock said it is also adding multi-factor authentication, commissioning an independent security review by Bishop Fox and launching a coordinated vulnerability disclosure program. Langley has also acknowledged the limits of leaving retention policy solely to vendors. “Historically, my point of view as a chief executive of a private company was, I don't know if I should be making these decisions,” he said in remarks quoted by the BBC. “I don't know if it's my job to say how long data should be retained.”