Flock Safety tightens guardrails amid privacy backlash: what AI builders should watch for

Flock Safety, the dominant provider of automated license plate readers (ALPRs) to US law enforcement, is introducing mandatory guardrails after a surge of public backlash and evidence of officer abuse. The company now requires officers to enter a criminal case number before searching its network, makes automatic auditing mandatory, and recommends cutting data retention from 30 days to seven. For AI builders designing similar watchlist or access-control systems, the practical takeaway is that reactive policy changes can reshape product requirements fast, but enforcement gaps can undermine even mandatory safeguards.

New search requirements and mandatory auditing

Flock operates roughly 120,000 cameras across the US, giving officers access to a massive pool of searchable location data. A Washington Post investigation found 46 cases of officers accused of using the system for unauthorized purposes like stalking. In response, Flock is turning two previously optional features into requirements: officers must now enter a criminal case number before conducting a search, and an automatic auditing system that flags suspicious search activity is now mandatory for all agencies MIT Technology Review. The company also recommends that agencies hold data for seven days instead of 30, though agencies can override that limit, and lets departments restrict cross-department searches to specific case types like kidnapping.

Why developers building surveillance or access control tools should pay attention

The shift from optional to mandatory guardrails is the key signal here. Flock CEO Garrett Langley told MIT Technology Review that the company is moving from "building things that are optional" to having "a responsibility to enforce guardrails, not provide optionality" MIT Technology Review. For developers designing access control, audit logging, or data-sharing features in AI products, this highlights a growing expectation that platforms must actively enforce policy rather than rely on user compliance. The cross-department search limitation also demonstrates the value of purpose-based access restrictions, a design pattern that reduces scope creep.

Loopholes remain despite mandatory rules

The new requirements still depend on honest reporting by officers. The ACLU recently found that when Flock previously required a text reason for a search, officers entered generic terms like "investigation" or mocked the prompt, with one department entering "hehehe" 20 times MIT Technology Review. Flock does not verify case numbers, so an officer could type any string. The automatic auditing system could catch such behavior, but Flock has not disclosed how accurate it is or allowed independent researchers to evaluate it. ACLU's Chad Marlow notes that judging whether the changes reduce abuse would require opening systems to independent evaluation for the first time.

For AI builders, this is a reminder that mandatory logging and auditing are only as strong as the enforcement and transparency behind them. Without independent validation, internal audit tools can become a compliance checkbox rather than a deterrent.

Flock's changes are real but incremental. The company faces continued pressure from cities dropping contracts and laws banning ALPRs altogether. Builders designing similar platforms should watch for where the next round of requirements goes: verification of search justifications, independent audit access, and mandatory data retention limits that cannot be overridden. The direction is clear, even if the current implementation leaves room for circumvention.