ALPR cameras face bipartisan bills from Hawley, Sanders

ALPR cameras face bipartisan bills from Hawley, Sanders

Two bills introduced in the US Congress within three days target AI-powered automatic license plate recognition (ALPR) cameras. They show that opposition to the technology now comes from both parties, and that Flock and its competitors face growing political risk.

The first bill came on Wednesday from Republican Sen. Josh Hawley of Missouri. His Stop Flock Abuse Act aims to add safeguards for AI-enabled cameras and protect constitutional rights. On Friday, Democratic Sens. Bernie Sanders of Vermont and Jeff Merkley of Oregon, together with Rep. Alexandria Ocasio-Cortez of New York, followed with a broader proposal.

The Sanders-Merkley-Ocasio-Cortez bill would bar the federal government from using ALPR cameras. States that deploy them would lose federal funding. According to a press release, it would also let Americans sue the federal government if ALPR deployment violates their rights.

"Going to the doctor? Flock knows," Sanders said. "Dropping your kid off at school? Flock is tracking you. Flock is always watching. We cannot allow America to become a surveillance state where a handful of AI oligarchs profit by giving the government the power to track our every movement."

Not just Flock

Both bills cover all ALPR vendors, including Motorola and Axon, not only Flock. Privacy and civil liberties activists have warned for some time that public anger has focused on Flock because of its higher profile. Competitors with very similar practices have drawn far less attention. In recent weeks, some police departments ended their Flock contracts and then signed with another ALPR company.

At a hearing last week, lawmakers from both parties voiced concern about the technology. "What seems to make these networks unique is not just the sheer number of cameras; it's the fact that they're all linked together, empowered and searchable by AI," Hawley said.

One witness was Lindsey Isaacs from Florida. She was arrested and jailed for 13 days after a Flock Safety reader produced wrong data. Her car was the same model as a vehicle linked to a crime a few miles away. She said she spent more than three days in solitary confinement.

Hawley also cited work by cybersecurity researcher Joshua Michael. On September 23, Michael published a map showing about 300,000 Flock-connected devices across the country and more than 170,000 Flock cameras. Flock has consistently said it deploys only 120,000 cameras.

Michael said that in November 2025 he found an access token exposed on Flock's website that worked without logging in. He claims it let him query a Flock geographic information system and pull location data. Flock has reportedly filed a trademark infringement complaint against him. Michael said the company also sent him a cease-and-desist letter threatening litigation, and told customers by email that he was a malicious actor and that law enforcement had been notified. "I'm not backing down," he wrote on Instagram. Flock did not respond to a request for comment.

What Hawley's bill would change

Hawley's proposal is narrower but still strict for a Republican usually seen as friendly to police. It would:

  • ban ALPR companies and local governments from selling or sharing data with nongovernmental third parties
  • shield driver data from public records requests and block third-party vendor access
  • require written approval before officers run a search, plus routine supervisor audits
  • require encryption and cap data retention at 10 days (Flock now often allows 30)
  • prohibit adding facial recognition to the cameras

Privacy advocates say that is not enough. "It is a very good sign that leaders from both political parties are sponsoring bills to confront the dangers of AI-driven ALPRs," said Chad Marlow, senior policy counsel at the ACLU. "The critical next step will be Congress coalescing around a single bill that keeps people safe from ALPRs, and the only way to fully do that is with a ban."

Misuse cases keep piling up. On September 23, five Indianapolis police officers were arrested for allegedly running dozens, sometimes hundreds, of Flock searches to track personal contacts. The Washington Post also reported that officials in St. Lucie County, Florida, found 14 Flock cameras they had not known about or permitted.

It is unclear whether congressional leaders will schedule votes during the lame-duck session after the elections, but the topic is expected to return next year.

Our Take

For security readers, the Flock story is about more than policing. It combines a large, centrally searchable data set, insider misuse by authorized users, and an alleged exposed access token. These are the same failure patterns seen in many breaches. The response to Michael's disclosure also suggests that researchers probing surveillance vendors may face legal pressure rather than engagement.

The debate fits a wider concern about how much location and vehicle data is collected and shared, as seen in reports on connected car apps sharing driver data. It also echoes scrutiny of commercial surveillance firms such as the Paragon spyware maker.

It is worth watching whether both parties settle on one bill, whether retention limits or an outright ban prevails, and whether departments keep switching vendors instead of dropping ALPRs.