We tend to imagine data loss as a break-in. Someone at a keyboard, a flaw exploited, a clean before-and-after where the bad thing happens at a knowable moment and someone is at fault. That picture is comforting because it comes with a villain.
Most of the time that’s not how your data leaves. It leaves because a setting changed and nobody told you. Because a default was never what you assumed. Because a URL got crawled, or a contract clause reserved a right you’d never have agreed to. No alarm goes off. There’s no intruder. Often there’s nobody who thinks they did anything wrong. The data is just gone, and you find out later, if you find out.
Flock is the cleanest example going right now.
The company runs automated license plate readers. Pole-mounted cameras photograph passing cars, log the plate, time, and place, and drop it all into a database anyone with access can search. By mid-2025 that was somewhere near 90,000 cameras and roughly 5,000 law enforcement agencies. [ACLU-MA; NPR]
And the cameras do real work. They’ve helped close serious cases, including finding a homicide suspect’s body late last year. [NPR] Police use them to chase stolen vehicles and suspects across city lines. That’s not nothing, and any honest read of the privacy problem has to sit next to it. Which is what makes Flock such a good test. This isn’t some obviously evil dragnet. It’s a useful tool that leaked anyway, over and over, without a single hacker involved.
Look at how the data actually got out.
Ventura County, California turned off Flock’s “National Lookup” in June 2023 to stay on the right side of state law. A vendor error switched it back on in early 2025. Before anyone noticed, outside agencies had run more than 364,000 queries against that data. [Rain Intelligence] No breach. A toggle flipped itself.
Mountain View is worse. A statewide lookup setting turned out to have been live on 29 of the city’s 30 cameras since the day they went in, and the police department had no idea. Over about a year ending December 2025, more than 250 agencies that had never signed anything with the city ran an estimated 600,000 searches against its data. One camera had a national setting quietly switched on too, and Flock kept no logs for that stretch, so there’s no way to know what left or where it went. The ATF, the Air Force, and a federal inspector general all showed up in the records. The city killed the contract. [Tech Times; Rain Intelligence]
San Francisco found something similar in an audit disclosed in June 2026: a regional intelligence center had queried the city’s cameras for federal and out-of-state agencies close to 300 times in a year. Flock’s answer is worth quoting, because it’s accidentally the whole point. The company said it “was not the result of a software malfunction, platform issue, unauthorized access or any failure of the Flock system.” [KQED] They’re right. Nothing broke. The data went where it shouldn’t anyway.
Then there’s the part where the plumbing just leaked into Google. In 2025, privacy advocates in Colorado started seeing police plate searches turn up in DuckDuckGo and Bing results, full plates, case numbers, the reason the officer typed in. Flock admitted about 70 of those URLs from 2024 and 2025 had been indexed before it pulled them. [404 Media, via Yahoo Tech] Nobody attacked anything. Sensitive records walked out through a link a crawler happened to follow.
Call the settings failures carelessness if you’re feeling generous. The contract rewrite doesn’t get that excuse. Someone sat down and chose this.
Flock’s older terms said plainly that it would not sell customer data. In a run of edits leading into a February 2026 version, that line disappeared. [ACLU] Flock says it was cut for redundancy and that it doesn’t and can’t sell the data. [Flock Safety] Fine, judge the effect instead of the intent. The current terms hand the customer “ownership” and, in the next breath, hand Flock a “limited, non-exclusive, royalty-free, irrevocable, perpetual, worldwide license” to use and disclose that data, with Flock keeping “the exclusive right to determine and control the method, timing, format, and medium” of how the customer reaches their own records. [Flock T&C, Feb 2026] You own it. They decide when and how you’re allowed to touch it, and their license outlives the contract. Your name is on the title; they hold the only key. [Footnote4a]
On top of that, the privacy policy keeps the standard right to disclose personal information on a good-faith belief that it’s needed to comply with legal process. [Flock Privacy Policy] Half the internet’s privacy policies say that. It’s still a door, and the person the camera photographed never signed any of it.
Here’s what I keep coming back to. Trace where the value goes, then trace where the risk goes, and they don’t land on the same people.
Flock builds and sells the network. The city gets the closed cases and the good press. Both chose to be there. The driver chose nothing. No contract, no ask, no login to see their own movement history, no way to audit who pulled it, no opt-out short of never driving past a pole they couldn’t pick out of a lineup. Their whole pattern of life, where they sleep, pray, get treatment, show up to protest, sits in a system they have no relationship with. Audit-log projects have already counted north of 180 million Flock searches across millions of plates. [Yahoo Tech]
And when it spills, through a flipped setting, a crawled link, a query run for an agency the city never approved, the driver eats all of it. Here’s the part that should stop you cold: there is no fixing it. A credit card breach gets you a new card and an apology. Location data doesn’t work that way. Once a record of where you were, and when, is sitting on the open internet or logged in some federal system, it is there. You cannot recall it. You cannot un-see it into existence. “Sorry” buys back nothing, because nothing that was taken can be returned. The harm is permanent by the nature of the thing, and everyone in this system knew that going in.
And the driver never agreed to carry that risk. This is the part that ought to be said plainly and isn’t. The person photographed did not consent. They signed nothing. The municipality signed for them. A city council clicked accept on terms it did not read and traded away the location privacy of every person who would ever drive down that road, none of whom were asked, none of whom could have refused. That is not a bystander unlucky enough to get caught in a leak. That is a party with no standing signing away a right that was never theirs to sign.
I’m not telling you plate readers are evil. That’s lazy and it’s wrong, and reasonable people land in different places on the tradeoff. The useful part isn’t about cameras at all.
Any system holding your data that you don’t run can burn you without ever being “breached” the way you picture it. The setting you think is off is on. The default you never checked doesn’t mean what you assumed. The contract you didn’t read gave away something you’d have fought over. The access you believe stops at one agency quietly reaches fifty.
So quit asking whether a thing has been hacked yet. Ask who can already reach your data through a front door that’s standing open on purpose, and whether you’d have said yes if anyone had asked.
Nobody asked.
Sources
Tech Times, “Flock Safety Crosses 100,000 Cameras as 53 Cities Cancel,” June 2026
KQED, “San Francisco Police Audit Shows Feds ‘Improperly’ Accessed License Plate Data,” 2026
NPR, “Why some cities are canceling Flock license plate reader contracts,” Feb 2026
Rain Intelligence, “The Billion-Dollar Surveillance Wave,” May 2026
Yahoo Tech / 404 Media, “Police License Plate Searches Leak Into Public Search Results,” June 2026
ACLU, “Municipalities: Beware of Changes in Flock’s Legal Terms,” April 2026
ACLU of Massachusetts, “Flock Gives Law Enforcement All Over the Country Access to Your Location,” Oct 2025
Flock Safety, Terms & Conditions (Feb 16, 2026) and Privacy Policy (Aug 1, 2025)
Flock Safety, “Terms & Conditions Update,” Feb 2026 (company response)
Footnote4a, “The Deal has been Altered Further,” Feb 2026