ACLU Claims Massive Privacy Threat in Police Cameras

Last week, the American Civil Liberties Union (ACLU) wrote to the chief executive of each municipality in the state (See copy below), explaining the 'loopholes' that allow camera vendors such as Flock to widely share surveillance information gathered locally, regardless of local policies. Both Franklin and Medway have Flock cameras. Neither town's administration has yet responded to a request for comment on the ACLU letter.

Dear Municipal Leader,

If your police department uses Flock Safety’s license plate reader technology, sensitive data about your residents may be automatically shared with thousands of law enforcement agencies nationwide, including those involved in civil immigration enforcement and in states that ban abortion. Moreover, this data sharing undermines the effectiveness of the Massachusetts Shield Law and potentially violates its protections.

If your police department uses Flock or a similar license plate reader (LPR) provider, we urge you to take immediate action to: (1) disable any nationwide data sharing features, and (2) amend contract language that may give the company the legal right to share your jurisdiction's data.1

We strongly recommend you take the following steps within the next 30 days:

1. Inquire with your police department to determine if they use Flock Safety or other LPR

technology.

2. Request documentation from your police department showing current Flock or other LPR

system settings and complete contract terms.

3. If they do use Flock or another LPR provider, immediately instruct them to:

a. Disable all automated data sharing with agencies outside Massachusetts, and

b. Review and amend any contract language to ensure it does not give the LPR company

rights to share your municipality's data.

4. If external data sharing cannot be prevented, end your LPR contract and remove the

cameras from your community.

If your local government has not contracted with Flock or another LPR provider, we urge you to work with your police department to exercise extreme caution if approached by representatives from the LPR industry.

What is Flock Safety?

Flock sells license plate readers and database software to police departments, federal agencies, and private corporations across the country. These cameras collect data indicating who is driving, where, and when—for every car that passes, not merely cars associated with suspected criminal activity. Flock stores this information in a proprietary database.

1 Note that Flock Safety is not the only company that offers police a nationwide license plate reader database. Vigilant Solutions, owned by Motorola, offers a similar system. The concerns outlined in this letter apply to all LPR systems.

Data Sharing Options

Police departments that contract with Flock can choose from several data sharing settings, including:

• No sharing outside the department

• Sharing only with specific, named police departments

• Sharing only with Massachusetts police departments

• Sharing with all government customers nationwide

The Contract Language Problem

Even when departments select restrictive administrative settings, there’s an additional concern. According to documents obtained by the ACLU through public records requests, Flock's standard contracts with Massachusetts police departments include language giving the company “a nonexclusive, worldwide, perpetual, royalty-free right and license [to] disclose the Agency Data (both inclusive of any Footage) to enable law enforcement monitoring against law enforcement hotlists as well as provide Footage search access to law enforcement for investigative purposes only.”

This contract language may supersede your police department’s selection of restrictive settings, meaning departments must amend their contracts with Flock to ensure their data is truly protected.

The Scope of the Problem

Public records recently obtained by the ACLU reveal that Flock Safety’s nationwide information sharing network allows external federal, state, and local law enforcement to access sensitive license plate data from dozens of Massachusetts cities and towns without a warrant or meaningful oversight.

According to these records, police departments in Massachusetts are currently sharing data with thousands of departments nationwide. Records show that police in states like Florida and Texas have searched license plate reader data through the Flock nationwide database, including for explicit immigration enforcement purposes and at least one abortion-related investigation.2 Police departments have also searched the nationwide database on behalf of the FBI, DHS, and Border Patrol.

Put simply: if your local police are sharing data with Flock's national database, police from thousands of outside jurisdictions can track Massachusetts residents—including immigrants, people seeking

[FOOTNOTE: 2 Jason Koebler and Joseph Cox, Had an Abortion for Her 'Safety.' Court Records Show They Considered Charging Her With a Crime, 404 Media (Oct. 7, 2025), https://www.404media.co/police-said-they-surveilled-woman-whohad-an-abo…; Dave Maass and Rindala Alajaji, Flock Safety and Texas Sheriff Claimed License Plate Search Was for a Missing Person. It Was an Abortion Investigation, Electronic Frontier Foundation (Oct. 7, 2025), https://www.eff.org/deeplinks/2025/10/flocksafety-and-texas-sheriff-cla….]

reproductive or gender-affirming care, elected officials, and other targets of the federal government—as they drive through our communities.

Even worse, according to Senator Ron Wyden and Rep. Raja Krishnamoorthi, Flock’s failure to require customers to use industry standard security measures to protect their accounts has led to serious cybersecurity breaches of Flock’s data. In a letter calling on the FTC to investigate the company, the members of Congress pointed to at least 35 cases in which Flock passwords had been stolen, and evidence “from a Russian-language cybercrime forum in which Flock accounts appear to be offered for sale.”3

Massachusetts Shield Law

The Massachusetts Shield Law was designed to help protect people from other states’ laws that criminalize abortion and restrict access to gender-affirming care, ensuring that people who receive and provide protected healthcare that is lawful in Massachusetts can do so without fear of retribution from out-of-state actors.

The law is clear: officers and employees of Massachusetts law enforcement agencies may not “provide information or assistance to any federal law enforcement agency or any other state’s law enforcement agency...in relation to an investigation or inquiry” into reproductive healthcare or gender-affirming healthcare that is lawful in the Commonwealth. See Section 63(b) of Chapter 147.

Why Flock's System Undermines Shield Law Compliance

Flock Network Audits shared by Massachusetts police departments make clear that the nature of Flock's nationwide database system threatens the very purpose of the Shield Law. Flock's system automates data sharing and does not require individualized reviews of investigations or search queries of Massachusetts-collected data.

Records obtained by journalists confirm that in at least one case, police in Texas searched Flock’s database to try to track down a woman they suspected of self-managing an abortion.4 Among the records searched in that case was data from Massachusetts. As this incident demonstrates, Massachusetts police department participation in nationwide LPR data sharing operations could inadvertently share the very information the Shield Law was intended to protect.

[FOOTNOTE 3 Letter from Senator Ron Wyden and Representative Raja Krishnamoorthi, to Federal Trade Commission Chair Andrew N. Ferguson (Nov. 3, 2025), https://www.documentcloud.org/documents/26212269-wyden-flock-ftc-letter/.

4 Jason Koebler and Joseph Cox, Police Said They Surveilled Woman Who Had an Abortion for Her 'Safety.' Court Records Show They Considered Charging Her With a Crime, 404 Media (Oct. 7, 2025), https://www.404media.co/police-said-they-surveilled-woman-who-had-an-ab….]

Flock Data and Mass Deportations

The Shield Law is not the only reason to stop sharing data with Flock’s nationwide system. By sharing LPR data with a nationwide network of police departments and federal agencies, Massachusetts law enforcement also risks inadvertently providing information to out-of-state police that could contribute to serious human and civil rights violations.

The Florida Highway Patrol Example

The Florida Highway Patrol has been deputized to perform federal immigration enforcement and frequently queries the Flock national database. According to records obtained by the ACLU of Massachusetts, the Florida Highway Patrol searched the Flock nationwide database over 12,000 times from the start of 2025 through the end of July, including for explicitly stated immigration related reasons.

Because Florida law requires police to engage in civil immigration enforcement, Communities that seek to protect their immigrant neighbors from the Trump administration’s campaign of mass deportations should decline to participate in Flock's or any other LPR company’s nationwide data sharing operation.

What Success Looks Like

Protecting both your residents’ civil rights and civil liberties and the fundamental purposes of Massachusetts law requires only two straightforward actions:

1. Disable automated data sharing with entities outside Massachusetts through Flock's or

other LPR provider administrative settings.

[FOOTNOTES:  3 Letter from Senator Ron Wyden and Representative Raja Krishnamoorthi, to Federal Trade Commission Chair Andrew N. Ferguson (Nov. 3, 2025), https://www.documentcloud.org/documents/26212269-wyden-flock-ftc-letter/.

4 Jason Koebler and Joseph Cox, Police Said They Surveilled Woman Who Had an Abortion for Her 'Safety.' Court Records Show They Considered Charging Her With a Crime, 404 Media (Oct. 7, 2025), https://www.404media.co/police-said-they-surveilled-woman-who-had-an-ab….

5 Nancy Guan, Local law officers must cooperate with ICE. What that may mean for the public, WUSF Public Media (Feb. 12, 2025), https://www.wusf.org/politics-issues/2025-02-12/local-officers-must-coo….

6 Gisela Salomon and Kate Payne, Detained immigrants at 'Alligator Alcatraz' say there are worms in food and wastewater on the floor, Associated Press (Jul. 11, 2025), https://apnews.com/article/alligator-alcatraz-immigrationdetainees-flor….

7 Nermeen Shaikh, Shirsho Dasgupta, and Thomas Kennedy, Where Are the Detainees? Hundreds of 'Alligator Alcatraz' Prisoners Disappear from ICE Database, Democracy Now (Sept. 25, 2025), https://www.democracynow.org/2025/9/25/alligator_alcatraz.]

2. Amend contract language that may give Flock or another LPR company the legal right to

share your residents' data with law enforcement outside the Commonwealth.8

These are the only ways to ensure information collected by your police department’s technology will not be misused by another agency or used in contravention of the protections of the Shield Law. Ending nationwide data sharing also reduces the likelihood that information collected by your police department will be used for civil immigration enforcement or other unintended purposes.9

If your police department claims they are not sharing data nationwide, we recommend requesting documentation showing their current LPR database settings and complete contract terms to verify compliance with the above principles.10

If external sharing of license plate reader data cannot be prevented through both restrictive system settings and clear contract language limiting external data sharing, your municipality should end its contract with Flock Safety or other LPR providers.

ACLU Support Available

ACLU of Massachusetts staff are available to meet with you and your police chief to review your current Flock or other LPR settings and contract language. We can provide technical assistance to protect civil rights and civil liberties while addressing public safety concerns.

We request a response within 30 days regarding the steps your municipality is taking to address this issue.

Thank you for your public service and your dedication to the people of Massachusetts.

Sincerely,

Kade Crockford, Director, Technology and Justice Programs, ACLU of Massachusetts

Gideon Epstein, Policy Counsel, Technology for Liberty Program, ACLU of Massachusetts

[FOOTNOTE: 8 For more information about contract language, please visit: https://data.aclum.org/2025/10/07/flock-gives-lawenforcement-all-over-t…

9 The same concerns apply to police department use of other LPR technology, including systems provided by Vigilant Solutions, a Motorola subsidiary.

10 Note that disabling nationwide automatic sharing does not prevent cooperation on specific investigations. Your department can still choose to share data with named departments or agencies when appropriate. The key difference is that this sharing would be deliberate and reviewable rather than automatic and unmonitor]