Real Safety AI Foundation / Research

Privacy, Surveillance, and Consent

Already Illegal: Flock Safety and the Six Bodies of Existing Law Nobody Is Applying

Publisher: Real Safety AI Foundation

Legal research article.

Written
August 2026
Version
v2
Pages
39
Download PDFPlain language slides (PDF)Export BibTeXExport RIS

Abstract

Automated license plate reader networks are debated as a privacy problem awaiting a privacy statute. That debate has obscured a simpler fact: at least six bodies of existing law already reach the conduct, and none of them is a privacy statute. Antidiscrimination law reaches the procurement decision, because a municipality that closes its own mobility program to a disability-defined class through a facially neutral administrative choice violates Title II and Section 504. State criminal surveillance law reaches the conduct, because observing a person in a private place without the consent of all persons observed is a felony in Georgia and in most states. Consumer protection law reaches the vendor, on a deception theory and on an unfairness theory grounded in documented security failure. Contract and delegated authority reach the access, because a municipality cannot license to a vendor a use that the camera owner was expressly told would not occur. Computer crime law reaches the intruder but, after Van Buren v. United States, not the credentialed insider, and that hole is the one real gap. National security data law reaches the location data itself, because the executive branch has already found by regulation that precise geolocation inside 736 enumerated areas is government-related data regardless of volume. This Article also reports an original empirical result bearing on the last of those. Joining the coordinates the Attorney General published for all 736 areas against 23,946 mapped readers, the author finds readers inside 74 enumerated areas, 504 of them within tightly drawn boundaries, against 11,992 within a ten kilometer approach. The densest is a 2.14 square kilometer rectangle enclosing the Pentagon, which holds eleven readers positioned on the roads in and out. The Article assembles the six bodies, identifies the statute the public reaches for and why it fails, and closes on the substitution the enacted threat model has not performed: what the assembled system does when the tracked vehicle belongs to a sitting legislator and the credentials belong to someone who can be bought.

Keywords

  • automated license plate readers
  • mass surveillance
  • disparate impact
  • methods of administration
  • meaningful access
  • unlawful eavesdropping and surveillance
  • continental geofence
  • subscription surveillance
  • Van Buren v. United States
  • paranoia-spectrum conditions
  • law enforcement insider threat
  • government-related data

Plain language slides

First slide of the plain language summary of Already Illegal: Flock Safety and the Six Bodies of Existing Law Nobody Is ApplyingOpen the 26-slide summary (PDF)

Suggested citation

Gilly, Travis. "Already Illegal: Flock Safety and the Six Bodies of Existing Law Nobody Is Applying." Real Safety AI Foundation Legal Research Article, August 2026. https://realsafetyai.org/research/et22ev/

Other versions

This paper is also posted on SSRN.

SSRN version

References (42)

  1. Alexander v. Choate, 469 U.S. 287 (1985).
  2. Alexander v. Sandoval, 532 U.S. 275 (2001).
  3. American Civil Liberties Union. (2026). Flock Safety credibility lost as it repeatedly lies to city councils, police departments, and public across the country. https://www.aclu.org/news/privacy-technology/tracking-alpr-cameras/flock-safety-credibility-lost-as-it-repeatedly-lies-to-city-councils-police-departments-and-public-across-the-country.
  4. Americans with Disabilities Act of 1990, 42 U.S.C. §§12101–12213.
  5. Barden v. City of Sacramento, 292 F.3d 1073 (9th Cir. 2002).
  6. Bribery concerning programs receiving Federal funds, 18 U.S.C. §666.
  7. Children’s Online Privacy Protection Act, 15 U.S.C. §§6501–6506.
  8. Children’s Online Privacy Protection Rule, 16 C.F.R. pt. 312.
  9. Computer Fraud and Abuse Act, 18 U.S.C. §1030.
  10. Cummings v. Premier Rehab Keller, P.L.L.C., 596 U.S. 212 (2022).
  11. de Montjoye, Y.-A., Hidalgo, C. A., Verleysen, M., & Blondel, V. D. (2013). Unique in the crowd: The privacy bounds of human mobility. Scientific Reports, 3, 1376.
  12. Executive Order No. 14117, 89 Fed. Reg. 15421 (2024).
  13. Federal Trade Commission Act, 15 U.S.C. §45.
  14. Flock Safety. (n.d.). Does Flock share data with ICE? https://www.flocksafety.com/blog/does-flock-share-data-with-ice.
  15. Federal Trade Commission v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015).
  16. Frame v. City of Arlington, 657 F.3d 215 (5th Cir. 2011) (en banc).
  17. Freeman, D. (2016). Persecutory delusions: A cognitive perspective on understanding and treatment. Lancet Psychiatry, 3, 685.
  18. Freeman, D., Bradley, J., Antley, A., Bourke, E., DeWeever, N., Evans, N., …Clark, D. M. (2016). Virtual reality in the treatment of persecutory delusions. British Journal of Psychiatry, 209, 62.
  19. Gaines, J. (2026). Finding 67 Flock Safety live PTZ camera/LPR feeds and debug web interfaces accidentally exposed without authentication to the internet. GainSec. https://gainsec.com/2026/01/09/bird-hunting-season-finding-67-live-camera-feeds-and-debug-web-interfaces-accidentally-exposed-by-flock-safety/.
  20. Gary v. State, 338 Ga. App. 403 (Ga. Ct. App. 2016).
  21. Hunt v. Washington State Apple Advertising Commission, 432 U.S. 333 (1977).
  22. Illinois v. Rodriguez, 497 U.S. 177 (1990).
  23. LabMD, Inc. v. Federal Trade Commission, 894 F.3d 1221 (11th Cir. 2018).
  24. Georgia Code Annotated §§16-11-60 to 16-11-69.
  25. Koebler, J. (2025). Illinois cops gave ICE access to more than 5,000 surveillance cameras nationwide. 404 Media.
  26. Lincoln, T. M., & Peters, E. (2019). A systematic review and discussion of symptom specific cognitive behavioural approaches to delusions and hallucinations. Schizophrenia Research, 203, 66.
  27. Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992).
  28. Payan v. Los Angeles Community College District (Payan I), 11 F.4th 729 (9th Cir. 2021).
  29. Pereira, G., & Raetzsch, C. (2022). From banal surveillance to function creep: Automated license plate recognition (ALPR) in Denmark. Surveillance & Society, 20(3), 265.
  30. Payan v. Los Angeles Community College District (Payan II), 169 F.4th 971 (9th Cir. 2026).
  31. Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, 28 C.F.R. pt. 202.
  32. Rehabilitation Act of 1973, Section 504, 29 U.S.C. §794.
  33. Kemira, Inc. v. Williams Investigative & Security Services, Inc., 215 Ga. App. 194 (Ga. Ct. App. 1994).
  34. Omni Builders Risk, Inc. v. Bennett, 313 Ga. App. 358 (Ga. Ct. App. 2011).
  35. Rutter v. Rutter, 294 Ga. 1 (Ga. 2013).
  36. Snyder v. United States, 603 U.S. 1 (2024).
  37. Schneider, J. (2025). Big Brother left the door open: Flock’s AI surveillance cameras exposed to the internet. PetaPixel.
  38. Somerville v. White, 337 Ga. App. 414 (Ga. Ct. App. 2016).
  39. Stoner v. California, 376 U.S. 483 (1964).
  40. Tennessee v. Lane, 541 U.S. 509 (2004).
  41. University of Washington Center for Human Rights. (2025). Leaving the door wide open: Flock surveillance systems expose Washington data to immigration enforcement. https://jsis.washington.edu/humanrights/2025/10/21/leaving-the-door-wide-open/.
  42. Van Buren v. United States, 593 U.S. 374 (2021).

All research