Flock Safety Mandates New Search Rules on 30-Day Stored Camera Data

For cybersecurity and data protection professionals, Flock Safety's announcement raises a classic data governance problem: a nationwide network of ALPR cameras stores 30 days of location metadata, and the controls over who can query that data—and by what authorization—remain unclear. The Sullivan County backlash is a signal that exposure of personal mobility patterns is being evaluated as a systemic surveillance risk, not just a law enforcement tool.

On August 13, 2026, Flock Safety announced a set of changes to its surveillance technology policies—described in syndicated reporting as including new search mandates—after weeks of mounting privacy concerns in Sullivan County, Tennessee. The announcement arrived as the Sullivan County Commission prepared to discuss a resolution that would publicly commit the county not to renew its technology contracts with Flock until privacy concerns are addressed. The local dispute is significant because it shows how budget and procurement authority are being used as levers to force private surveillance vendors to accept stronger data governance terms, even in the absence of new state or federal privacy legislation.

“

Mayor-elect Zane Vanover said he and many residents trust the Sullivan County Sheriff's Office to use the technology appropriately, but he worried about the data falling into the wrong hands.

The immediate conflict centers on Sullivan County, where several law enforcement agencies in the Tri-Cities operate cameras on Flock's automated license plate recognition system. Mayor-elect Zane Vanover said he and many residents trust the Sullivan County Sheriff's Office to use the technology appropriately, but he worried about the data falling into the wrong hands. He specifically warned against someone building a dossier on a person based simply on where they shop or their daily activities. That framing matters: the concern is not only about law enforcement overreach, but about the aggregation of routine mobility data into a surveillance profile that could be misused later.

Sheriff Jeff Cassidy defended the program, saying the sheriff's office has used the technology to locate suspects and victims and enhance public safety. He stated that policies and guardrails are already in place to ensure lawful and appropriate use, and he emphasized that the system retains data for only 30 days. Cassidy also noted that the decision to fund or not fund the technology rests with county commissioners, effectively leaving the final call to elected officials rather than the sheriff's office.

Flock Safety's public position is that the company does not own or sell the data collected by its cameras, that data is stored for 30 days, and that local departments have control over the photos and videos in their systems. Those assurances, however, have not fully satisfied critics. The announced changes—including search mandates that the reporting indicates were made in response to public backlash—suggest the company recognizes a need to demonstrate stronger access controls. But the full scope of the new mandates remains unclear because the syndicated reports covering the announcement were truncated before enumerating all of the changes. That absence of detail is itself part of the accountability problem: local officials and residents are being asked to accept policy modifications without yet having a clear technical or contractual specification of how searches are governed, logged, or audited.

The broader context is the rapid expansion of automated license plate recognition networks nationwide. These systems capture time-stamped vehicle locations that can reveal sensitive patterns about work, worship, medical visits, and personal associations. A 30-day retention window may sound limited, but if query access is broad, poorly logged, or not subject to independent audit, retention limits alone do little to prevent misuse. From a data governance perspective, the critical questions are who can search, under what authorization, with what documentation, and whether those searches are subject to regular review.

For legal and regulatory observers, Sullivan County is a live case study in procurement-driven privacy reform. A nonrenewal resolution would not create a new privacy law, but it would impose contract conditions rooted in public accountability. If the county follows through, other municipalities facing similar citizen pressure may adopt comparable language, creating a patchwork of local surveillance-vendor requirements. That patchwork could, in turn, push vendors like Flock Safety to standardize stronger privacy controls across all contracts rather than negotiate municipality by municipality.