Bipartisan Backlash to ALPRs Grows as Two High-Profile Bills Are Introduced

Congress Moves on Two Fronts to Rein In License Plate Surveillance

A bipartisan backlash against automated license plate reader (ALPR) networks reached Congress this week, with lawmakers from opposite ends of the political spectrum introducing competing bills within days of each other. Republican Sen. Josh Hawley (R-MO) unveiled the Stop Flock Abuse Act on September 30, 2026, proposing new guardrails — retention limits, audit logs, a facial-recognition ban — on how police agencies and vendors handle ALPR data. Two days later, on October 2, 2026, independent Sen. Bernie Sanders (I-VT), Democratic Sen. Jeff Merkley (D-OR), and Rep. Alexandria Ocasio-Cortez (D-NY) introduced the far more sweeping Ban Flock Act, which would prohibit the federal government from using ALPRs at all and threaten federal funding for states and cities that keep deploying them. Both bills name-check Flock Safety, the dominant ALPR vendor, whose cameras — and the law-enforcement data-sharing practices built around them — have drawn mounting scrutiny over access by U.S. Immigration and Customs Enforcement (ICE), wrongful arrests, and officer misuse.

Details

The Hawley Bill: Stop Flock Abuse Act

Hawley's bill follows a Senate Judiciary Subcommittee on Crime and Counterterrorism hearing he chaired, where he invited the CEOs of Flock, Axon Enterprise, Motorola Solutions, and Verkada to testify — none appeared. In his release, Hawley said the goal was to "establish basic safeguards for AI-powered cameras to ensure these nationwide surveillance networks protect Americans' constitutional rights," adding that what makes these networks concerning "is not just the sheer number of cameras; it's the fact that they're all linked together, empowered and searchable by AI."

The bill would require local agencies to permanently delete captured driver data after 10 days unless it is tied to an active criminal investigation — down from the roughly 30-day retention window many agencies currently use. It would bar agencies and vendors from selling or sharing vehicle-location data with nongovernmental third parties, shield driver data from public-records requests, and require written preapproval plus supervisor audit logs for every database search, intended to flag red flags such as repeat searches of the same person. It would also prohibit ALPR networks from incorporating facial recognition and bar hardware or software sourced from foreign adversaries.

Notably, despite witness testimony at Hawley's own hearing recommending that Congress require a probable-cause warrant before searching ALPR data for evidence of a crime, the bill as described does not include a warrant requirement — a gap privacy advocates have flagged as a significant limitation.

The Ban Flock Act: Sanders, Merkley & Ocasio-Cortez

The Democratic-led bill takes a categorically different approach: an outright ban rather than a regulatory framework. Introduced in the House by Ocasio-Cortez with a companion Senate version from Sanders and Merkley, the Ban Flock Act would bar the head of any federal agency, federal official, or anyone acting on the federal government's behalf from acquiring, possessing, accessing, or using an ALPR or any "captured plate data" in the United States — with narrow exceptions for toll collection and for uses Congress explicitly authorizes in future legislation, capped at a 48-hour retention limit.

Its second lever targets state and local governments indirectly: funding from the Department of Justice, Department of Transportation, HHS, HUD, and DHS would stop flowing to any jurisdiction that doesn't adopt a law or binding policy prohibiting ALPR use by its own agencies and contractors "to the same or greater extent" as the federal ban. The bill also creates a private right of action against the federal government for violations — allowing individuals to sue for actual and punitive damages plus attorneys' fees — and lets state attorneys general bring suit on residents' behalf. Despite the bill's name, the text doesn't single out Flock Safety; it applies to any ALPR system. Sanders framed the stakes bluntly: "Flock is always watching. We cannot allow America to become a surveillance state where a handful of AI oligarchs profit by giving the government the power to track our every movement."

Why ALPRs Are Controversial

Flock Safety has grown into the dominant player in the space, with the company claiming roughly 120,000 cameras deployed nationwide — though one independent researcher has documented closer to 300,000 Flock devices in the field. That scale, combined with the company's searchable, networked database, has produced a string of controversies:

• ICE and federal access: Audits reviewed by journalists and civil-liberties groups found Denver police conducted more than 1,400 ALPR searches on behalf of ICE since June 2024, and plaintiffs in California lawsuits allege San Francisco's cameras were accessed by federal agencies more than 1.6 million times. In Boston, a city report found that within three days of a 2025 pilot, Flock data was accessible to outside agencies despite the contract specifying that sharing was switched off — Flock maintains it has no direct contract with ICE even though the agency has reportedly queried the data.
• Marin County: The EFF and ACLU sued Marin County's sheriff, alleging continued illegal sharing of drivers' location data with ICE and Border Patrol despite a prior settlement over the same conduct.
• Wrongful arrest and misuse: A Florida woman, Lindsey Isaacs, spent 13 days in jail after Flock data matched her car's model to a suspect vehicle. Five Indianapolis police officers were arrested for running unauthorized ALPR searches to track personal contacts, and a Washington Post investigation found officers elsewhere had used the cameras to track romantic partners.
• Undisclosed deployments and accuracy: Flock installed 14 unpermitted cameras in St. Lucie County, Florida, and the ACLU has noted that fewer than 1% of vehicles scanned by ALPRs are tied to any crime, while roughly 1 in 10 plate reads misidentify the state of origin.

Flock's chief legal officer, Dan Haley, has pushed back, arguing Americans' privacy "should not depend on one vendor's good judgment, leadership or commercial incentives" — an implicit acknowledgment that oversight has so far rested largely on the company's own policies. At the state level, Missouri Gov. Mike Kehoe signed an executive order this year directing the state's Department of Public Safety to issue best-practice guidelines for ALPR use, one of several state-level moves running in parallel with the federal debate.

Impact Assessment

Recommendations

For State and Local Agencies Operating ALPRs

• Audit actual outbound data-sharing logs rather than trusting vendor dashboard settings — Boston's case showed a contractually "disabled" sharing setting did not match real-world access.
• Adopt short retention windows and require a documented, case-linked justification (and ideally a warrant) for every database search, independent of whether federal legislation passes.
• Publish regular transparency reports listing which outside agencies — including federal immigration authorities — have queried local ALPR data.

For Security and Privacy Teams Advising Public-Sector Clients

• Treat ALPR data feeds as sensitive PII repositories requiring the same access controls, logging, and breach-notification planning as any other law-enforcement database.
• Review data-sharing agreements with ALPR vendors for CJIS-style controls and explicit, auditable restrictions on third-party and inter-agency access.
• Model the compliance impact of both pending bills now — a regulate-and-audit outcome and an outright-ban outcome require very different technical controls.

For Residents and Civil Liberties Advocates

• File public-records requests for local ALPR contracts, audit logs, and lists of agencies with data-sharing access.
• Track municipal ALPR contract renewal dates and raise concerns with city councils before renewals are approved.
• Follow organized efforts such as the ACLU's "Get the Flock Out" campaign for jurisdiction-specific advocacy resources.

Key Takeaways

1. Sen. Josh Hawley's Stop Flock Abuse Act would regulate ALPR data handling — shorter retention, audit logs, no facial recognition — but notably does not include a warrant requirement for searches.
2. The Sanders-Merkley-AOC Ban Flock Act takes the opposite approach: an outright ban on federal ALPR use, with federal funding to states and cities conditioned on matching local bans.
3. Both bills followed a Senate Judiciary Subcommittee hearing, "Always Watching: Flock's Nationwide AI Surveillance Network," where invited vendor CEOs did not appear.
4. Audits in Denver, Boston, San Francisco, and Marin County have documented ICE and Border Patrol access to local ALPR data, often despite assurances that sharing was disabled.
5. Flock Safety is the central target, but the legislation's scope — and documented misuse incidents — also implicate Axon, Motorola Solutions, and Verkada.
6. A third related bill, Rep. Thomas Massie's Flock-Off Act, underscores that congressional momentum against ALPR surveillance now spans further than just these two proposals, even though a floor vote this session remains uncertain.

Sources

• Bipartisan backlash to ALPRs grows as two high-profile bills are introduced — The Record
• Sanders introduces bill to ban the federal government from using Flock — TechCrunch
• Group of progressive lawmakers unveil bill to ban federal automatic license plate readers — The Hill