Pa. lawmakers propose guardrails on automatic license plate cameras as backlash grows

As Pennsylvania lawmakers proposed measures to better regulate the use of automatic license plate readers (ALPRs) and the data they gather, a major purveyor of the technology announced last Thursday it would tighten the optional controls on how police use its system.

Flock Safety said it would shorten the default period its system stores information about vehicles and their whereabouts from 30 days to seven days, although police departments that use it could opt to keep the longer data retention period.

The announcement came amid mounting public pushback against the tech's broad deployment across the country following reports of law enforcement officers misusing it.

Earlier this month, the Washington Post reported that at least 50 law enforcement officers nationwide have been charged or accused of misusing Flock and similar systems to spy on their spouses or intimate partners, exes and their exes' new partners, the Post reported.

The Post story included an account of a mother from Leechburg, Armstrong County, who said she repeatedly warned police and the district attorney's office that her police officer husband had used a competitor to Flock to stalk and threaten her. The officer, Michael McSherry, ultimately pleaded guilty to official oppression and served about 11 months in jail, according to the article.

"There is a clear misuse of this technology from some of the people who should be the guardians of it," said Rep. Tarik Khan (D-Philadelphia), who published a memorandum Tuesday seeking cosponsors on legislation he plans to introduce to create penalties for misusing ALPR data.

Flock's ALPRs, otherwise known as Flock cameras, automatically capture images of passing vehicles and upload them to a database police can search. Law enforcement uses the data to help locate vehicles that may be linked to crimes, missing people or other police matters.

Among other changes aimed at protecting privacy, improving accountability and keeping data secure, the Atlanta-based company also highlighted software features introduced earlier this year that it said automatically detects abnormal activity and flags it for review. Users will be required to use this feature going forward, it said.

It also noted new functionality in its software that allows departments to filter what kinds of reasons are permissible for other agencies to access cameras. A department could allow other departments to search its cameras for stolen vehicles but not for immigration enforcement, for example.

In a news release, the nine-year-old company said it believed its prior default data storage settings "struck a careful balance between safety and privacy." It added the changes would allow cities to keep their "current, democratically approved" retention period that fits its public safety strategy.

"Abuse of Flock technology, at any level, is unacceptable," CEO Garrett Langley said in the news release, which said the company will now require users to enter a criminal case number for every search. Flock did not respond to questions from the Capital-Star.

Langley told the Washington Post that the company had not tightened controls itself because executives believed local officials would implement them.

"I had this hope that local lawmakers at the state and local level would move very quickly and they'd look at the things that we're recommending as optional and say, 'Great, we're going to force it.' And they haven't," he told the post. "Instead of waiting, we said, 'Look, we should just move faster.'"

Chad Marlow, a privacy expert at the American Civil Liberties Union, said Flock has a history of responding to privacy concerns as what he calls "public relations nuisances."

"It's more window dressing than anything else," Marlow said, noting that unless a jurisdiction has a law mandating Flock data be deleted after a certain time, police departments can keep it as long as they want. And other features the company touted, such as the system to detect misuse, have never been evaluated independently.

"So saying they're rolling it out everywhere when we don't even know how well it works. To me, that's not much of a privacy win," Marlow said.

The devices, which Flock provides under contract to police agencies and businesses, have become the targets of a national effort to dissuade local officials from adopting them. Critics say the indiscriminate collection of data on peoples' movements violates the constitution and is tantamount to mass surveillance.

In some cases, the cameras have also been vandalized or removed.

Proposals to set limits in Pennsylvania

A bipartisan group of Pennsylvania state representatives announced this week they would soon introduce legislation that would, among other things, create civil causes of actions for individuals or prosecutors to sue over misuse of the information.

Seventeen other states have laws that regulate the use of the cameras, according to the National Conference of State Legislatures. They range from limits on how long police can keep data, such as California's law requiring it to be deleted after 60 days unless it is evidence in a felony case, to Vermont's, which requires officers to be certified to use an ALPR system.

Khan's proposal, which already has bipartisan support, would give private individuals the right to sue and authorize the state attorney general and county district attorneys to investigate violations and bring civil enforcement actions. Among seven co-sponsors is Rep. Robert Leadbeter (R-Columbia).

It would also require clear rules for who may access such information, documented reasons for searches, audit trails, data retention standards and transparency measures, the memo says.

Rep. Nathan Davidson (D-Dauphin) is a co-sponsor of Khan's bill and introduced legislation that would prohibit law enforcement from sharing ALPR information with federal agencies or police in other states for purposes of tracking people who may travel to other states to obtain abortion care or other health care.

It stems, Davidson said, from a report in May 2025 that authorities in Texas had used a network of ALPRs to search for a woman who had a self-administered abortion, which is banned in Texas.

"I crafted a bill to prohibit the sharing of that data in the health care space, and it's not just abortion care. It could also be vaccines," he said. "I would not want them to be requesting license plate reader data that we have been using in law enforcement in Pennsylvania for those purposes in other states."

A constituent's concern about ALPR cameras in Rep. Jen O'Mara's (D-Delaware) district prompted her to learn more about the issues involved with Flock and similar systems, she said. She has proposed a bill that would limit how government agencies can use ALPRs, what the data can be used for and require that the data be erased in a timely manner.

"What we're saying is that they can be used for legitimate law enforcement purposes, conducting criminal investigations, ensuring compliance with federal, state, and local laws enforcing state and local parking laws and controlling access to secured areas, and it's only allowed to be used by government and law enforcement," O'Mara said.

The legislation would also prevent ALPR camera and software providers from selling the data their systems collect.

"One of the components of my bill is that the manufacturer doesn't own the data, so they can't take the license plate information and use it on their own," O'Mara said.

Davidson's bill was referred to the House Judiciary Committee in January and awaits consideration. With the legislative session winding down at the end of this year, Davidson said his and Khan's bills are unlikely to get to Gov. Josh Shapiro's desk to become law.

"I think it's about teeing up the ball and the conversation for next session," he said.

O'Mara said lawmakers can still prepare to advance the bills quickly next session by gathering feedback from constituents and stakeholders, planning hearings and lining up committee votes.

"This may be the kind of thing that if we do all the legwork now ... that we're ready to go come January when we're in a new session," she said.

How do police departments in Pa. use the system?

The Capital-Star filed Right-to-Know requests for Flock system data from six Pennsylvania police departments earlier this year. Only one, the New Castle Police Department in Lawrence County, granted the requests for audit logs, while others are still pending or were denied.

Allentown and Bethlehem each denied the requests, citing an exception in the state Right to Know Law for records related to criminal investigations. Allentown also cited the Criminal History Records and Information Act (CHIRA), which limits access to records created as part of a criminal investigation.

Marlow, of the ACLU, said license plate reader data and the audit logs are not investigative materials.

"They capture data on every single car that goes by without any suspicion that any of those cars are involved in a crime," he said. "So maybe you could say that it's pre-crime investigation, which isn't really even a thing except in that 'Minority Report' movie, right?"

Flock's software automatically creates logs of internal and external searches for each police department's ALPR database. Those records show the date, time, user, reason for the search, associated criminal case numbers and license plate numbers searched, among other pieces of information.

Departments may opt to share information with other agencies across the country. New Castle's external search logs for 36 months from January 2024 through June 2026 contained more than 11 million records of searches of its database from other departments around the country. New Castle police users, in comparison, ran just over 10,000 searches in the same period.

An analysis of the data using an artificial intelligence agent showed a majority of searches, more than four out of five, did not list a case number. Nearly one out of five had vague or non-descriptive reasons such as "sus", "atl", or "cj." It also showed nearly 36,000 searches labeled "test" run on Flock's live national database.

The data also showed other police departments and agencies had listed "immigration" or "ICE" as the reason for thousands of searches of New Castle's database. Flock doesn't have a business relationship with U.S. Immigration and Customs Enforcement or other federal agencies, and sharing with federal agencies is disabled by default, Flock says on its website. Individual police departments may opt to share with federal agencies.

New Castle police Chief David Cumo did not respond to an email with questions about his department's use of Flock cameras, of which the city has two. The city's internal audit log showed some officers ran dozens of searches for the same license plate numbers over periods of hours, but listed consistent and specific reasons.

------

Pennsylvania Capital-Star is part of States Newsroom, a network of news bureaus supported by grants and a coalition of donors as a 501c(3) public charity. Pennsylvania Capital-Star maintains editorial independence. Contact Editor Tim Lambert for questions: info@penncapital-star.com. Follow Pennsylvania Capital-Star on Facebook and Twitter.