An automated license plate reader in Watsonville identifies cars and feeds the information to a statewide database which has been accessed by federal agencies for immigration enforcement. (Amaya Edwards — Santa Cruz Local/CatchLight Local)

License plate data has been searched under vague justifications, making it hard to track if the searches are illegal, and it remains unclear if California’s sanctuary laws apply to a company headquartered in Georgia. Privacy experts also worry about a lack of audits and transparency — who within Flock has access to the data, and whether Amazon Web Services, Flock’s cloud provider, could also access it.

Now, a bill is moving through the state legislature aimed at closing these loopholes and adding more oversight. At the local level, a new group called Get the Flock Out is calling for the three cities with Flock cameras to pause their contracts. Members of the group plan to speak out against the contract at Tuesday’s Watsonville City Council meeting.  

Loopholes in the law

A 2015 California law bars state police from sharing license plate data with out-of-state agencies, and a 2018 law forbids the sharing of information with federal immigration authorities. However, some agencies have not complied with the law.

License plate data collected in California cities, including in Santa Cruz County, are fed into a statewide database that all law enforcement agencies in the state that contract with Flock have access to.

Several Southern California law enforcement agencies illegally searched the Flock database on behalf of the Department of Homeland Security and U.S. Customs and Border Protection, CalMatters reported in June. 

California Highway Patrol used the Oakland Police Department’s Flock data in April for a search labeled “ICE case,” which the agency told the San Francisco Standard it is investigating.

“Between January and March of 2025, data gathered by California law enforcement agencies was improperly made available to law enforcement agencies outside of California,” Santa Cruz police spokesperson Katie Lee wrote in an email. “The SCPD continues to monitor the situation with Flock to make sure that these types of occurrences do not happen again.”

A representative from the Watsonville Police Department said in an email on Sept. 3 that they understand the concern about data handling, but cannot “speculate or comment about possible legal loopholes.” Watsonville City Council members did not respond to requests for comment.

Several Flock cameras identify cars near a Home Depot on Green Valley Road in Watsonville. (Amaya Edwards — Santa Cruz Local/CatchLight Local)

A local criminal justice expert said she is uneasy about the cameras.

Ginger Charles, a retired police sergeant of 27 years who serves as the chair of Cabrillo College’s Criminal Justice Department, said license plate readers can be effective policing tools, but raise concerns about data security.

“There should be some kind of guardrail or policies that coexist [concerning] whoever can get into that database,” Charles said. “I don’t know how comfortable I am with a private company having all of that information.”

Charles speculated that state law enforcement agencies might be reluctant to speak out against the misuse of their data due to the current presidential administration’s stance on immigration.

Transparency concerns

Ram Sundara Raman, an assistant professor of computer science and engineering at UC Santa Cruz, said there is a troubling lack of transparency and oversight in Flock’s data practices. Because the company is private and lacks third-party audits, he said, the public can’t verify how data is handled — raising concerns about encryption, AI training, internal oversight and potential for leaks or unauthorized sharing to outside agencies.

Sundara Raman also noted Amazon, which stores the data, can share it with law enforcement if it chooses to. There’s currently no way to know whether Amazon is accessing the data or sharing it with out-of-state agencies, he said.

Sundara Raman and PhD candidate Sabrina Reis compared Flock’s database to the popular Ring home surveillance cameras, which have also been a point of contention for privacy advocates. In Ring’s case, police can request data without user consent directly from the company or through its cloud storage provider — also Amazon — by stating there is a life-threatening emergency. 

He said while Flock claims that the data is secure, they have not allowed independent verification of their claims and the data could be vulnerable to intentional and accidental breaches. “What is the safeguard to ensure that user data cannot be accessed without permission?” he asked.

Flock acknowledges on its website that anytime you store data, it has the potential to be mishandled. But the company says it has built “accountability measures into our system to ensure that if that happens, it is swiftly discovered.”

Flock Safety did not immediately respond to a request for comment.

Opposition and increased regulation

The Santa Cruz-based Get the Flock Out, led by former county supervisor candidate Ami Chen Mills, is pushing to end local Flock contracts.

Proposed bill SB 274 would tighten oversight by limiting Flock staff’s access to data, requiring privacy training and mandating annual audits. It would also require law enforcement to provide a case number when searching the database.

The bill was introduced in February by State Sen. Sabrina Cervantes, D-Riverside, and State Assemblymember Josh Lowenthal, D-Long Beach. 

State Sen. John Laird, D-Santa Cruz, and State Assemblymember Gail Pellerin, D-Santa Cruz, told Santa Cruz Local on Monday they support the bill.

“Any instances of [data] misuse need to be addressed to ensure adequate privacy protections for individuals,” Laird wrote in an email.

Pellerin criticized President Donald Trump’s policies and said they undermine due process. 

“We have an obligation to protect our friends and neighbors — regardless of their immigration or legal status — from having their data shared with other organizations,” Pellerin wrote in an email. “Even if that organization is the federal government, what I am seeing is a complete disregard for the Constitution.”

As state lawmakers denounce data abuse, Sundara Raman and Reis at UCSC will continue to scrutinize Flock’s practices to interrogate whether its systems put privacy at risk. They’ll also look into precedent on comparable systems and best practices in the space.

“There seems to be a lot of discontent in the community,” said Reis. “As scientists with technical expertise, I think that we have an obligation to support people and try to get answers in whatever way we can because we can ask questions that maybe other people wouldn’t know to ask.”

Questions or comments? Email [email protected]. Santa Cruz Local is supported by members, major donors, sponsors and grants for the general support of our newsroom. Our news judgments are made independently and not on the basis of donor support. Learn more about Santa Cruz Local and how we are funded.