What Flock Tells the Public vs. What Flock's Contract Says
Flock's public FAQ makes three big promises. Flock's own legal documents (the ones that actually bind) walk each one back. All quotes below are from flocksafety.com as captured August 11, 2026.
| The FAQ says | The legal documents say |
|---|---|
| "Flock will never share or sell data with third parties." "Flock will not share, sell, or access your data." |
The Terms & Conditions take a "limited, non-exclusive, royalty-free, irrevocable, perpetual, worldwide license" to "use and disclose Customer Data" and to "use Customer Data to support and improve Flock's products and services." The LPR Policy separately reserves disclosure "to law enforcement authorities, government officials, and/or third parties" on Flock's own "good faith belief" that it's reasonably necessary. And in practice: Dunwoody, Georgia's own records showed Flock employees viewed that city's camera feeds more than 1,000 times from 2023 into 2026, including a children's gymnastics room camera used as a sales demo. Flock acknowledged the access, disputed that it was improper, and restricted demos only afterward (Dunwoody's council renewed its contract anyway; the point here is what the records showed). (404 Media; IPVM) |
| "Data from Flock Safety devices is stored and then deleted after 30 days." | The perpetual license above has no expiration date. The LPR Policy admits Flock keeps "a fraction of LPR images" "solely for the purpose of improving Flock Services through machine learning." The Evidence Policy allows retention extensions up to a year. The Privacy Policy allows data to transfer to a new owner in a "merger, acquisition, divestiture, restructuring, or sale of assets." And Wylie PD's own Policy 906 mandates sharing with TxDPS, where data is kept under TxDPS's schedule, not Wylie's. |
| "All images and metadata is encrypted throughout its entire lifecycle." | The Terms & Conditions disclaim, in capital letters, any warranty that services will be "UNINTERRUPTED OR ERROR FREE." In the real world: researchers found 60+ Flock cameras exposed with no passwords, and Flock's system leaked live police search queries onto public search engines in 2026. |
The FAQ says Flock will never access your data. The contract takes a perpetual, irrevocable license to use it. Both statements are Flock's own published words. They cannot both be true.
Why this matters for Wylie: when residents were told "the data belongs to the city and deletes in 30 days," that was the FAQ talking. The agreement the City Manager signed incorporates the terms: the version with the perpetual license.
Five Clauses Every Wylie Resident Should Read
1. The forever license
"Customer hereby grants to Flock a limited, non-exclusive, royalty-free, irrevocable, perpetual, worldwide license to (a) use and disclose Customer Data to provide the Flock Services; and (b) use Customer Data to support and improve Flock's products and services." — Terms & Conditions, Data Use and Licensing
Plain English: images of Wylie residents' vehicles can feed Flock's commercial product development forever, including after the contract ends. "Irrevocable" means ending the contract doesn't take it back. The only data never captured is the data never collected.
2. The "good faith belief" back door
"Flock Safety may access, use, preserve and/or disclose the LPR data to law enforcement authorities, government officials, and/or third parties, if legally required to do so or if Flock has a good faith belief that such access, use, preservation or disclosure is reasonably necessary…" — LPR Policy
Plain English: no warrant, no subpoena, no judge required: Flock's own belief is a sufficient standard for handing data to "government officials and/or third parties." Nowhere in any document is there an exclusion for federal immigration enforcement. The silence is the policy.
3. The accuracy disclaimer
"Although infrequent, license plate translation may be incomplete or inaccurate… Users should confirm the computer translation prior to taking any action based on an LPR alert or search." — LPR Policy
Plain English: Flock's lawyers tell officers not to act on alerts without confirming them, while the product's entire pitch is real-time action on alerts. When an officer skips that confirmation, you get Amber Newell handcuffed on I-94 over a stale hit, twice in one week. The marketing says 96% accurate; the contract wing of the company won't warrant any accuracy at all.
4. The liability shield
Flock's total liability is capped at roughly the fees paid in the twelve (12) months before a claim (about $27,000 for Wylie), with consequential damages excluded, disputes governed by Georgia law and routed to private arbitration.
Plain English: Aurora, Colorado paid a family $1.9 million after a false ALPR alert put a 6-year-old face-down on hot pavement. Under these terms, when the system fails, the city carries the constitutional liability. The vendor's exposure is about one year of subscription fees.
5. The data you can't take with you
"Flock retains the exclusive right to determine and control the method, timing, format, and medium" of data access, with no obligation to provide data in any alternative format. — Terms & Conditions
Plain English: the city's "own" data is accessible only how, when, and in whatever format Flock chooses. Want to audit it independently, migrate to another vendor, or hand it to a court in a different format? That's Flock's call.
The Security Standards Flock Demands: From Everyone but Itself
Flock publishes an Information Security Addendum and Data Processing Agreement that its own suppliers must sign. Read what Flock requires of its vendors, next to Flock's own 2026 record:
- Flock requires vendors to report suspected breaches within 72 hours (48 hours for personal-data breaches). Flock itself leaked police search queries onto public search engines and exposed 2.3M+ plates in unredacted logs, with no equivalent notification to the residents whose data was exposed.
- Flock requires vendors to use multi-factor authentication and least-privilege access. Flock's own product has been criticized by lawmakers for not enforcing MFA on police accounts, and researchers found 60+ cameras with no authentication at all.
- Flock requires vendors to meet TLS/AES encryption minimums and hold SOC 2 / ISO 27001 certifications, subject to audits. Flock's cameras ran discontinued 2021 Android software with hundreds of known vulnerabilities.
- Flock requires vendors to destroy Flock's data within 30–60 days of contract termination, with written certification. Flock's customer contract grants Flock a perpetual, irrevocable license to city data with no termination provision at all.
Flock's own vendor paperwork is the security standard Flock fails.
The disclosure policy that excludes the disclosures that matter
Flock's Vulnerability Disclosure Policy (effective August 6, 2026, days before this page was written) offers researchers legal safe harbor, with one carve-out: "Testing against live customer deployments" is prohibited and unprotected. The exposed cameras that made national news were found exactly that way: by examining real, fielded devices. The policy protects research against Flock's test systems, and withholds protection from the research that actually finds the failures residents live with.
And when it breaks, they tell you quietly
Flock's own public status page logged 50 incidents between March 2025 and August 2026, including 18 separate delays or outages of the "hotlist" alert pipeline, the exact real-time feature that justifies the cameras' existence. In April 2026 they paused hits from the FBI's NCIC database entirely. In February and March 2026, the audit and transparency portals (the accountability tooling) degraded twice. The surveillance never has an outage worth posting. The safety features do, about once a month.
Source: status.flocksafety.com incident history, captured August 11, 2026.
The Receipts
Every document quoted on this page was captured on August 11, 2026: the raw pages, their SHA-256 cryptographic hashes, and submission to the Internet Archive's Wayback Machine. Flock revises these documents regularly: the versions we reviewed carried five different "last updated" dates. If the language changes tomorrow, the record of what it said today survives.
Documents archived: LPR Policy · Terms & Conditions · Evidence Policy · Privacy Policy · Product-Specific Terms · Third-Party Terms · Vendor InfoSec Addendum · Vendor DPA · Vendor Compliance Addendum · Vulnerability Disclosure Policy · public FAQ · status-page incident history · Texas DPS license record (#C29742701) and the August 2025 DPS disciplinary filing.
Want copies? Email [email protected]. Live originals: Flock's legal page · Flock's FAQ · Flock's status history. Read them yourself: that's the whole point.
What to do with all this: Wylie's contract with this vendor auto-renews unless the city sends one letter by September 13. Sign the petition, email the council, and come to the meetings on August 25 and September 8.