Sen. Josh Hawley’s new license plate reader bill would make police permanently delete driver data after 10 days. Flock Safety, the company the bill is named for, already hard-deletes plate data on a rolling seven-day schedule by default, according to the license plate reader policy it last updated June 30, 2026.
That comparison is a fair guide to the rest of the Stop Flock Abuse Act, which the Missouri Republican announced on Sept. 30. Most of its seven guardrails would write into federal law practices Flock already lists in its own policy, applied to the agencies that buy the cameras. One of them, a second signature on every search, would change how officers use the system day to day. And none of the seven, as Hawley’s office describes them, address the feature that helped put a Florida driver in jail for 13 days: the network’s ability to hunt for a car by what it looks like instead of by its plate.
Seven rules, described in a press release
Hawley’s office has released a summary of the bill, not its text. According to that summary, the act would:
- bar local governments from selling or sharing vehicle location data with non-governmental third parties, which the release says would also shield drivers’ data from FOIA requests;
- require a written approval process that logs every authorization for a search;
- require agencies to record who searched, why, who approved it and what was viewed, with supervisors auditing those logs regularly for red flags such as repeat searches of the same person;
- require the data to be encrypted and kept inside the United States;
- require permanent deletion of driver data after 10 days, with narrow exceptions for active criminal investigations;
- ban plate reader hardware and software sourced from foreign adversaries;
- ban facial recognition from plate reader networks.
The bill follows a Sept. 23 hearing of the Senate Judiciary Subcommittee on Crime and Counterterrorism, which Hawley chairs, titled “Always Watching: Flock’s Nationwide AI Surveillance Network.” Hawley had invited the chief executives of Flock, Axon, Motorola Solutions and Verkada, and his office says all four declined. Flock answered in writing instead; Hawley’s office says the company agreed in that letter that Congress needs to create a federal framework. Hawley’s office did not release the letter with its announcement.
The scale is why a senator is writing rules for a camera company. In an Aug. 26 letter to Flock CEO Garrett Langley, Hawley wrote that the company “boasts more than 120,000 cameras across 49 states and more than 20 billion vehicle scans every month.” A week later he sent similar demands to Motorola Solutions, Verkada and Axon.
Flock’s policy already covers most of the list
Set the bill summary beside Flock’s published policy and much of it lines up. Flock says it stores every query with the username, date, time, purpose and the plate or other details searched. It says data is encrypted from camera to cloud and stored in U.S.-based Amazon Web Services infrastructure, including what it calls AWS Government Cloud. It says the customer, not Flock, owns the data, that customers decide whether to share it with other Flock customers, and that Flock will not sell customer plate data for commercial purposes.
Some of that is recent. Alasdair Whitney, legislative counsel at the Institute for Justice, a public-interest law firm that is suing Norfolk, Virginia, over its Flock cameras, told the subcommittee that Flock, “facing public backlash, revised its default retention period from 30 days to seven and made its audit tools mandatory.”
A default is only a default, though. Flock’s policy says the seven-day window can be lengthened or shortened if a customer’s law or policy calls for a different schedule, and that is where a federal ceiling would bite. Whitney testified that state retention limits, where they exist, run from three minutes in New Hampshire to five years in Alabama. Virginia’s 2025 law set 21 days. A 10-day federal cap would cut Virginia’s limit by more than half and Alabama’s by about 99 percent. What it would mean for New Hampshire’s three-minute rule depends on bill text Hawley’s office has not yet released.
The bill also stops short of what Hawley’s own witness asked for. The Institute for Justice model legislation Whitney presented would require a warrant before a government official can access historical location information and would cap retention at seven days. Hawley’s version keeps the search inside the agency, with a supervisor’s written approval standing in for a judge.
Milwaukee shows why a second signature matters
An audit log records misuse after the fact. Hawley’s August letter cited a Milwaukee police officer whom prosecutors charged after he allegedly searched his girlfriend’s plate 124 times and her former boyfriend’s plate 55 times, “entering ‘investigation’ as his justification each time.” The system logged every one of those searches, along with a purpose field that said nothing. The same letter said the St. Charles County Police Department in Missouri ended its Flock contract after an audit found a civilian employee had run searches for personal reasons. The Auto Wire has also covered a class action built on one deputy’s repeated searches.
The written-approval requirement is the part of Hawley’s bill that addresses this. A one-word justification typed by the person searching is a sign-in sheet. A search that another person has to approve in writing, followed by a supervisor reviewing the log for the same plate turning up again and again, is closer to the two-key rule a bank uses for its vault. It still is not a warrant, and Pinal County, Arizona, Sheriff Ross Teeple, who testified that he was one of the first law enforcement leaders in the country to end a Flock contract, put the gap in terms any car owner can follow. “If my deputies need a search warrant to put a physical tracker on a vehicle, where is the line for camera systems that build an identical, AI-driven map of a citizen’s life?” he asked in his written testimony.
Whitney’s numbers show how far that map can go. In the Norfolk case, he testified, Flock cameras logged one plaintiff’s plate at least 526 times and the other’s at least 849 times in less than five months, and replicating that by hand would have taken at least 352 officers working 12-hour shifts, seven days a week.
The Durango search the bill does not mention
The name “license plate reader” undersells what these cameras catalog. Flock’s own policy defines its data to include the vehicle image and vehicle characteristics such as color and make, and says an alert can fire on a “license plate or vehicle characteristics” that match a database or hot list. Whitney testified that an officer can search by full or partial plate, filter by a car’s features, or type a description like “blue Mustang with racing stripes,” then generate a “Vehicle Journey Map” of everywhere that car has been captured and run “convoy analysis” to find vehicles frequently seen together.
Lindsey Isaacs of Palm Coast, Florida, is what that looks like when it goes wrong. In her testimony, she said a Flock camera captured her Dodge Durango two to three miles west of a fatal crash. Investigators were looking for a black Durango. She later learned that witnesses had described a maroon Durango and that 911 callers had given a partial plate of 458. She was arrested on charges that included three counts of vehicular homicide, spent 13 days in jail, about three and a half of them in solitary confinement, and in May 2026 the state declined to prosecute. Hawley’s letter described the arrest as based on investigators’ search of Flock’s network “for a vehicle description.”
Nothing in the bill summary deals with accuracy, testing, or searches by description. A plate is close to unique. A make, model and color is shared by every car that matches it within camera range, and a popular SUV in a dark color is a long list. Hawley’s letter cited a California police department that found 71 percent of its alerts were wrong, and said the Los Angeles Police Department dropped its Flock contract after an audit found officers had stopped 161 vehicles incorrectly flagged as stolen in two months. Flock’s policy tells users to confirm the computer’s reading before acting on an alert. That is advice, and nothing in the bill summary would turn it into a requirement.
Bill text, private cameras and federal grant money
Three things will decide whether this bill touches the cameras drivers pass every day. The first is coverage. Hawley’s summary assigns its duties to “local governments” and “agencies,” but Flock also sells to homeowners associations and businesses, and Teeple warned specifically about relying on “private camera networks to act as a dragnet.” If a subdivision’s camera feeds the same search portal police use, whether the 10-day clock applies to it is the first thing to look for when the text is filed.
The second is preemption: whether a 10-day federal ceiling lets states keep shorter limits like New Hampshire’s or overrides them. The third is money. Sens. Raphael Warnock and Katie Britt wrote to Attorney General Todd Blanche in a letter dated Sept. 21, asking, among other things, how much Justice Department funding has gone to buying plate reader systems and how those grants are overseen, with answers requested by Oct. 21. Whitney urged Congress to condition federal grants on stronger safeguards. Grant conditions are the usual way Washington sets rules for local police, though state money has paid for these networks too, as The Auto Wire reported from Texas. Hawley’s bill also arrives alongside House proposals such as the Flock-Off Act.
For a driver, the practical result of the bill as summarized is a shorter memory and a harder search: a record of your commute that disappears after 10 days unless it is tied to an active criminal investigation, and an officer who needs someone else’s sign-off to look it up. It would not stop a camera from deciding that your car looks like the one police want.
Should police need a warrant to search where your car has been, or is a supervisor’s written approval enough?