In September 2026, the mayor of Columbus, Ohio ordered city workers to cover 65 license plate cameras with bags. The trigger was one officer who searched a single plate at least 272 times, for personal reasons.
Columbus is not an outlier. It is a preview.
Public-space surveillance in 2026 is two systems wearing one name. The big one is license plate readers: Flock Safety has built a national camera network that its own marketing says scans more than 20 billion plates a month across more than 5,000 communities. The other is face recognition: smaller, mostly investigative, and already the subject of wrongful-arrest settlements and a European ban.
The audits that exist found the same thing on both sides. The technology works well enough to be useful, and the guardrails meant to keep it honest were mostly never built. Here is what is deployed, and what the record shows.
Rung One: The Camera on the Corner
A license plate reader is a camera with one job: photograph every plate that passes and log the plate, the location, and the time. Mounted on poles, traffic lights, and patrol cars, they capture cars that have nothing to do with any crime.
Flock does not just sell cameras. It sells a subscription to a network. Flock’s own network page, cited by the ACLU in June 2026, says the system produces more than 20 billion plate scans every month across more than 5,000 communities. Third-party tallies put the fleet at more than 100,000 cameras in 49 states. Those figures are company-provided, but the trend is clear: this is the largest vehicle-tracking network ever assembled in the United States.
The design choice that matters is what happens to the data. Flock keeps it and makes it searchable across its customers, rather than checking each plate against a local list and discarding the misses. That turns thousands of local cameras into one national search engine.
Rung Two: When Local Cameras Become a National Dragnet
Consider Syracuse, New York. The police department did not set out to run a national dragnet, but its Flock data was searchable by agencies far outside the city. According to the ACLU, Syracuse’s footage was queried 4.4 million times in a single year. When that number became public, the city canceled its contract.
This is the structural problem with network license plate readers. A small town buys cameras to catch local car thieves and, in doing so, hands every other agency a window into its streets. The ACLU draws the line plainly: a targeted tool checks a plate and forgets it; a mass surveillance system remembers everything and shares it.
Rung Three: The Face
Face recognition is the older technology and, in public space, the less deployed one.
In the United States, most police face recognition is not live. An investigator uploads a still image, the system returns candidate matches, and a human decides what to do next. The NYPD, which runs one of the largest programs, states in its February 2026 policy that it does not perform real-time facial recognition and that a match is a lead, not probable cause.
The record complicates that assurance. In Detroit, Robert Williams was arrested in front of his family in January 2020 after a face recognition match to a shoplifting suspect, then held about 30 hours. He settled with the city in June 2024 for $300,000, and Detroit agreed to stop building photo lineups or seeking warrants based on a face recognition lead alone. Legal Aid in New York documented a similar pattern in 2025.
Outside policing, retailers were the early cautionary tale. The FTC banned Rite Aid from using face recognition for security for five years in December 2023, after its system falsely flagged shoppers, disproportionately women and people of color, as shoplifters. Much of the underlying data is scraped off the open web: Clearview AI, whose roughly 30 billion-image trove drew a 30.5 million euro fine in the Netherlands in September 2024, still sells to US agencies.
Rung Four: Who Else Can See It
The fourth rung is not a new device. It is access.
Because the network is built for sharing, a local agency’s data can be reached by federal agencies, and federal agencies can reach into local data. Flock was found to have shared data with Customs and Border Protection through an undisclosed pilot, since ended. The ACLU reports that a Texas sheriff used the network to search more than 83,000 cameras across more than 6,800 networks to track a woman suspected of self-managing an abortion, and that a federal agency used plate readers to identify attendees at a gun show.
These searches turned license plate readers from a local police story into a national political one. NPR reported in February 2026 that cities were canceling Flock contracts over the fear that local data would feed immigration enforcement. By mid-2026, the ACLU counted more than 55 localities that had ended their Flock contracts in a single year. Denver signed with a competitor, Axon, instead.
What the Audits Actually Found
For years, the honest answer to “is this being misused?” was that nobody knew, because nobody was auditing. The first serious audit was performed not by a government body but by a newspaper.
In August 2026, USA TODAY published an analysis of more than 75 million Flock searches spanning three and a half years and more than 6,300 agencies. It found 240 users whose search patterns stood out. Reporters contacted the agencies employing 67 of them. In about half of those cases, the agency either confirmed misuse or opened an investigation. By September 11, USA TODAY counted 22 police and sheriff’s officials arrested, fired, placed on leave, or under investigation over searches it had flagged.
The cases read as a pattern, not mistakes:
- An investigator in Albany County, New York searched one plate more than 2,600 times. It was registered to her former girlfriend. She was charged with official misconduct.
- A Georgia deputy searched a single tag 1,146 times, entering “SUSPICIOUS” and “BOB” as his stated reasons.
- A Texas officer searched one plate more than 3,400 times and was indicted on at least 100 felony counts.
Then came the part that matters most for future oversight. In December 2025, Flock changed its software to black out officer initials, plate numbers, and stated reasons from the monthly audit logs that customers can see. In many states those logs are public records, and USA TODAY reported the change makes large-scale outside analysis far harder. Flock said this broadened its safeguards.
That is the pattern to remember. The technology was fully auditable only briefly, the audit found enough to trigger arrests in at least five states, and then the audit trail narrowed. It is the same lesson we covered in our look at AI benchmarks: an audit is worth only as much as what the auditor is allowed to see.
Why the Guardrails Keep Failing
First, the vendor is also the auditor. Flock controls the logs, decides what customers can see, and reports on its own safeguards. That is not an independent check, which is why a newspaper had to do the work a regulator normally would.
Second, the reason field is mostly theater. Investigators found searches justified with “SUS,” “TRAFFIC,” “TEST,” or a single letter of the alphabet. A system that accepts “BOB” as a justification is not enforcing anything.
Third, most searches need no warrant. Running a plate or a face through a database is legally a query, not a stop, and in most places there is no rule requiring a search be tied to a real case.
What the Rules Actually Say
The EU AI Act prohibits real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions requiring prior judicial authorization. Penalties reach 35 million euros or 7 percent of global turnover. That ban has applied since February 2025, though the act’s high-risk deadlines for certain biometric systems were pushed to December 2027, a timeline still in flux.
In the US there is no federal law, only a patchwork. A handful of states and cities restrict face recognition in policing, and Detroit now operates under court-ordered rules from the Williams settlement. Washington passed a Driver Privacy Act in March 2026 after its attorney general raised concerns about out-of-state data sharing. According to the advocacy group State of Surveillance, most US law enforcement agencies operate under no binding face recognition policy at all.
What This Means for You
- Deployment is local, so the decisions are local. Most changes in 2026 came from city councils and mayors, not courts. Contract renewals are the pressure point.
- Sharing settings matter more than camera counts. A camera that flushes its data is a different tool from one that feeds a national network.
- A “no hit” is still a record. Your plate, and your face if captured, gets logged whether or not you did anything wrong.
- Watch the audits, not the press releases. Where there was no audit, misuse ran for years unnoticed. Where there was one, it produced findings within weeks.
The Cameras You Cannot See at Work
Public-space cameras get the headlines, but your employer may already be running a monitoring stack of its own: keystroke logs, screen capture, and in some cases AI that scores your productivity. We broke down what is common, what your boss can actually see, and what the rules allow.
The Short Version
- Public-space surveillance in 2026 is two systems: license plate reader networks (huge, shared, lightly audited) and face recognition (smaller, investigative, legally contested).
- Flock’s network is company-reported at 20 billion scans a month; independent counts put it at 100,000+ cameras in 49 states.
- A USA TODAY audit of over 75 million searches across 6,300+ agencies helped trigger action against 22 officials in at least five states.
- Flock narrowed its audit logs in December 2025, making the outside analysis that exposed the misuse much harder.
- Europe bans real-time police face recognition in public space. The US has no federal law, only a patchwork.
FAQ
Can the police identify me in real time from a street camera?
In the United States, mostly no. The NYPD and most departments say their face recognition is not live, and that a match is a lead rather than an arrest. Europe bans real-time police face recognition in public space outright. What runs continuously is the plate reader network, which logs every car.
Do license plate readers keep data on drivers who did nothing wrong?
Yes. The camera logs every plate it sees, not just wanted ones. Retention depends on the contract, but the ACLU has found agencies holding data for 30 days or more, and that window is what makes historical tracking possible.
What is the difference between a plate reader and face recognition?
A plate reader identifies a car by its registration, so it works even when the driver is unknown. Face recognition tries to identify a person by their face. Plate readers are far more widespread and always on; face recognition usually runs on a single image after a crime.
Has anyone actually been punished for misusing these systems?
Increasingly, yes. USA TODAY’s investigation led to disciplinary action or investigation against 22 officials, and one Texas officer faced more than 100 felony counts. Vendor-level accountability is rarer. Clearview AI has been fined in Europe but continues to sell to US agencies.
About The Author
