`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Exhibit A
`
`
`Ex. A
`p. 7
`Case 3:26-cv-02375 Document 1-1 Filed 03/18/26 Page 1 of 32
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`COMPLAINT
`
`1
`
`J. Aaron Lawson (SBN 319306)
`alawson@edelson.com
`Mickey Terlep (SBN 367340)
`mterlep@edelson.com
`EDELSON PC
`150 California St., 18th Floor
`San Francisco, California 94111
`Tel: (415) 212-9300
`
`Attorneys for Plaintiffs
`
`SUPERIOR COURT OF THE STATE OF CALIFORNIA
`FOR THE COUNTY OF CONTRA COSTA
`
`DORIAN ELDRIDGE and SILAS PEREZ,
`individually and on behalf of all others
`similarly situated,
`
` Plaintiffs,
`
`v.
`
`FLOCK GROUP INC.,
`
` Defendant.
`Case No.: ___________________
`
`CLASS ACTION COMPLAINT
`
`DEMAND FOR JURY TRIAL
`Plaintiffs Dorian Eldridge and Silas Perez bring this Class Action Complaint and Demand
`for Jury Trial against Defendant Flock Group Inc., and allege as follows upon personal knowledge
`as to themselves and their own acts and experiences, and upon information and belief as to all
`other matters:
`NATURE OF THE ACTION
`1. Flock operates one of the largest automated license plate recognition (“ALPR”)
`networks in the country. Its cameras, which are mounted on unmarked poles along public roads
`throughout California, photograph nearly every passing vehicle and capture license plate numbers,
`vehicle images, and the precise location, date, and time of each sighting. That data is uploaded to
`Flock’s centralized databases, where it can be searched, aggregated, and shared across Flock’s
`network of more than 4,800 law enforcement agency clients. The result is a surveillance system
`that tracks the movements of millions of Californians––including data showing where they live,
`Electronically Filed Superior Court of CA County of Contra Costa 2/18/2026 2:37 PM By: C. Padilla, Deputy
`Processed by Court on 2/23/2026 2:38 PM
`C26-00576
`Per local Rule, This case is assigned to
`Judge Reyes, Benjamin T, II, for all purposes.
`Ex. A
`p. 8
`Case 3:26-cv-02375 Document 1-1 Filed 03/18/26 Page 2 of 32
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`COMPLAINT
`
`2
`work, worship, seek medical care, protest, and associate—without their knowledge or even a
`warrant.
`2. California law does not prohibit ALPR surveillance. But the Legislature recognized
`that unchecked ALPR use capturing the movements of millions of drivers, continuously and
`without notice, demands meaningful regulation. In 2015, the Legislature enacted Senate Bill No.
`34 (2015-2016 Reg. Sess.) (hereafter “SB 34” or the “ALPR Law”) to regulate how ALPR data is
`collected, secured, and shared with third parties. (Civ. Code, § 1798.90.5 et seq.) SB 34 requires
`ALPR operators like Flock to maintain reasonable security procedures, implement and post a
`“usage and privacy policy,” and ensure that ALPR data is used only for “authorized purposes.” SB
`34 also prohibits California public agencies from sharing ALPR data with federal agencies and
`out-of-state law enforcement. (See Civ. Code, § 1798.90.5, subd. (f); § 1798.90.55, subd. (b).)
`3. The First Appellate District recently confirmed that these obligations are
`mandatory. In Bartholomew v. Parking Concepts, Inc., the court recognized that the public-facing
`disclosure is a “primary focus of the ALPR Law” because the statute “grants individuals the right
`to know which entities are collecting their ALPR data and how it is being used and maintained.”
`The court held that collecting ALPR data without a compliant policy is itself a cognizable harm
`under the statute—meaning that Flock is systematically violating the privacy and civil liberties of
`millions of California residents on thousands of roads across the state, every single day. (See
`Bartholomew, (Ct.App. Feb. 5, 2026, No. A171546) 2026 WL 308163, at *6 (“Collecting and
`maintaining individuals’ ALPR information without implementing and making public the
`statutorily required policy harms these individuals by violating this right to know.”).)
`4. Flock has systematically violated these statutory obligations, and its conduct has
`far-reaching consequences. The ALPR information Flock collected on California drivers—and
`then made available to unauthorized agencies nationwide—has been exploited for exactly the
`purposes the Legislature sought to prevent. Flock’s ALPR information has been used for a number
`of unlawful purposes, including federal immigration enforcement, cross-border investigations
`targeting women who obtained abortions, and dragnet surveillance untethered from any criminal
`predicate.
`Ex. A
`p. 9
`Case 3:26-cv-02375 Document 1-1 Filed 03/18/26 Page 3 of 32
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`COMPLAINT
`
`3
`5. Flock designed its system—including the cross-jurisdictional sharing features like
`“National Lookup”—to facilitate exactly the kind of sharing SB 34 prohibits. A single lookup on
`Flock’s platform can sweep across its entire nationwide database, giving federal and out-of-state
`agencies, including Immigration and Customs Enforcement (“ICE”) broad access to California
`ALPR information. The scope of this unlawful sharing only came to light through investigative
`reporting and public records requests, which revealed systematic violations across California.
`More than 1.6 million searches were conducted by 5,757 outside agencies—including at least 19
`searches marked as related to ICE operations––on ALPR information collected by the San
`Francisco Police Department, which was just one of more than 200 California agencies on Flock’s
`platform. Texas law enforcement used Flock’s network to conduct a nationwide search, including
`specifically in California, for a woman they claimed had obtained an abortion. Audit logs reflect
`discriminatory search terms and cross-border investigations related to abortion and other sensitive
`medical care.
`6. In February 2025, Flock acknowledged that out-of-state agencies had access to
`conduct broad searches of California ALPR data. But it was only after sustained public scrutiny
`that Flock finally removed California from its “National Lookup” system. Even then, numerous
`law enforcement agencies in California continued to use Flock’s system to share California ALPR
`data with federal and other out-of-state agencies.
`7. As discussed more fully below, Flock violated SB 34 in two distinct ways.
`8. First, it failed to post the required “usage and privacy policy” before collecting
`ALPR information from California drivers. SB 34 requires that ALPR operators identify the
`“authorized purposes” for collecting and using ALPR information. “The authorized uses
`delineated in the policy apply not only to the ALPR operator, but to anyone who receives ALPR
`information from that operator.” (Bartholomew, supra, 2026 WL 308163, at *6.) SB 34 also
`requires that the policy include a description of how the ALPR system is monitored for
`compliance with privacy laws, who is authorized to access the system, what training they receive,
`and the “purposes of, process for, and restrictions on” the sale or sharing of ALPR information to
`third parties. (See Civ. Code, § 1798.90.51, subd. (b)(2)(D).) Flock’s publicly posted policy fails
`Ex. A
`p. 10
`Case 3:26-cv-02375 Document 1-1 Filed 03/18/26 Page 4 of 32
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`COMPLAINT
`
`4
`on every count.
`9. Second, Flock designed its system to make California ALPR information available
`to federal agencies and out-of-state law enforcement. Flock’s “National Lookup” and cross-
`jurisdictional sharing features allowed any agency on its platform to search California ALPR
`databases without restriction. Flock implemented no technical safeguards to limit access to
`California public agencies as the statute requires, did not require multifactor authentication, and
`did not provide California agencies with the ability to block unauthorized access to their data.
`10. Plaintiffs are California residents whose vehicles were photographed by Flock
`ALPR cameras and whose ALPR information was captured and stored on Flock’s system. Their
`data was accessible to federal agencies, out-of-state law enforcement, and the public at large in
`violation of SB 34. They bring this action on behalf of themselves and a class of similarly situated
`California residents to hold Flock accountable for its knowing violations of Civil Code sections
`1798.90.5 et seq.
`PARTIES
`11. Plaintiff Dorian Eldridge is a natural person and citizen of the State of California.
`Plaintiff Eldridge resides in the City of San Ramon.
`12. Plaintiff Silas Perez is a natural person and citizen of the State of California.
`Plaintiff Perez resides in the City of Monrovia.
`13. Defendant Flock Group Inc. is a corporation formed under the laws of Delaware,
`with its principal place of business in Georgia.
`JURISDICTION AND VENUE
`14. This Court has subject matter jurisdiction over this matter pursuant to Article VI,
`section 10 of the California Constitution.
`15. This Court has general personal jurisdiction over Flock because Flock conducts
`substantial, continuous, and systematic business in California. Flock has active contracts with
`more than 200 California law enforcement agencies, including the San Ramon Police Department
`and Contra Costa Sheriff’s Office, operates thousands of ALPR cameras within the state, and
`collects and stores data on millions of California drivers. Plaintiffs’ claims arise out of and relate
`Ex. A
`p. 11
`Case 3:26-cv-02375 Document 1-1 Filed 03/18/26 Page 5 of 32
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`COMPLAINT
`
`5
`to Flock’s California contacts.
`16. Venue is proper in Contra Costa County under Code of Civil Procedure section
`395, subdivision (a) because Plaintiff Eldridge resides in Contra Costa County, Flock operates
`ALPR cameras in Contra Costa County, and a substantial part of the events giving rise to Plaintiff
`Eldridge’s claims occurred in this County.
`FACTUAL BACKGROUND
`I. The California ALPR Law.
`17. In 2015, the California Legislature recognized the numerous privacy concerns
`implicated by the use of ALPR technology:
`
`The collection of a license plate number, location, and time stamp over multiple
`time points can identify not only a person’s exact whereabouts but also their pattern
`of movement. Unlike other types of personal information that are covered by
`existing law, civilians are not always aware when their ALPR data is being
`collected. One does not even need to be driving to be subject to ALPR technology:
`A car parked on the side of the road can be scanned by an ALPR system. This bill
`will put in place minimal priva cy protections by requiring the establishment of
`privacy and usage protection policies for ALPR operators and end users.
`18. To address these concerns the ALPR law requires ALPR operators (such as Flock),
`and end users (such as law enforcement agencies), to comply with three basic requirements:
`i. The Security Requirement: ALPR operators and end users must “[m]aintain
`reasonable security procedures and practices, including operational, administrative,
`technical, and physical safeguards, to protect ALPR information from unauthorized access,
`destruction, use, modification, or disclosure. ” (Civ. Code , § 1798.90.51 , subd. (a); §
`1798.90.53, subd. (a).)
`ii. The Privacy Requirement: ALPR operators and end users must implement a
`usage and privacy policy in order to ensure that the collection, use, maintenance, sharing,
`and dissemination of ALPR information is consistent with respect for individuals ’ privacy
`and civil liberties. (Civ. Code, § 1798.90.51, subd. (b)(1); § 1798.90.53, subd. (b)(1).)
`iii. The Notice Requirement: ALPR operators and end users must post a usage
`and privacy policy “conspicuously” on their website and include the following information
`Ex. A
`p. 12
`Case 3:26-cv-02375 Document 1-1 Filed 03/18/26 Page 6 of 32
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`COMPLAINT
`
`6
`pursuant to Civil Code sections 1798.90.51, subdivision (b) and 1798.90.53 , subdivision
`(b):
`(a) The authorized purposes for using the ALPR system and collecting
`ALPR information;
`(b) A description of the job title or other designation of the employees
`and independent contractors who are authorized to use or access the ALPR
`system, or to collect ALPR information. The policy shall identify the training
`requirements necessary for those authorized employees and independent
`contractors;
`(c) A description of how the ALPR system will be monitored to ensure
`the security of the information and compliance with applicable privacy laws;
`(d) The purposes of, process for, and restrictions on, the sale, sharing, or
`transfer of ALPR information to other persons;
`(e) The title of the official custodian, or owner, of the ALPR system
`responsible for implementing this section;
`(f) A description of the reasonable measures that will be used to ensure
`the accuracy of ALPR information and correct data errors; and
`(g) The length of time ALPR information will be retained, and the
`process the ALPR operator will utilize to determine if and when to destroy
`retained ALPR information.
`19. ALPR operators must also comply with two additional requirements to ensure
`consumer privacy and protect against unauthorized access:
` i. The Audit Requirement. ALPR operators must maintain a record of the
`times their ALPR system is accessed, whether by operators, employees, or end users. (Civ.
`Code, § 1798.90.52, subd. (a).) The audit trail must note the date and time of the query, the
`data that was queried, who queried it, and the purpose of the query. (Ibid.) A record that
`omits required fields or uses non-descriptive placeholders for “purpose”—for example, a
`blank entry or a generic label such as “investigation”—defeats the auditability SB 34
`Ex. A
`p. 13
`Case 3:26-cv-02375 Document 1-1 Filed 03/18/26 Page 7 of 32
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`COMPLAINT
`
`7
`mandates and undermines the Legislature’s intent that ALPR access be meaningfully
`reviewable and accountable.
`ii. The Proper Use Requirement. ALPR operators must also “[r]equire that
`ALPR information only be used for the authorized purposes described in the usage and
`privacy policy.” (Civ Code., §1798.90.52, subd. (b).)
`20. California public agencies collecting ALPR data may not share ALPR data with
`federal agencies or out-of-state law enforcement agencies. “A public agency shall not sell, share,
`or transfer ALPR information, except to another public agency, and only as otherwise permitted
`by law.” (Civ. Code., § 1798.90.55, subd. (b).) “Public agency” means “the state, any city, county,
`or city and county, or any agency or political subdivision of the state or a city, county, or city and
`county, including, but not limited to, a law enforcement agency.” (Civ. Code., § 1798.90.5, subd.
`(f).)
`21. The California Attorney General issued written guidance in October 2023
`explaining that the plain text of the ALPR Law permits the sharing of ALPR data only with other
`California state and local agencies:
`[T]he definition of “public agency” is limited to state or local agencies, including
`law enforcement agencies, and does not include out-of-state or federal law
`enforcement agencies. (See Civ. Code, § 1798.90.5, subd. (f).) Accordingly, SB
`34 does not permit California LEAs [Law Enforcement Agencies] to share ALPR
`information with private entities or out-of-state or federal agencies, including out-
`of-state and federal law enforcement agencies. This prohibition applies to ALPR
`database(s) that LEAs access through private or public vendors who maintain
`ALPR information collected from multiple databases and/or public agencies.
`22. Likewise, the California AG has clarified that, under SB 34, “ALPR operators [like
`Flock] . . . must develop a usage and privacy policy, which must be conspicuously posted on their
`website, and must contain provisions designed to ‘protect ALPR information from unauthorized
`access, destruction, use, modification, or disclosure.’”
`23. An individual harmed by this statute may bring a civil suit “against a person who
`knowingly caused the harm” and recover (1) actual damages, but not less than liquidated damages
`in the amount of $2,500, (2) punitive damages upon proof of willful or reckless disregard of the
`law, (3) reasonable attorney’s fees and other litigation costs reasonably incurred, and (4) other
`Ex. A
`p. 14
`Case 3:26-cv-02375 Document 1-1 Filed 03/18/26 Page 8 of 32
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`COMPLAINT
`
`8
`preliminary and equitable relief as the court determines to be appropriate. (Civ. Code, §
`1798.90.54, subd. (b).)
`II. Flock’s ALPR System and Unlawful Practices.
`24. Flock operates one of the largest ALPR systems in the United States. Flock’s
`system includes thousands of cameras deployed throughout California, a centralized database
`containing billions of license plate scans, and an AI-powered software platform that enables real-
`time searching, analysis, and cross-jurisdictional data sharing.
`25. Flock’s most popular products, the “Falcon” and the “Sparrow,” are ALPR cameras
`that photograph all passing vehicles. The cameras are typically mounted on existing traffic poles
`or on freestanding unmarked poles with solar power sources.
`26. Flock ALPR cameras collect the following information: (a) license plate image; (b)
`vehicle image; (c) vehicle characteristics (including color, make, body type, and other visual
`details such as bumper damage, roof racks, and stickers); (d) license plate number; (e) license
`plate state; (f) date; (g) time; and (h) camera location.
`27. Flock uses machine learning to identify and analyze vehicles beyond basic license
`plate recognition. Flock refers to this composite identifying information as a “Vehicle
`Fingerprint.” Flock has stated in its own marketing materials that its system “delivers more than
`just license plate information” and that it has “taken license plate reading to the next level by
`including details on the entire vehicle,” including the ability to “identify a temporary paper plate
`and even a vehicle where there is no plate present.”
`28. Flock holds a United States patent (U.S. Patent No. 11,416,545 B1) for a dynamic
`surveillance system that can be configured to identify “classes of people (male, female, race,
`etc.).” While Flock claims in advertising materials that it does not use facial recognition, recent
`reporting indicates that Flock’s ALPR readers in at least some instances capture images of
`people’s faces, saving them to a folder separate from the ALPR data.
`29. More than 200 California law enforcement agencies collect and use images
`captured by Flock ALPR cameras. The Los Angeles County Sheriff’s Department alone operates
`476 Flock cameras.
`Ex. A
`p. 15
`Case 3:26-cv-02375 Document 1-1 Filed 03/18/26 Page 9 of 32
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`COMPLAINT
`
`9
`30. Flock boasts that its cameras are used by more than 4,800 law enforcement
`agencies nationwide and claims to operate the nation’s largest fixed ALPR network: “With
`billions of monthly plate reads, Flock connects communities, businesses and law enforcement in a
`shared network.”
`31. Flock does not merely collect data passively. Its AI-powered system analyzes
`movement patterns, identifies how often a vehicle visits a given location, and can predict future
`activity based on historical data. In 2025, Flock announced new capabilities through its
`“Investigations Manager” product, designed to proactively flag vehicles as suspicious. These
`features include a “Multi-State Insights” feature that alerts law enforcement when vehicles are
`detected in multiple states; a “Linked Vehicles” or “Convoy Search” that allows police to uncover
`vehicles frequently seen together; and a “Multiple locations search” that identifies vehicles seen at
`multiple locations.
`
`A. Flock Disclosed California ALPR Data to Federal and Out-of-State
`Agencies.
`32. Despite the ALPR Law’s clear prohibition on sharing California ALPR data with
`non-California entities, Flock allows federal agencies––including ICE––and numerous out-of-state
`law enforcement agencies, to access its California ALPR databases.
`33. Flock’s system includes a “National Lookup” feature that permits law enforcement
`agencies outside of California to search a given California agency’s ALPR data.
`34. Only after extensive negative media coverage in mid-2025 did Flock remove
`California ALPR information from its national lookup system. The timing of this change amounts
`to a tacit admission that Flock’s configuration violated California law.
`35. Before and even after this change, California law enforcement agencies used
`Flock’s platform to search ALPR data on behalf of federal agencies in direct violation of the
`ALPR Law.
`36. In February 2025, Flock acknowledged to California agencies that its system
`architecture permitted out-of-state law enforcement agencies to conduct broad searches of
`California ALPR data.
`Ex. A
`p. 16
`Case 3:26-cv-02375 Document 1-1 Filed 03/18/26 Page 10 of 32
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`COMPLAINT
`
`10
`37. Even after Flock’s mid-2025 system changes, violations continued. Officers from
`the San Francisco and Oakland Police Departments continued sharing California Flock ALPR data
`with at least seven federal agencies. Many California agencies that had previously run illegal
`immigration-related searches subsequently ran hundreds of searches with no case number and no
`stated reason beyond “investigation,” raising concerns that unlawful sharing persists.
`38. The Riverside County Sheriff’s Department continued to perform ALPR searches
`on behalf of federal agencies even after being informed that its practice of sharing ALPR data with
`federal agencies violated state law.
`39. A 2023 analysis by the Electronic Frontier Foundation found that at least 71
`California law enforcement agencies had violated the ALPR Law that year.
`40. The California Attorney General has initiated enforcement actions against at least
`20 California law enforcement agencies, and in October 2025 filed suit against the City of El
`Cajon for illegally sharing license plate data with out-of-state law enforcement.
`41. Flock’s system architecture made these violations foreseeable and preventable. As
`Flock itself has acknowledged, once a department allows another agency to access its system, the
`outside agency can search the data without needing approval each time. Users can query multiple
`networks simultaneously: searches of Oakland’s ALPR data were found to reach hundreds of other
`networks at once.
` B. Flock Failed to Implement an Adequate Privacy and Usage Policy.
`42. The ALPR Law requires ALPR operators to implement a usage and privacy policy
`designed to ensure that ALPR data collection, use, and sharing is “consistent with respect for
`individuals’ privacy and civil liberties” and to monitor the system to ensure “compliance with
`applicable privacy laws.” (Civ. Code, §§ 1798.90.51, subds. (b)(1), (b)(2)(C).)
`43. As the Bartholomew court held, this policy requirement is “critical in holding
`ALPR operators accountable[.]” (Bartholomew, supra, 2026 WL 308163, at *6.) Without a
`compliant policy establishing authorized uses, “it is much more difficult to hold them accountable
`for unauthorized uses, even though this is an example of a harm-causing violation expressly stated
`in the ALPR Law.” (Ibid. (emphasis in original).)
`Ex. A
`p. 17
`Case 3:26-cv-02375 Document 1-1 Filed 03/18/26 Page 11 of 32
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`COMPLAINT
`
`11
`44. Flock’s policy, as it existed for the majority of the class period, did not include
`adequate provisions to prevent unauthorized sharing of California ALPR data with federal or out-
`of-state agencies. Until at least June 2025, Flock’s system permitted national lookups that exposed
`California data to non-California agencies without any safeguard or warning.
`45. Flock has publicly disclaimed responsibility for compliance with the ALPR Law,
`maintaining that its “customers choose whether to share LPR data with other customers in
`accordance with their laws and policies.” This position is contrary to the ALPR Law, which
`imposes independent obligations on ALPR operators—not just end users—to ensure compliance
`with applicable privacy laws. (See Civ. Code, § 1798.90.51, subd. (b)(2)(C) [policy must describe
`“how the ALPR system will be monitored to ensure the security of the information and
`compliance with applicable privacy laws”]; see also Civ. Code, § 1798.90.52, subd. (b) [operator
`must “require that ALPR information only be used for the authorized purposes”].)
`46. Flock’s CEO Garrett Langley, in a June 2025 blog post announcing the removal of
`California from national lookup, characterized the change as intended “to make compliance
`easier”—language that falls well short of the ALPR Law’s mandate that operators ensure
`compliance.
`47. In an August 2025 blog post, Langley wrote that Flock’s new Chief Legal Officer
`would lead efforts “to ensure users are able to determine, in compliance with local laws,
`regulations, and community norms, whether and when to share their data.” This statement is an
`implicit admission that, prior to that date, Flock’s system did not enable users to comply with
`California law, and that Flock was not in compliance with the ALPR Law. It also confirms that it
`was always feasible for Flock to place reasonable limitations on use of its database in order to
`comply with California law.
` C. Flock Failed to Maintain Reasonable Security Procedures.
`48. The ALPR Law requires ALPR operators to “[m]aintain reasonable security
`procedures and practices, including operational, administrative, technical, and physical safeguards,
`to protect ALPR information from unauthorized access, destruction, use, modification, or
`disclosure.” (Civ. Code, § 1798.90.51, subd. (a).)
`Ex. A
`p. 18
`Case 3:26-cv-02375 Document 1-1 Filed 03/18/26 Page 12 of 32
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`COMPLAINT
`
`12
`49. Flock’s security practices fall far below any reasonable standard.
`50. Failure to Require Multifactor Authentication. Flock did not require multifactor
`authentication (“MFA”) for law enforcement end users accessing its ALPR database. MFA is a
`basic, widely adopted security measure used to protect access to sensitive systems, including the
`federal courts’ PACER filing system. Flock’s failure to mandate MFA facilitated unauthorized
`credential sharing with federal and out-of-state agencies. Only after negative press coverage did
`Flock make MFA a default setting—but even then, Flock still did not require it. Predictably, Flock
`police login credentials have been found for sale by Russian hackers on dark web forums.
`51. Fifty-One Identified Vulnerabilities. A security researcher known as Jon “GainSec”
`Gaines published a formal white paper identifying fifty-one vulnerabilities in Flock’s hardware
`and software, many classified as critical. These include:
`(a) Physical vulnerabilities: Pressing an easily accessible button on the back of
`publicly mounted Flock cameras in a simple sequence opens a wireless access
`point that can be hijacked to grant root access to the camera’s systems, enabling
`an attacker to access video data, scrape data, insert fake camera feeds, obtain
`police information, and install software. Exposed USB ports provide yet
`another avenue for unauthorized access.
`(b) Unsupported operating system: Flock cameras continue to run on Android
`Things 8.1, a mobile operating system that has been discontinued by Google
`and is no longer supported with security patches.
`(c) Unprotected testing data: Flock left its internal testing data accessible online,
`including police names, phone numbers, patrol areas, suspect hotlists, full
`license plates, and geographic information systems data showing the live
`locations of patrol cars.
`(d) Exposed Video Feeds. Reporting revealed that video feeds from Flock’s
`“Condor” cameras—designed to track people and operating in conjunction with
`Flock’s ALPR cameras—were configured in a way that made at least dozens of
`live feeds accessible on the internet without any password or login information.
`Ex. A
`p. 19
`Case 3:26-cv-02375 Document 1-1 Filed 03/18/26 Page 13 of 32
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`COMPLAINT
`
`13
`Several of these unsecured feeds were from cameras located in California.
`Journalists were able to watch in real time as Flock’s devices surveilled drivers
`and pedestrians.
`(e) Leaked Audit Reports. Flock’s monthly audit reports, which are subject to
`public records requests, have revealed hundreds of thousands of unredacted
`license plate numbers, alongside the sensitive reasons law enforcement agencies
`searched for them. Rather than implementing proper redaction procedures,
`Flock removed wholesale the ability to view officer names and license plate
`numbers from audit reports—rendering the reports insufficient under Civil
`Code section 1798.90.52, subdivision (a), while failing to address the
`underlying security deficiency.
`52. Flock’s response to the GainSec white paper was misleading. Flock claimed that
`exploitation of the identified vulnerabilities would “require physical access to a device” and
`“intimate knowledge of internal device hardware.” But Flock’s cameras are mounted in public
`areas, making physical access easy, and the white paper itself noted that the vulnerabilities could
`be exploitable by less experienced hackers.
`
`D. Flock’s Audit and Transparency Failures Enabled Unauthorized Use
`and Disclosure.
`53. SB 34’s audit requirement exists to ensure ALPR operators maintain an auditable
`record of access and use—including “[t]he purpose for accessing the information”—so that
`unauthorized or unlawful searches can be detected, investigated, and deterred. (See Civ. Code, §
`1798.90.52, subd. (a).) The audit requirement is a critical accountability mechanism: it enables
`oversight by regulators and the public, and it deters misuse by ensuring that those who access
`ALPR information know their searches will be recorded and reviewable. By failing to maintain
`adequate audit records, an ALPR operator deprives individuals of the statutory protection designed
`to ensure that access to their ALPR information is transparent and accountable.
`54. Flock’s platform generates and provides monthly audit reports to end-user
`agencies. Those audit reports have been routinely subject to public records requests. Reporting has
`Ex. A
`p. 20
`Case 3:26-cv-02375 Document 1-1 Filed 03/18/26 Page 14 of 32
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`COMPLAINT
`
`14
`revealed that audit-report disclosures exposed large quantities of unredacted license plate numbers
`alongside the sensitive reasons officers searched for them. This information can be used to infer
`where individuals live, work, worship, associate, and seek medical care.
`55. These disclosures were foreseeable. SB 34 requires maintenance of audit records,
`and California public-records laws make it predictable that agencies will receive—and respond
`to—requests for audit materials. Reasonable ALPR security and privacy practices therefore
`require robust operational and technical controls to ensure audit materials can be produced in
`compliance with public-records obligations without disclosing ALPR information to the public at
`large.
`56. Instead of implementing reasonable and privacy-prot