Flock Cameras on Campus: Who Controls License Plate Data?

By Jaspal Singh October 12, 2026 Updated: October 12, 2026

A college that rents Flock license plate cameras does not own them, so it cannot simply switch them off. Elgin Community College learned this when Flock refused to end its contract early. Under Flock's model, Flock owns the hardware, the customer owns the data, and sharing is set in software. That split decides who controls campus surveillance.

What Happened

Elgin Community College, a two-year public college in the far west suburbs of Chicago, had Flock Safety install six automatic license plate reader (ALPR) cameras in April 2025. President Peggy Heinrich said at the time that they would improve student safety. On October 9, 2026, WBEZ and the Chicago Sun-Times, reporting with the nonprofit newsroom Open Campus, published an account of how that arrangement fell apart. The Verge followed up the next day.

According to that reporting, Heinrich became uneasy after news broke that federal Customs and Border Protection had searched Illinois Flock data. Then, on September 18, 2025, federal immigration agents detained a student in a parking lot on the main campus. The college confirmed the detention in a public statement and said it does not take part in immigration enforcement. More than half of Elgin's students identify as Latino. Heinrich told reporters that enrollment dipped and that students were afraid to come to class.

In October 2025 the college asked Flock to cancel the contract and remove the cameras. Heinrich said Flock turned the request down within a day, on the grounds that the company had not breached the agreement. In December 2025 the college offered to pay for the remaining five months of the contract if Flock would take the hardware down. Heinrich said it got no reply.

Staff then covered the cameras with black trash bags and zip ties. Heinrich said workers in an unmarked vehicle, which she assumed was Flock's, kept removing the covers during service visits, and the college kept putting them back. That went on until the contract ran out in April 2026, when Flock finally uninstalled the cameras. The college said its own audit found no sign that federal immigration agents had accessed its Flock data. Flock did not respond to WBEZ's request for comment.

Why It Matters

Elgin is a small case, but it sits inside a much larger network. A WBEZ review of contracts published on September 17, 2026 found that five of Illinois's 12 public universities still use Flock, and that together they have spent more than $450,000 on its services since 2021. The University of Illinois Chicago runs 15 cameras under a two-year, $110,300 contract, which works out to roughly $3,700 per camera per year. The University of Illinois Urbana-Champaign has 20 cameras and has paid more than $180,000 since 2021. Southern Illinois University Carbondale pays more than $40,000 a year for a Flock drone. WBEZ says more than 150,000 students at Illinois public universities now pass these cameras.

The scale of outside access is the part that should get the most attention. When WBEZ asked the University of Illinois System for a log of external searches, officials refused on the grounds that the request was too burdensome. Their explanation was that outside law enforcement had searched the system's Flock data more than 650,000 times in a single 30-day window in July and August. Public records gathered by surveillance researcher Torin Monahan and WBEZ show that camera data from Joliet Junior College, UIC and UIUC was searched dozens of times last year in connection with immigration enforcement, and that in some cases federal immigration authorities accessed it directly.

This matters beyond Illinois because colleges, cities, homeowners associations and retailers all buy the same product. Any organization that signs a Flock contract takes on the same three questions Elgin faced: who can turn the cameras off, who can search the data, and what happens when the organization changes its mind.

How It Works

The cameras. A Flock ALPR is a camera mounted on a pole at an entrance or along a road. It photographs every passing vehicle, not just suspect ones. Software reads the plate and also records the vehicle's make, model, color and features such as dents, roof racks and bumper stickers, which Flock markets as a vehicle "fingerprint." Each read is uploaded to Flock's cloud with a time and location, where authorized users can search it by full plate, partial plate or description. Reads are also checked against hotlists, such as stolen-vehicle records and Amber Alerts, and a match triggers an alert to police.

The contract. This is the detail Elgin ran into. Customers usually do not buy Flock hardware. They pay an annual subscription for cameras that Flock owns, installs and maintains. That keeps upfront costs low, but it also means the customer cannot legally remove equipment that belongs to someone else, and the contract term, not the customer's preference, decides when the cameras come down. Covering the lens was the only lever Elgin had. Flock says it will publish a plain-English, section-by-section guide to its standard contract.

The data. Flock's position is that hardware and data are owned by different parties. In its explainer on federal data access, the company says every plate read "is owned and controlled by the customer," that sharing with federal agencies is off by default, and that federal agencies are not part of its statewide or national lookup. Customers choose whether to share one-to-one with another agency, with a statewide pool or with Flock's national network. That is why a single campus's cameras can be searched hundreds of thousands of times by outside departments: each police agency that joins a shared pool can query the reads.

The safeguards. On August 13, 2026, Flock CEO Garrett Langley announced a set of changes after a run of misuse cases. They include:

A new default retention period of 7 days instead of 30, although existing customers may keep their current setting.
"Evidence Mode," which lets detectives move specific reads into longer-term storage for an active case.
Offense filters that let a city allow outside searches only for listed crimes, such as stolen cars or missing persons, and block immigration searches.
Mandatory case codes on every police search by the end of 2026. Emergency searches can skip the code but are flagged for review.
Automatic account lockouts when a user's search pattern looks abnormal.

The law. Illinois already limits how plate reader data can be shared. Public Act 103-0540, passed as House Bill 3326 and signed in August 2023, bars ALPR users from sharing data to investigate or enforce laws that allow detention based on immigration status or that interfere with health care, including abortion. In August 2025 the Illinois Secretary of State's office said Flock had broken that law by letting Customs and Border Protection search Illinois data during a pilot program. Flock's own timeline lists that CBP pilot as running from May 9 to August 24, 2025. The company says it no longer runs pilots with federal agencies.

What's Still Unknown

Several important points have not been confirmed. Flock has not publicly explained why it refused an early exit that came with full payment, or whether its standard contract lets public customers terminate for policy reasons. Nobody has confirmed who removed the trash bags: Heinrich said she assumed the workers were Flock's, but the company did not comment. It is also unclear how many Illinois campuses have moved to the 7-day retention default or turned on offense filtering, since existing customers are not required to change.

The broader legal question is open too. The Secretary of State found a violation in 2025, but the reporting does not say whether any penalty followed or how Illinois audits data shared through Flock's national lookup. UIC told WBEZ in September that it was negotiating a renewal. Joliet Junior College, whose contract renews in July 2027, said it reviews who can access its data.

Frequently Asked Questions

Why couldn't Elgin Community College just remove the Flock cameras?

The cameras belonged to Flock, not the college. Under Flock's subscription model the company owns, installs and maintains the hardware, and the customer pays for access. Taking down equipment owned by someone else during a contract could expose the college to legal claims. When Flock refused to end the agreement early, covering the lenses was the only option the college had until the contract expired in April 2026.

What data does a Flock license plate camera collect?

It photographs every vehicle that passes, then records the plate number, time and location along with make, model, color and visible features such as dents or bumper stickers. Those reads go to Flock's cloud, where authorized users can search them and where they are checked against hotlists like stolen-vehicle records. Over time, a vehicle's recorded movements can reveal a lot about where its driver lives, works and studies.

Who can search license plate data collected on a campus?

The customer, usually campus police, decides. Flock lets customers share reads with individual agencies, a statewide pool or a national network, or keep them private. Flock says federal sharing is off by default. Once a campus joins a shared pool, outside departments can query its cameras, which is how University of Illinois data was searched more than 650,000 times in 30 days.

How long does Flock keep license plate data?

It depends on the customer's setting. Flock's default was 30 days for nine years. On August 13, 2026, the company changed its recommended default to 7 days, but existing customers may keep their current retention period. A feature called Evidence Mode lets detectives keep specific reads longer when they relate to an active investigation, so some data can outlast the default.

Is it legal to share Illinois license plate data with immigration agents?

Generally no. Illinois Public Act 103-0540, signed in 2023, bars plate reader users from sharing data to investigate or enforce laws that allow detention based on immigration status or that restrict health care such as abortion. The Illinois Trust Act also limits cooperation with federal immigration enforcement. In 2025 the Secretary of State found that Customs and Border Protection had searched Illinois Flock data in violation of state law.

What did Flock change after the criticism?

In August 2026 Flock announced a 7-day default retention period, offense filters that can block immigration searches, mandatory case codes on police searches by the end of 2026, required audit tools, and automatic lockouts for suspicious search patterns. It also made multi-factor authentication mandatory and said in August 2025 that it would stop running pilots with federal agencies. Critics argue that because many changes are optional for existing customers, their effect depends on local choices.

What should a college check before signing a surveillance camera contract?

It should check who owns the hardware, whether the contract allows early termination for policy or community reasons, and what removal costs. On the data side, it should confirm the retention period, which outside agencies can search its cameras, whether offense filters are enabled, and whether search logs are published. Elgin's experience shows that these terms matter more than the sales pitch once priorities change.