Two federal bills on automated license plate readers (ALPRs) arrived within three days of each other. On September 30, Sen. Josh Hawley (R-MO) unveiled the Stop Flock Abuse Act. According to The Record, Sens. Bernie Sanders (D-VT) and Jeff Merkley (D-OR) and Rep. Alexandria Ocasio-Cortez (D-NY) followed on Friday with a broader bill. It would bar federal use of ALPRs, cut federal funding to states that deploy them, and let people sue the federal government if their rights are violated. The overlap is striking, but the two bills rest on different theories of the problem, and only one of them is proportionate.
The strongest case for the harder line
The argument for going further than regulation is serious. ALPR networks turn a person's movements into a searchable database without any individualized suspicion. The Supreme Court recognized the danger of that pattern in Carpenter v. United States (June 22, 2018). It held that acquiring historical cell-site location records is a Fourth Amendment search requiring a warrant, because such records expose "the privacies of life." Plate-reader data is not identical to cell-site data, but a dense camera network can reconstruct a person's routine in much the same way.
The abuse record gives the argument weight. KCUR reports cases that include five Indianapolis officers charged with stalking, a Texas jury finding that traffic stops enabled by ALPR data were unconstitutional, and a Kansas journalist tracked after criticizing local police. CBS News reports that a Senate Judiciary subcommittee hearing featured a woman who was wrongfully jailed after Flock technology misidentified her vehicle. Executives from Flock, Axon, Motorola and Verkada declined to testify. If a vendor will not explain its systems to Congress, the case for stronger oversight is easy to make.
What the Hawley bill actually does
Per Hawley's announcement, the Stop Flock Abuse Act would:
- ban selling or sharing vehicle location data with non-governmental third parties;
- require written approval and audit logs for searches;
- require encryption and U.S.-only storage;
- require deletion of driver data after ten days, absent an active investigation;
- bar facial-recognition integration and hardware or software from foreign adversaries.
These rules govern the data rather than the camera. The key design choice is the retention limit. A camera that flags a stolen vehicle or an AMBER Alert match needs its data for minutes or days, not months. The ten-day window keeps the real-time public safety function. It also removes the long-tail archive that makes retrospective tracking of ordinary people possible. Missouri's governor has already moved in this direction. KCUR reports that Gov. Mike Kehoe's September executive order requires 30-day deletion, which is looser than Hawley's proposal.
Written approval and audit logs address the most common failure documented so far, which is not the technology but individual misuse. The Indianapolis and Kansas cases involved insiders searching for personal or retaliatory reasons. Logged, supervisor-reviewed searches are a direct, testable response to that.
The bill has a gap. Reports on it describe a prohibition on vendor data sales and rules for how agencies search, but a retention limit is only as good as its enforcement. Public reporting does not describe a private right of action or an independent deletion audit. Congress should add verifiable deletion, because a promise to delete is easy to make and hard to check.
Why the federal-ban approach overreaches
As The Record describes it, the Sanders–Merkley–Ocasio-Cortez bill would block federal ALPR use, withhold federal funding from states that deploy the cameras, and create a right to sue the federal government. Its political logic is clear. Sanders's statement frames Flock as a handful of "AI oligarchs" profiting from tracking Americans, and the bill would reach every ALPR vendor, including Motorola and Axon.
The weakness is the funding lever. ALPR deployment is overwhelmingly a local decision. Flock says its network is about 120,000 cameras across 49 states, and the great majority sit with municipal police and homeowners' associations rather than federal agencies. Cutting federal money to states that deploy them is a blunt instrument. It penalizes states that adopt their own guardrails, as Missouri just did, in the same way as states that do nothing. A state that cuts retention to ten days and requires audit logs would be treated no better than one with an open-ended database. That removes the incentive to build the safeguards the Hawley bill demands.
The private right of action against the federal government is more defensible, but it addresses only federal conduct. It does little about the local deployments where the documented abuses occurred.
A workable middle
The pairing of these bills is useful if lawmakers combine them. Hawley's data-lifecycle rules (short retention, no resale, no facial recognition, logged searches) could form the baseline. A narrow warrant requirement for searches beyond the retention window, and a private remedy for violations, could be added from the Sanders approach without cutting funds. Even Flock's CEO told CBS that effective frameworks should preserve law enforcement's ability to use the tool "while requiring accountability, oversight and responsible data practices." That is a low bar, and it is one the industry has so far not met voluntarily.
A proportionate regime treats ALPRs as what they are, a useful tool for narrow public safety tasks that becomes dangerous when it is retained, resold and searched without limits. Rules that fix those three things deserve support. A funding cutoff aimed at the whole category does not.