Law enforcement agencies from all 50 states and federal bodies including the ATF searched Palo Alto's license plate reader data for roughly 18 months without the city's permission or the Palo Alto Police Department's knowledge, according to a KQED investigation published Aug. 20.

The breach of California law, which has prohibited sharing automated license plate reader data with out-of-state and federal agencies since 2016, came to light after Palo Alto Weekly reporter Riley Cooke obtained thousands of pages of search audit logs through a public records request in March.

"Flock was still able to bypass those without telling anybody," Cooke told KQED. "They didn't tell the police department, they didn't tell city officials, they just quietly rolled out this nationwide data-sharing effort, which completely went past local and California regulations."

PAPD told Cooke the department never accessed or downloaded any out-of-state data. But Palo Alto's cameras still appeared in search results run by agencies in Mississippi, Illinois and dozens of other states. Flock Safety had quietly enabled a national lookup feature that made the data discoverable without notifying the city.

The fallout has been swift. PAPD has published license plate search logs on its website since Cooke's reporting, a transparency step Cooke said he's not aware any other city has taken. The city has also hired the OIR Group, a consulting firm that previously pushed PAPD to standardize body camera use, to conduct an independent audit of the Flock contract.

The City Council is scheduled to define the scope of that audit at its Monday, Aug. 24 meeting, KQED reported. City spokesperson Meghan Horrigan-Taylor said Palo Alto is negotiating with Flock over contract language to tighten the company's data-security obligations, and the department remains open to other vendors. She said the city has received no federal request for plate data in 2026.

Palo Alto's contract with Flock runs through December 2029, and all 30 cameras remain active. Hundreds of residents have packed recent council meetings to protest the contract and urge the city to follow neighboring jurisdictions that have terminated their Flock agreements. As of August 2026, at least 82 localities across 28 states have ended or rejected Flock contracts.

Stanford University ended its own Flock contract in late July and switched to Genetec Cloudrunner, KQED reported, a system Stanford vice provost Patrick Dunkley described in a Stanford News announcement published Aug. 3 as "designed for use within a single institution," unlike Flock's shared national network. A San Mateo County Civil Grand Jury report released Aug. 3 found that 16 of the county's 20 ALPR operators had shared license plate data with private university security forces, including agencies serving Stanford and the University of the Pacific.

Flock Safety announced policy changes on Aug. 13, including shortening its recommended data retention window from 30 to seven days and requiring all law enforcement customers to use its audit tool by year-end. The company has also disabled its national lookup feature for California agencies and blocked out-of-state discoverability, according to GovTech.

The Aug. 24 council meeting will determine whether the OIR audit examines only PAPD's use of the system or extends to Flock's own data-handling practices.