Flock cameras in Oregon: who reads your license plate, and who can search it?

There's a small black camera on a pole near an intersection you drive through. Somebody has probably told you it's a Flock camera, and that Oregon is covered in them now.

If you've heard anything else about it, you've heard one of two things: that it's just a tool for finding stolen cars, or that ICE is watching your neighborhood through it.

Neither of those is the useful answer.

The useful answer came out of Woodburn, Oregon, and it isn't a rumor or an advocacy estimate. It's the city's own audit of its own camera network, published by the city, with the numbers in it. What that audit shows is that the question most people ask about these cameras — do I trust my local police department? — is the wrong question.

Oregon also passed a law about this in 2026. It changed real things, and it left real seams. Here's what the cameras collect, what the audit found, what the law does, and the two documents you can go read about your own town today.

What is a plate reader actually doing?

The technology is called ALPR — automated license plate recognition. Oregon's new law defines it as "one or more high-speed cameras combined with computer algorithms used to convert images of license plates or other vehicle characteristics into computer-readable data" (SB 1516, section 3). Flock Safety is the vendor behind the Oregon deployments people argue about — the ACLU of Oregon counts at least 15 police and sheriff departments in the state with active Flock contracts (Know Your Tech: Flock) — which is why "Flock camera" has become the shorthand for the whole category.

What it records is broader than a plate number. The same section defines the captured data as the GPS coordinates, date and time, video, photograph, license plate number, vehicle characteristics, "or any other related data or information collected."

So it's a timestamped, geolocated record of your car being in a specific place. Not a photo of your face. Not a speeding ticket either — the statute specifically carves photo red light cameras and photo radar out of the definition, because those are a different system doing a different job.

One camera capturing your car once is close to meaningless. That's not the model. The model is a lot of cameras, retained for a window of time, searchable.

Is your local police department the thing to worry about?

This is the question almost everyone asks first, and it's fair. It's also, based on the only Oregon audit we have, aimed at the wrong target.

Woodburn ran Flock cameras for most of 2025 and then shut them off. The city published a public question-and-answer document with the audit results in it. Over the search period of January 15 to November 13, 2025, 3,318,618 searches were run against Woodburn's camera network by 4,734 law enforcement agencies, Woodburn's own department included (City of Woodburn, Flock Q&A).

Read the split. Non-federal Oregon agencies, including Woodburn itself, accounted for 0.78% of those searches. Non-federal out-of-state agencies accounted for 99.04%.

And 99.99% of the searches weren't looking at Woodburn specifically. They were cross-searching many agencies' networks at once. Only 306 of the 3.3 million searches uniquely targeted Woodburn, and all 306 came from three Oregon departments.

That's the thing to understand about this technology, and it has almost nothing to do with your city council's intentions. Your town buys cameras. The cameras join a national network. Thousands of agencies you have never heard of, in states whose laws you have no say in, can sweep that network in a single query.

Did federal immigration agencies search Oregon cameras?

Yes. The city's own answer is narrower and more precise than the headlines were, and the precision matters.

The same Woodburn Q&A says that in 2025 Flock "granted broad search capabilities to federal agencies during a trial period." Homeland Security Investigations ran 175 searches and U.S. Border Patrol ran 209 that included Woodburn's network — not aimed at Woodburn, but sweeping it along with many others. The document states that no federal agency searches occurred after June 24, 2025, and that Woodburn's police department was never notified the federal pilot existed. Once the department learned of it, on or around October 23, 2025, the national lookup feature was disabled.

On the specific question of immigration as a stated search reason, the city's answer is careful, and worth repeating in full rather than flattening: several out-of-state non-federal agencies did search "immigration" across a wide variety of networks, none of those searches were exclusive to Woodburn, and from the data available none of them returned results on Woodburn's network.

Woodburn ended officer access on November 11, 2025 and mechanically deactivated the cameras on November 13. The contract ran out the following spring and the hardware came down (The Oregonian). Eugene got there first — its city council voted in October 2025 to switch the cameras off (KLCC) and the department ended the contract that December, as did Springfield (OPB).

What did Oregon's new law actually change?

Senate Bill 1516 is Oregon's first real ALPR statute. The enrolled bill records passage by the Senate on February 20 and by the House on March 5, 2026, and closes with an emergency clause: the Act "takes effect on its passage," meaning on the Governor's signature rather than the usual delay. The legislature's own record for the measure lists it as chapter 77 of the 2026 session laws (SB 1516 measure history). It has been in force since spring 2026.

The structure is a default prohibition with holes cut in it. Section 4 opens by saying a law enforcement agency "may not use an automated license plate recognition system or captured license plate data," then lists the purposes that are allowed: investigating a crime, a vehicle tied to an outstanding arrest warrant, a missing or endangered person, an uninsured or unregistered vehicle, parking, and access control to secured areas. Traffic violations are explicitly excluded.

The provisions that matter most for the network problem above:

Retention is capped at 30 days for data not tied to a court proceeding or an ongoing criminal investigation.
Every search must be logged with the searcher's identifier, their agency, the inputs used, the date and time, a case number where applicable, and the stated law enforcement purpose.
Sharing outside Oregon is restricted. Under section 5, an agency may not give access to a government entity not created under Oregon law, except for a specific law enforcement purpose — and that data "must be limited to data relevant to the law enforcement purpose and may not include unrestricted or ongoing access." The agency has to log which outside entity the search was for, and how many cameras it touched.
The vendor is fenced off from the data. Section 9 says a vendor "may not access, disclose, sell, share or otherwise use" the captured data, apart from consented technical support and producing audits. If a vendor breaks that intentionally or with gross negligence, an individual can sue for damages and a court may award attorney fees.

Notice what that last one is and isn't. The private right of action runs against the vendor, not against the police agency.

Does the law ban immigration enforcement use?

Not in those words, and the difference is worth being precise about.

SB 1516 gets there indirectly. Section 4 permits ALPR use for a federal crime only where that use "is not contrary to the public policies set forth in ORS 24.500 or any law of this state restricting the use of public resources for prohibited enforcement activities," and it names Oregon's sanctuary statutes specifically. So the limit is real, but it's inherited from Oregon's sanctuary law rather than written as a standalone ban.

Some agencies have said it plainly in their own policy. Portland Police Bureau's ALPR directive, effective April 2, 2026, states that members "shall not use ALPR systems or data to conduct or assist with immigration enforcement investigations or operations, unless required by law" (PPB Directive 0625.00). That same directive sets Portland's retention at 30 days for non-investigative reads and two years for investigative ones, and requires the program manager to produce an annual report covering plate reads, recoveries, notable cases, and any known misuse.

This is Oregon-specific and it is current as of this writing. Policies get revised and statutes get amended, so check the linked pages rather than trusting a date on an article.

What does the law give you that you can actually use?

Here's the part almost no coverage mentions, and it's the reason this article exists.

Agencies have to publish a policy before they turn the cameras on. Section 7 requires a law enforcement agency, before deploying ALPR, to establish and publish policies covering system security, hot list accuracy, user training, retention and destruction, vendor contract terms, and audits. Portland's directive is exactly that document. If you go looking for your agency's and can't find one, that absence is itself information worth taking to a council meeting.

Agencies have to publish audits, and the audits include where the cameras are. Section 6 requires the vendor to hand the agency a monthly audit listing the number of systems installed, the location of every fixed camera, the number of searches run, every agency with access, the number of authorized users, unique vehicles captured, and alerts generated. There's a quarterly audit too, covering searches run on behalf of outside government entities. The agency then has two days to publish those results on its website — or to require the vendor to give the public direct access.

SB 1516 also amended Oregon's public records law. The plate data itself is exempt from disclosure, but the same amendment says audit contents must be disclosed once personally identifying information is stripped out.

Put those together and the practical answer to "are there cameras near me" is no longer a guess or a crowdsourced map. Your agency is supposed to be publishing the locations, monthly.

Where are the seams?

Two, and they're both in the text.

Section 8 grandfathers existing deals. An agency already running ALPR under a vendor contract signed before the law took effect can keep operating under that contract's terms for its duration. It can't extend, renew, or sign a new one without complying. The use limits in section 4 apply either way, but the contract terms — the parts governing what the vendor may do — ride out the old agreement.

And as noted above, when a vendor mishandles data, the remedy the statute creates points at the vendor. If your concern is the 4,734-agency network rather than any single company's conduct, the lever there is procurement, not litigation. Which is precisely the lever Eugene, Springfield, and Woodburn used.

Why should our community care?

Because a plate read is not a search of you, and that's the point. It's a record of where your car was, pooled with everyone else's, sitting in a system that thousands of agencies can query at once. Nobody has to suspect you of anything for your movements to end up in it.

That matters more if your life involves showing up places. A clinic. A mosque or a synagogue. A union hall. A mutual aid distribution. A friend's house at 2am because they called you. None of that is illegal anywhere, and all of it is legible as a pattern to anyone who can search where your car has been.

This is the same threat model as the rest of our surveillance coverage, one layer out. Cell-site simulators sweep up the phones near them. Faraday bags address a phone that's broadcasting. Neither does one thing for your license plate, which is bolted to your car by law and readable by anyone. Don't let a good phone habit convince you you've solved a problem you haven't touched.

And the pattern underneath is the one we wrote about when the Pentagon went looking for AI without surveillance limits: the collection gets built for one stated reason, and the question of who else gets to query it turns up afterward.

What can you actually do?

Concrete, in order of effort.

Search for your agency's published ALPR policy. City police, county sheriff, and the state police are three different agencies with three different answers — check the one that patrols where you actually drive.
Look for the published audit. It's supposed to be on the agency's site or reachable through the vendor, refreshed monthly, and it's supposed to list fixed camera locations. If it isn't there, that's a specific, answerable question for a public comment period.
Ask before it's bought. The decision point is a council vote on a contract, not the day a pole goes up. The ACLU of Oregon's Know Your Tech page, linked above, tracks which departments in the state have signed one.
Adjust your expectations, not your license plate. In Oregon, a plate counts as illegally altered if it "has been altered, modified, covered or obscured in any manner," and the statute spells that out to include any material or covering placed on, over or in front of the plate, and any frame that renders the numbers unreadable. The same section makes the offense "a Class B traffic violation" (ORS 803.550). So the sprays and covers marketed for this buy you a traffic stop, which is the exact contact you were trying to avoid. This is a policy problem with a policy solution.

The short version

A plate reader records where your car was, when, with a photo. Oregon's SB 1516 caps retention at 30 days for most of that data, requires a logged purpose for every search, limits what can be handed to out-of-state and federal agencies, and lets you sue a vendor that misuses the data.

The risk was never mainly your own department. Woodburn's audit counted 3.3 million searches of its cameras by 4,734 agencies in ten months, 99% of them from out of state.

The law's most useful gift to you is paperwork: your agency must publish its ALPR policy before deploying, and must publish a monthly audit that includes where the fixed cameras are. Go read your town's.

If you're thinking about your safety in broader terms than a phone and a car, that's the conversation our training parties are built around — starting from your actual situation rather than someone else's.

Frequently asked questions

Is this facial recognition? Not as Oregon regulates it. What SB 1516 defines and governs is a system that converts images of license plates and vehicle characteristics into computer-readable data — the thing being identified is the vehicle, not the driver. That's a statement about what the law covers, though, not a technical guarantee about any particular vendor's hardware or what it might be sold as doing later. The audit your agency has to publish is where you'd look for that.

Can police pull me over just because the camera flagged my car? Not on the alert alone. SB 1516 requires the officer to visually confirm that the plate number, issuing state, and vehicle characteristics actually match the alert before making the stop.

Is the plate data a public record I can request? The captured data itself is exempt from disclosure under the public records amendment SB 1516 made. The audits are a different story — those must be released with personal identifying information removed.

How long is the data kept? Under SB 1516, no more than 30 days if it isn't tied to a court proceeding or an ongoing criminal investigation. Individual agency policy can be stricter or can set a longer window for investigative material — Portland's directive uses two years for investigative reads.