retail lpr privacy
Last week, NBC Connecticut reported what shoppers across the country are starting to notice in their store parking lots: automated license plate reader (ALPR) cameras have arrived at Home Depot and Lowe’s. The stated goal is to deter theft and “boost public safety.” It’s a reasonable goal—retail crime is a real and growing issue, and one Connecticut Home Depot was hit for over $1,700 in merchandise in a single day this week.
But the choice of how a retailer deploys license plate technology matters just as much as the decision to deploy it at all. And right now, the dominant vendor in this space—Flock Safety—comes with a baggage trail that every retailer evaluating LPR should look at carefully.
The Vendor Question Home Depot and Lowe’s Aren’t Answering
The NBC piece is honest about a key detail: neither Home Depot nor Lowe’s has publicly identified its camera vendor. The article specifically names Flock Safety as the dominant player in the category and notes that Flock told reporters “only the organization that uses the cameras has access to them.”
That sounds reassuring. The problem is that throughout 2025, a series of investigations exposed how Flock data was reaching U.S. Immigration and Customs Enforcement (ICE) anyway—through what reporters called a “side door”:
- 404 Media (May 2025): Local police departments across the country had performed roughly 4,000 immigration-related searches in Flock’s network on behalf of ICE, even though ICE held no direct contract with Flock.
- San Francisco Standard (September 2025): SFPD allowed out-of-state officers to run 1.6 million unauthorized searches against the city’s surveillance data, including at least 19 explicitly tagged for ICE.
- University of Washington Center for Human Rights (October 2025): Washington State agencies were giving Border Patrol back-door access to Flock-collected data.
- NPR (February 2026): Cambridge, MA. Eugene, OR. Flagstaff, AZ. Charlottesville, VA. A growing number of cities have cancelled Flock contracts, with elected officials citing fears that local data is fueling a federal deportation dragnet.
Flock’s official position is that it does not contract with ICE and that customers control their own data. On paper, that’s true. But the way the data flows through the shared network — where one local agency can query plates captured by thousands of other deployments nationwide — doesn’t respect the on-paper boundary in practice. That gap between policy and reality is exactly what has eroded public trust in the platform.
Why This Matters Specifically for Home Depot and Lowe’s
Drive past any Home Depot or Lowe’s in Dallas, Houston, Los Angeles, Phoenix, Miami, or just about any major metro at 6:30 AM, and you’ll see something that has been part of American life for decades: day laborers waiting in the parking lot, hoping a contractor pulls up needing an extra set of hands on a framing crew, a landscaping job, a small remodel, or a tile install.
A significant share of those workers are immigrants—some documented, some not. They show up to do hard, honest, physical work. Home Depot and Lowe’s have, for decades, benefited directly from this informal labor economy. Every job those workers get translates into lumber, fasteners, tools, paint, drywall, and flooring sold inside the store that same morning. The contractor pulls up, picks up the labor, walks into the store, and fills a flatbed.
Now imagine you’re one of those workers—or one of those contractors—and you read in the news that the parking lot you stand in every morning is being scanned by a camera system that has been repeatedly documented to feed plate data, through indirect channels, to ICE.
You stop showing up.
The contractor who relied on you stops showing up.
And the store that used to be a hub for the small-job construction economy becomes a place those communities actively avoid. The chilling effect doesn’t only hit shoplifters. It hits the early-morning, working-class, cash-spending customer base that walks the aisles with a coffee in hand and leaves with $300 in two-by-fours.
If theft prevention were the genuine intent, then picking a vendor whose name appears in ACLU reports, federal surveillance investigations, and city council cancellation votes is—charitably—an own goal.
What a Privacy-First LPR Actually Looks Like
This is exactly what PLACA.AI was built around. Our LPR platform serves neighborhoods and HOA communities as a primary use case—environments where the misuse of plate data could expose residents’ daily routines, their children’s school runs, and the contractors, caregivers, and visitors they invite into their homes. That product DNA — built around protecting the people inside the perimeter, not surveilling the people who pass through it — shapes how we deploy everywhere else, including retail.
Concretely, that means:
Customer-controlled data, no shared national lookup pool. Plates captured at your location stay in your tenancy. We don’t operate a nationwide query network where another retailer, sheriff, or out-of-state officer can search your parking lot data on demand. There is simply no shared search layer for any third party to exploit.
No proactive law enforcement marketing. We don’t sell “police access” as a feature. We don’t run federal pilot programs. We don’t have a self-service portal that 5,000+ agencies can log into. Like every U.S. company, we comply with valid judicial process directed at us — but responding to a specific subpoena under judicial review is fundamentally different from running an always-on, self-service search portal that thousands of agencies can query at will.
Short, configurable retention. The longer plate data is held, the more useful it becomes for purposes that have nothing to do with theft prevention. Our default retention windows align with the newer state laws—including the LPR retention bill Connecticut Governor Lamont just signed—that limit how long ALPR data can be stored.
Theft is a vehicle problem, not a community problem. Catching the same Ford F-150 that hit four Home Depots in a week is exactly what LPR is genuinely good at. You don’t need a 5,000-agency surveillance network to do that. You need targeted alerts on plates already tied to documented incidents at your stores. That’s the product. That’s the entire product. Anything beyond that isn’t theft prevention — it’s mass surveillance with a theft-prevention business case stapled to it.
The Bottom Line for Retailers
Theft prevention and customer trust are not opposing values. You can have both. But you cannot have both if your camera vendor is the subject of a city council cancellation vote in one news cycle and the rollout press release for your stores in the next.
Home Depot and Lowe’s still have time to reconsider. So does every other retailer in the middle of an LPR rollout right now. The question to ask the vendor is no longer “Can you catch a thief?”—every modern LPR can. The real questions are:
- Where does our captured data physically go, and who controls it?
- Who else can search it — and through what mechanism?
- What does the audit log look like, and can we see it in real time?
- What happens when an out-of-state agency, or a federal one, asks for a lookup?
- How long is the data retained by default, and can we shorten it?
If the answers don’t match the privacy promise on the in-store signage, the camera is doing more than reading plates. It is quietly converting paying customers into a searchable database that follows them out of the parking lot. And that is a problem no amount of theft recovery can offset.
If you’re a retailer, a property manager, or a municipality thinking seriously about this trade-off, talk to us at placa.ai. We’d rather have the conversation about how to deploy LPR responsibly now than read about another contract cancellation in next month’s headlines.