Who Is Watching the Dispensary Parking Lot?
Drive to a dispensary in most American cities and you will pass three or four license plate readers before you arrive. One at the pharmacy. One at the bank. One at the hardware store, mounted on a pole at the edge of the customer lot, about the height of a stop sign, gray, solar panel on top, entirely unremarkable. No sign tells you it is there. In fact, most states don’t require a notice at all.
Then you park. The camera at the entrance to the dispensary lot looks exactly like the one at the hardware store. Same pole, same gray housing, same company. The difference is not visible from the parking space. That one is there because a state agency wrote a rule requiring it, with specified coverage, specified retention, and specified access.
I ran one of those agencies.
We wrote rules requiring licensees to install cameras covering entrances, points of sale, storage, and virtually everywhere else, to keep the recordings, and to make them available to the Commission on request. There was some logic to it, even if it was a bit overkill. The question in 2018 was public safety and diversion, whether product was leaving through the back door, or a safe full of cash was at risk. Cameras answer that question well. Nobody was asking in 2018 what a searchable national network would eventually do with ninety days of footage, because there was not one yet.
So the only camera on that whole trip that a government affirmatively demanded is the one pointed at people buying cannabis. Not the pharmacy, where the merchandise is more dangerous. Not the bank, where the money sits in bulk. Every state that has legalized has said, in its own regulations, that this is the errand worth recording.
We spent ten years arguing that buying cannabis was ordinary, and we wrote the opposite into the code.
That has been sitting with me as news has emerged out of Wisconsin about a criminal complaint.
On April 26th of last year, a Brown County deputy received an alert on a vehicle registered to Edward Abrams-Phillips, who was wanted on a felony warrant connected to a domestic violence case. Deputies could not find the car, so they followed it through the camera network instead. It hit a reader on Highway 41, another at County Line in Marinette, and a third crossing into Michigan. At 3:56 that afternoon it came back south toward Green Bay, and deputies were waiting.
The complaint explains what the deputy made of the trip. "Based on prior flock hits, the vehicle travels to Michigan frequently which is a known source State for Marijuana as it is legal there."
The stop had other grounds, including the warrant, and the search rested on an officer's claim that he smelled raw cannabis after the driver declined to consent. Deputies found a grinder, a jar with residue, two resealable bags, and a pre-roll. Eight and a quarter grams. With it was a receipt in his name from the Nirvana Center in Menominee, Michigan, where every item on it was purchased legally. The bail-jumping count was dismissed. He was eventually convicted of possessing marijuana.
He is a poor mascot for anything and this argument does not need him to be otherwise. He bought the cannabis legally in Michigan. A Wisconsin deputy treated the trips themselves as grounds for suspicion, and the only reason the deputy knew about the trips was a camera network that nobody in either state ever voted for.
Legalization is territorial. Every version voters or legislators have ever approved stops at their state line, because that is where their authority stops. Michigan decided what would be lawful on Michigan ground, and nothing in that decision follows a person off it. Menominee sits on the Michigan bank of the river and Marinette sits on the Wisconsin bank, and the dispensary economy along that stretch of the Upper Peninsula exists because of the borders. Everybody involved understood the arrangement. A Wisconsin resident could drive across, buy legally, and carry their own risk home. For six years it worked the way border commerce has always worked, on the general understanding that nobody was keeping a list, or surveilling.
Somebody is keeping a list now, and it reaches communities in 49 states.
“That is how a chilling effect works, and it never turns up in an enforcement statistic, because it works on the people who stay home.”
I cannot prove this next part, and nobody has measured it. The cost lands on the person in Marinette who reads about that conviction and decides not to make the drive next month, on the patient who does not sign up for the medical program in a state where the registry is a government list and the parking lot has a camera on it, and on the customer who keeps buying from the guy he has always bought from, in cash, because the legal store leaves a record he cannot see, held by a company he did not choose, searchable by departments he will never hear from.
Nothing has to happen to any of them. That is how a chilling effect works, and it never turns up in an enforcement statistic, because it works on the people who stay home.
And it lands harder here than anywhere else, because cannabis is the only thing on that drive that people went to prison for buying. Everyone in this business knows somebody with a record for it. Legalization was supposed to mean the surveillance ended, that walking into a licensed store made the purchase nobody's business. Legal markets already compete against legacy operators on price and convenience and lose routinely. Now they compete on privacy and lose there too, which is a strange outcome for the option the state licensed, inspected, and taxed.
In fairness, nobody planned this. No one sat down and designed it. It has developed gradually.
The cameras at the pharmacy and the hardware store went up because a vendor made it easy and because organized crime rings really do hit the same stores in the same vehicles across a metro area, which is why the tool reads plates instead of watching aisles. Home Depot says its readers are there to prevent theft and to protect customers and employees, and there is no reason to doubt that is why they were installed. A regional manager signed a contract. The company that operates the network says the data belongs to the business and that sharing with police is off by default. It is also true that when a Connecticut newsroom pulled the records this spring, Lowe's and Home Depot locations were giving local departments access to their lots' databases, some under written agreements providing continuous, ongoing access. California supposedly has the strongest law in the country governing private plate readers, and what it requires is that the operator post a usage and privacy policy conspicuously on its website. Not at the lot. Not where you park. To a website you’ve never visited.
One state saw this coming.
Illinois wrote the strongest plate reader privacy law in the country, the first anywhere to prohibit sharing data with out-of-state police for reproductive health or immigration enforcement. Last May, a Johnson County, Texas deputy ran two searches of the network, the second reaching 6,809 networks and 83,345 cameras, with the stated reason recorded on both as a woman having had an abortion. The sheriff's office and the company have called it a “welfare check” for a missing person. Records later obtained by the Electronic Frontier Foundation describe deputies opening a death investigation and consulting prosecutors about charges. Both searches carried the same case number as the death investigation. Illinois cameras were accessed as part of that search.
The Illinois statute carries no penalty provision. The prohibition existed, the query ran, and the state found out from reporters. Texas, where the officer physically sat, has no plate reader statute at all. The only reason there is any record of the search is that the company keeps an audit log, which is a product feature rather than a legal obligation. If a company's engineering choices decide whether your statute is enforceable, can you really call it privacy?
That vendor made some decisions this week.
Flock announced it will cut standard retention from thirty days to seven, require a case number from the agency's records system on every search, mandate an audit tool that locks out users showing abnormal search behavior, and let customers choose which offense types outside agencies may search their cameras for. Optional becomes mandatory January 1st.
These are real improvements and they are stronger than anything pending in Michigan, where pending legislation would set retention at fourteen days and a bipartisan House package has languished in committee since late January. A company under pressure moved faster and further than the legislatures confronting the same questions. Bureaucracy is not often known for being nimble.
It should embarrass all of us that it took a product announcement.
Run that Wisconsin search from earlier through these new rules, though. It passes. The search was near real-time, so a seven-day retention window changes nothing. It was attached to a live felony warrant, so there was a case number to type.
The changes were built against the scandals, the officers looking up ex-girlfriends and the Texas query, and they address those. Wisconsin is not a scandal. When a deputy watches a car cross into a legal state and draws his own conclusion about what the driver bought there, the system is working exactly as designed. No audit tool will ever flag that.
So go back to the parking lot.
In Madison Heights, outside Detroit, JARS Cannabis was required to install a plate reader at the entrance to its customer lot and give the police department unhindered live access to the camera, the footage, and any and all data it collects. That is not based on any rule. Arctic Fox LLC applied for a license in August of 2022, was denied, and sued. The council rejected a settlement in November of 2023 by a vote of four to three, then approved one in January 2024, when a single member changed his vote. The package included $175,000 up front, $25,000 a year to a community fund, one percent of net profits, and the camera. Late last month JARS mounted a sign reading NO FLOCK ZONE in front of the lens. The company says the city answered with a demand letter giving it forty-eight hours to take the sign down. So the sign came down.
Other states got there first, by rule. Nevada requires that cameras covering entrances, vaults, and points of sale be capable of remote access by a law enforcement agency in real time upon request, a right that exists independently of the Cannabis Compliance Board. Missouri reads much the same. Illinois names the agency outright, giving the Illinois State Police a round-the-clock portal into licensee cameras, written into the administrative code. El Monte, California requires licensees to provide the police department twenty-four-hour live-stream access by name.
Across twenty-seven state codes, not one conditions police access to cannabis surveillance footage on a warrant. One state wrote an exception, and it is a narrow one. Massachusetts requires that footage from delivery drivers' body cameras go to law enforcement only under a court order or search warrant demonstrating probable cause, and that it be destroyed after thirty days.
The reasoning was about doorsteps. A delivery camera arrives at a home, and what it picks up of who answers and what is behind them is not what a retail transaction puts on display. We understood that a camera pointed at private life earns a higher standard than a camera pointed at a retail sales floor, and distinguished.
That principle is sound, and it reaches further than delivery. A doorstep camera catches one moment at one address. A plate reader network reconstructs where a person has been for weeks, which is a good deal more of somebody's private life than any delivery driver ever sees.
We can still go back.
Every state that licenses cannabis already tells licensees what to record, how long to keep it, and what to produce on request. That authority runs to the business rather than to the police, which is exactly what let Massachusetts impose a warrant standard on delivery footage without legislating about law enforcement at all. The regulation tells a licensee what it may hand over and on what showing, and nothing in that mechanism is peculiar to delivery. It would work for the camera at the entrance to a parking lot, the one whose entire output is a record of who came and when, and it would work in Nevada, where the rule currently points the other way.
“Somebody just has to decide, out loud, what a picture of a perfectly legal errand is worth and how long it deserves to last.”
That is rulemaking rather than legislating. It requires no session, no legislative sponsor, and no floor vote. The rule can be lifted from Massachusetts with ease. A rule like that reaches the licensee and stops there. It cannot tell a Wisconsin deputy what he may conclude from a travel pattern, and it cannot keep Illinois cameras from answering a Texas query. Those do take a legislature, and two states have already written them. Washington provides that a positive match alone does not amount to reasonable suspicion, which is the sentence the Wisconsin complaint needed and did not have. Virginia bans sharing into another state's database outright, which is the only provision anywhere that would have stopped the Texas search at the keyboard.
None of that eliminates a camera. Somebody just has to decide, out loud, what a picture of a perfectly legal errand is worth and how long it deserves to last.
I helped build some of this. We required security cameras and I would probably still require many of them today. That call was right on what we knew in 2018, and what we know now is different. The rule was written when a licensee's footage sat on a hard drive in a back office, or somewhere in the cloud, before anybody had built the thing that makes a record like that worth searching from a different time zone. Leaving it there now would be stubborn. Addressing it costs redlining a Word document.
Somebody is pulling into a dispensary lot right now, in a state where every part of what they are about to do is legal. They voted for that, or their neighbors did, and what they were promised was that this would finally stop being anybody's business.
Nobody asked whether the promise came with a record of the trip. Nobody had to. That record exists because of a condition in a license, a term in a settlement, and a line in a security contract, and not one of those documents had a checkbox for the customer's consent.
Links and Resources:
Court Records & Criminal Filings
404 Media. Cops Used Flock to Track a Man Across State Lines to Create Pretext to Search His Car for Weed, the Brown County criminal complaint and court records. August 2026. First to report the case.
State of Wisconsin v. Edward Abrams-Phillips, Brown County Circuit Court. Criminal complaint and disposition, available through the Wisconsin Circuit Court Access system.
Electronic Frontier Foundation. Flock Safety and Texas Sheriff Claimed License Plate Search Was for a Missing Person. It Was an Abortion Investigation., search logs, incident report, and the detective's sworn affidavit obtained by public records request. October 2025. EFF is an advocacy organization and obtained the records.
Electronic Frontier Foundation. She Got an Abortion. So a Texas Cop Used 83,000 Cameras to Track Her Down, initial documentation of the Johnson County searches. May 2025.
News Coverage
Associated Press. Amid Public Backlash, Surveillance Tech Company Flock Announces Platform Changes, the retention, case-number, and audit changes announced by CEO Garrett Langley. August 13, 2026. Also carried here.
C&G Newspapers. City Council Rejects Settlement Offers in Marijuana Lawsuits, contemporaneous reporting on the November 2023 vote, including the Flock installation and police access terms. Madison Heights, Mich., November 2023.
C&G Newspapers. Madison Heights Council Reverses Course on Cannabis Licenses, the January 22 settlement approval, the deciding vote, and the payment terms. Madison Heights, Mich., 2024.
WXYZ Detroit. 'No Flock Zone' Controversy Brewing Over Flock Camera at Madison Heights Dispensary, the sign, the company's statement, and the demand letter. Detroit, Mich., August 2026. The demand letter is described in JARS' own statement and has not been independently confirmed.
GovTech. Retailers Say They Use Flock Safety Tech Responsibly, records showing Lowe's and Home Depot locations granting local police access, and retailer refusals of third-party audits. June 2026.
Fox News. Home Depot, Lowe's Parking Lots Now Scan Your License Plate in Connecticut, carrying Home Depot's statement on purpose and federal access. May 2026.
Carscoops. Police Plate Readers Follow Public Rules, Retailer Plate Readers Don't, on the transparency gap between public and private deployments. May 2026.
The Gander. Your Trip to a Michigan Dispensary Could Be Logged in a Police Database, Michigan agency counts and the Kalamazoo audit-log findings. August 2026.
High Times. Flock Cameras and Cannabis: Police Are Tracking Trips to Legal Weed States, cannabis-sector framing of both cases. August 2026. Trade press.
ABC7 Chicago. License Plate Reader Camera Legislation to Protect Those Traveling to Illinois Abortion Clinics, Immigration Status, on passage of the Illinois restrictions and Secretary Giannoulias' rationale. Chicago, Ill., 2023.
Statutes & Regulations
Illinois General Assembly. 625 ILCS 5/2-130, user of automated license plate readers and prohibitions, including the bar on sharing for immigration or reproductive health care enforcement. Annotated version here.
Massachusetts Cannabis Control Commission. 935 CMR 500.110, security requirements for marijuana establishments, including the ninety-day retention rule and the delivery body camera warrant standard at 500.110(8)(b).
California Civil Code. § 1798.90.51 and § 1798.90.53, obligations of ALPR operators and end users, including the requirement that a usage and privacy policy be posted on the operator's website.
Washington State Legislature. Senate Bill Report, ESSB 6002, the Driver Privacy Act as amended, covering the twenty-one-day deletion requirement, the probable cause warrant for privately held ALPR data, sensitive-location restrictions, and penalties. Chapter 239, Laws of 2026. Registration requirements at the Washington Attorney General.
Company Statements
Flock Safety. Trust Center and Myths and Facts, the company's positions on data ownership, default sharing settings, and audit logging. The company is the subject of this piece.
Flock Safety. What Does Washington Senate Bill 6002 Mean for ALPR Use in Washington, the vendor's compliance guidance. April 2026. Vendor-authored
From Policy, Decoded
How to Be Heard, our guide to writing a comment that works, free with five referrals of Policy, Decoded.
Cannabis and hemp comment deadlines and effective dates, tracked daily at homegrown-group.com/deadlines.
