An entire vendor ecosystem is now selling AI cameras and automated license plate readers into apartment communities, and the purchase has quietly become a data decision. AI video surveillance was a $6.3 billion industry in 2025 and is projected to reach nearly $27 billion by 2034, per market research cited by Bisnow. The question most owners have not worked through is narrower than whether to install cameras: when the camera is yours, you are the one deciding who else gets to search what it records.
What happened
Bisnow reported on September 21 that scrutiny of Flock Safety has not slowed AI-driven surveillance moving into commercial and residential property. Brivo, which Bisnow describes as serving 78,000 customers in more than 80 countries, counts Greystar among its clients; Verkada has more than 30,000 global customers. Marcelo Ballve, head of research at Sacra, told Bisnow that Flock itself has said "50% of their new revenue is coming from enterprises and businesses" rather than police departments — the company's own figure, relayed by an analyst. The privacy advocacy group Deflock counts roughly 140,000 Flock plate-reader cameras deployed around the country.
Vendors have started selling privacy as a feature. Cloudastructure's chief revenue officer, Nile Coates, told Bisnow the company's systems carry a 98% deterrence rate — a vendor claim, not an independent finding — and said data privacy became a major selling point only recently.
Flock itself narrowed its defaults over the summer. The ACLU reported on August 13 that the company announced it is reducing its standard retention window from one month to one week, preserving data tied to a case number under what Flock calls "Evidence Mode," and quoted Flock conceding that roughly 90 percent of all searches on Flock already happen within a week of the data's collection. The ACLU's caution was that Evidence Mode could be triggered broadly enough to retain more data, not less.
What California already asks of private ALPR operators
California's plate-reader statute is not aimed only at police departments. It defines an ALPR operator as a person that operates an ALPR system, and defines "person" to include partnerships, firms, associations, corporations and limited liability companies — not only public agencies. Flock's own explainer for private organizations, published September 2, says qualifying private organizations operating ALPR systems "can fall within the law's scope".
For an operator that is covered, Civil Code § 1798.90.51 requires "reasonable security procedures and practices" for ALPR information and a usage and privacy policy covering authorized purposes, who may access the system, how it is monitored, the rules on sharing or transferring the data, and how long records are kept. The policy has to be available to the public in writing, and posted conspicuously on the operator's website if it has one.
There is a private remedy attached, and its conditions matter. Under Civil Code § 1798.90.54, an individual harmed by a violation may bring a civil action against a person who "knowingly caused the harm." The court may then award any one or more of: actual damages, but not less than $2,500 in liquidated damages; punitive damages on proof of willful or reckless disregard of the law; reasonable attorney's fees and litigation costs; and equitable relief. None of it is automatic: the claim turns on knowledge, the award is the court's to make, and the punitive piece carries a higher standard still.
That is California. Other states regulate plate readers differently or barely at all, and camera and audio-recording rules vary by state and by where the device points. Confirm your own position with local counsel rather than assuming either the duty or the safe harbor.
Why it matters for property managers
You own the switch, not your vendor. Reporting by Knock LA in July found that landlords own the physical cameras and decide whether to enable data sharing with police through Flock's platform. A landlord who does so, it wrote, has effectively made an independent decision to "fold their tenants into a national surveillance apparatus" the tenants never agreed to join. Whatever you make of that framing, the operational point holds: the setting is yours to set, and nobody else will set it for you.
The decision outlasts the agency on the other end. Knock LA reported that the LAPD's three-year Flock agreement expired, with the department's chief information officer citing civil liberties and civil rights concerns over data handling — and that the cameras remain in place. Community associations sit in the same spot: a Cheviot Hills neighborhood association raised $200,000 in 2024 to buy Flock cameras on an informal understanding that the LAPD would take over ownership and data control after five years. Five years is shorter than most camera contracts feel when you sign them.
The litigation is filed, not decided. In late February, KTVU reported that an Oakland firm had filed a proposed class action alleging Flock illegally shares California drivers' information with out-of-state and federal law enforcement, pointing to figures including more than 1.6 million searches of the San Francisco Police Department's database by out-of-state agencies over seven months. Flock said it "takes privacy, legal compliance, and data security extremely seriously" and intends to defend itself. The allegations are unproven, and the case targets the vendor — but the reputational question reaches whoever mounted the camera.
Residents find out either way. A camera your residents learn about from a news story rather than from you is a renewal problem before it is ever a legal one.
What to do this week
This is general information, not legal advice. Plate-reader, camera and recording rules vary by state and by placement — confirm anything here with your own counsel before acting on it.
- Find out whether sharing is on. Log into the console for every camera and plate reader in the portfolio and check, device by device, whether data leaves your account and who can query it. Write the answer down; most teams are guessing.
- Set retention deliberately. Pick a window you can defend and document why you picked it. Flock's announced new default is one week; yours does not have to match, but it should be a decision rather than a leftover.
- Read the sharing terms in the vendor contract. Who else can search your footage or scans, through what process, and can you revoke access unilaterally? Get that in writing from your rep rather than from the marketing page.
- Write the usage and privacy policy, and publish it. Section 1798.90.51 is a workable checklist even outside California: purposes, access, monitoring, sharing rules, accuracy, retention. Put it where residents can actually find it.
- Decide your law-enforcement request policy before a request arrives. Name the single person who handles them and route anything beyond a routine request to counsel. Deciding this at the leasing desk, live, is how mistakes happen.
- Apply it uniformly. Enforcement decisions driven by camera data should follow the same written standard at every property and for every resident. Uneven application is where a security program turns into a fair housing problem.
What we're watching
- The California class action. A ruling on the data-sharing claims would sharpen what private operators can and cannot switch on.
- Whether retention defaults keep shrinking. The announced one-week default is the number competitors will now be measured against.
- How much of this market is private. If Flock's own enterprise revenue claim holds, the policy fight moves from city council agendas to leasing offices.
- State copycats of California's operator duties. The obligations in § 1798.90.51 are the most likely template if other legislatures move.
- Insurance and indemnity language. Worth asking your broker what a data-sharing claim would look like under the tower you carry today.