Did you put up a Ring camera on a stand in front of your house for the specific purpose of selling that I drove past at this specific timestamp? If so, yes. The CCPA[0] gives me explicit legal rights:

* The right to know about the personal information a business collects about them and how it is used and shared;

* The right to delete personal information collected from them (with some exceptions);

* The right to opt-out of the sale or sharing of their personal information including via the GPC;

This isn't someone incidentally taking pictures of license plates in an otherwise noncommercial setting. It's a company literally created to collect and sell PII. Laws are different for them than for us.

[0]https://oag.ca.gov/privacy/ccpa

I think you're going to find that you're wrong about this, and that you're not going to get anywhere targeting Flock in particular, as opposed to the owners of Flock cameras. Consider that California has had multiple rounds of legislation about red light camera legislation, including new limitations on it, and all of those cameras are also from commercial providers collecting your PII. Your argument proves too much.

You're going to get a lot of cheerleading and support about this in venues like HN and Reddit, because you're narrowcasting to an audience already primed to be hyperconcerned about surveillance technology (I am too). I think you're going to find those attitudes do not in fact generalize to the public at large, and especially not to the legal system.

Best of luck either way. It'll be an interesting experience to write up, and I'm happy to read about the outcome, even if I do think it's highly predictable.

>you're not going to get anywhere targeting Flock in particular, as opposed to the owners of Flock cameras.

fyi, flock owns the cameras.

"We operate using a lease model. What does that mean? Since we own the hardware, we own the problems that occur."

FWIW, I just did this as an experiment and turned it into a blog post afterward. I didn't really set out with an agenda or a deliberate audience, and I didn't share it here. Don't get me wrong, I'm happy to chat about it! But this ended up here without any special effort on my part.

I know the feeling! My arguments here are positive, not normative. I don't know that I think it would be a worse world if your hypothesis was correct. I'm just reasonably sure it isn't.

For sure. This is the sort of conversation I'd typically rather be having at a bar with appropriate beverages. If it sounds like I'm arguing, it's because it's the kind of thing I'd debate with my friends for the fun of it.

“Personal information” has a legal definition and photos of you in a public street might not satisfy it, regardless of the photographer’s intent.

Well, it matters if the photographer is the government (or contracted by the government, or subpoenaed by the government): see Chatrie v. United States [0]. The Fourth Amendment exists, and it remains to be tested whether querying massive surveillance networks is a "reasonable" search.

[0]: https://www.scotusblog.com/cases/case-files/chatrie-v-united...

True but the Fourth Amendment doesn’t rely on the CCPA for authority!

Personal information usually does include photos of someone in public without their consent: exceptions usually hold for taking photos of people where it is in the public interest to be able to show them or impractical to get consent. This covers large gatherings and celebrities, but a portrait photo of a stranger might put you on the wrong side of the law.

Obviously, the idea is to not disallow having someone take a photo of you as a background, passing figure as they take a front-and-center photo of their family, but not allow you to be the main subject unknowingly and especially when you object explicitly.

On the other hand, a photographer still owns the copyright to a photo, so a subject (including in a portrait) cannot claim it or distribute it without permission even if they can potentially stop the photographer from distributing that photo.

IANAL, but you are not by default allowed to use anyone's "likeness" for your individual profit.

> Personal information usually does include photos of someone in public without their consent

This is not the case in the United States. There is no presumption of privacy in public. In fact, there is a whole genre known as "street photography" that involves taking pictures in public without explicit consent of the subjects.

This is true, and it may also be true that location tracking through surveillance networks crosses a line into violating one or more Constitutional rights. One of Flock's revenue streams is explicitly selling access to data made available by other customers. A commonly-cited example is the ability of local law enforcement to locate abortion suspects in other states using the Flock camera network [0]; one could imagine dragnet-style or geofenced queries to also cross the line.

[0]: https://www.eff.org/deeplinks/2025/10/flock-safety-and-texas...

People keep making this claim that Flock "explicitly sells access to data", but the link you provided doesn't demonstrate that, and Flock contracts I've read contradict the claim.

I think what's happening here is that people are trying to colloquially define "selling access to data" to fit the camera data sharing that Flock enables, and then saying that because you have to pay to be a Flock customer to get access to that data, they're effectively selling it. I don' think that's how data brokerage laws work. Flock doesn't own the data they're providing access to, and they're providing that sharing access with the (avid!) consent of their customers.

You seem to be right, thanks for the correction!

If https://legalclarity.org/can-you-post-someones-picture-witho... is to be trusted though, at least you get protection from your likeness being used for commercial purposes, though that seems a bit more limited than I'd expect.

> In fact, there is a whole genre known as "street photography" that involves taking pictures in public without explicit consent of the subjects.

Try taking an upskirt photo of someone in public without their explicit consent. You'll find that there are limitations to that under both Federal and State laws.

You’re getting mixed up about commercial use and personal information.

I think it'd be challenging to rule that a license plate number is not personally identifiable information, when the same regulations often state that an IP address is.

Or home address, phone number, etc

"Anyone could have been driving my car, you can't positively identify me in the driver's seat with the evidence you have submitted" is routinely used to toss out cases involving traffic violations. It's not necessarily common but it does happen. By this logic a license plate does not personally identify the person driving, only the person the car is registered to.

Yet the same is true of IP addresses. You (typically) cannot know for certain whether traffic from an IP address was originated by a specific person and yet it's typically considered PII because it can be used in conjunction with other information to identify you.

Even your full legal name and birth date cannot be guaranteed to refer only to you specifically (as there could be someone else with an identical name and birth date), but it's obviously still PII because it helps narrow the field immensely if you can combine it with other information - for example, your IP address.

So yeah, "anyone could have been driving my car", but if you also know that the car drove from your home to your work then that narrows down the list of likely individuals immensely.

Conversely, if your license plate was spotted parked near an anti-ICE rally, then they can be pretty confident that you or someone you know was near an anti-ICE rally, which means they can harass you about it, follow you around, shoot you in the street, etc.

The standard of proving someone's guilt in a crime or civil infraction is higher than the one for inferring that someone could plausibly be the person you want. This is the basis of parallel construction, wherein a government agency plays a game of "pin a crime on the suspect."

Right, but in this context the license plate number is still personal information, just of a different person.

The CCPA explictly says:

> “Personal information” does not include [...] Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer

California has an entire statute regulating ALPR information, so we don't need to derive this axiomatically.

One generally has to follow all of the laws, so evaluating what the CCPA says here is relevant for evaluating CCPA compliance.

Yes, all the laws, including the ond GP is referring to.

Then the key aspect of our discussion is the "identifiable" part, which you've left out.

Are you now saying that one cannot possibly "identify" the "person" who owns a vehicle, solely with the "information" on a license plate?

You may be confused, but the owner of a vehicle is not necessarily the same as the driver of a vehicle. Recording a vehicle's license plate does not necessarily identify the driver unless they also happen to be the owner. (c.f. vehicle hiring companies)

Indeed, that definition is included in the CCPA.

> (v) (1) “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following [...]:

> (E) Biometric information.

> (H) Audio, electronic, visual, thermal, olfactory, or similar information.

https://leginfo.legislature.ca.gov/faces/codes_displaySectio...

To your point, the intent would presumably still matter for exceptions to when deletion requests must be honored (say for journalism), but a photo of someone walking down a public street would still logically be considered the subject's personal information, by the above definition.

The laws say that data about you is your data, information about you is your information. No one is saying that you "own the data", but by virtue of the data being personal information about you specificially you are allowed to exert control over that data, such as asking for it to be deleted.

That view of data ownership is _highly_ jurisdiction dependent and is not the overwhelming norm in the US.

While that's definitely true, in this particular case he's invoking his rights under CCPA.

They're invoking a right they do not in fact have under CCPA. Flock is a service provider under CCPA, and isn't required to respond to their request so long as they're operating under the terms of their contract with the municipality (which is, in turn, exempt from CCPA.)

I believe you are still the owner of that data, but if you are holding someone's PII — which time of passage, car model and license plates can be argued to be especially with a fixed location — according to privacy regulations, they can ask a business to remove it unless they have a legally acceptable reason to keep it (eg. they hit-and-run a parked vehicle).

Now, with you likely not keeping that Ring tied to a business account, how that applies to non-businesses holding PII is a different matter.

"Your data" isn't really a well defined term, right?

But yes, data that can be used to track my movements in my vehicle is certainly a type of personally identifiable information. I'd argue there should be some exemptions for individuals operating on a small scale, which I believe the CCPA has (and if we actually got a US GDPR, that it should have). But also that kind of exception shouldn't apply to a camera operated by and backhauling to Ring.

Who paid for the camera? If I did with taxpayer dollars then, you're damn right I should have a say.

The "my Ring camera" trope is a fun strawman, though.

If it's the municipality holding the data it's even less an issue! Municipalities are exempt from CCPA!

They aren't. Flock is, so are they? Also, the state I live in has a GDPA that would override CCPA, so it's not exactly that cut and dry as you very well know.

The Ring example is garbage. You paid for it and it's on your property. Nothing remotely similar.

I guess then it's OK for Flock to be required installed on your mobile device so they can check your geo history for the last hour and that you don't match the profile of the guy who stole Billy's Huffy bike?

What happens when the municipalities buy time on your device since, well, you don't own it and have no right to the software running on it because of ToS you agreed to. Or that awesome "save the children from CSAM pedos" bill you cheered for that paved the way for the USG and states to be guaranteed citizen introspection app slots on your device?

Because the piece of paper says so, it should then just be accepted as is!

I've lost track of what you're talking about. Flock cameras are installed by municipalities. They're physical devices. Nobody is required to have "Flock" installed on their mobile device. That's not a thing.

I never said it was, the hypothetical was clearly hard to follow.