Flock cameras at Lowe's and Home Depot

Yes. Lowe’s and Home Depot both run automated license plate readers — ALPRs — in the parking lots of some of their stores, and both say so in their privacy statements. Lowe’s writes: “At some of our stores, and when allowed by law, we use cameras with automated license plate reader (‘ALPR’) technology near and around parking areas.”¹ Home Depot’s statement carries a separate ALPR usage and privacy policy saying it may use such systems “where not prohibited by law.”² Neither document names the vendor, but police records do. In August 2025, 404 Media reported that records the Electronic Frontier Foundation obtained from the Johnson County, Texas, Sheriff’s Office showed the office could tap into Flock Safety license plate cameras at 173 Lowe’s locations around the U.S., and into cameras and gunshot-detecting microphones at dozens of Home Depot stores in Texas.³

Both chains also let police reach the data. KPBS, reporting on police access to private readers in San Diego County, named Home Depot and Lowe’s among the private businesses that “give police access to their license plate readers.”⁴ Home Depot told its shareholders in April 2026 that it “may permit law enforcement agencies to access the still images captured by ALPR technology for authorized purposes only,” and that it “has not authorized any law enforcement agency other than local and state law enforcement agencies to access this data.”⁵ A company spokesperson put it more briefly in May: “We do not grant access to our license plate readers to federal law enforcement.”⁶ Lowe’s privacy statement lists “Responding to a request from state or local law enforcement” among its examples of when it discloses personal information; its ALPR section does not mention federal agencies.¹

What neither policy says is which stores have readers, which agencies can search them, or how often they do. For how a Flock reader turns a passing car into a searchable record, see what a Flock camera is.

Neither retailer publishes a count, and no public registry of license plate readers exists. What does exist is the operator field that OpenStreetMap volunteers fill in when they map a reader. Merging the spellings they used for each chain, volunteers had attributed 1,752 cameras to Lowe’s and 1,152 to Home Depot as of September 26, 2026.

Spellings merged: Lowe's (1,661), Lowes (73), Lowe's Home Improvement (18); The Home Depot (1,105), Home Depot (47). Rank is among all named operators, excluding cameras recorded under a manufacturer’s name. State figures are summed from the ten largest states recorded for each spelling, so they can run slightly low.

Counted that way — each chain’s spellings merged, every other operator’s name taken as recorded — Lowe’s and Home Depot are the two largest named operators of license plate readers in the data, ahead of every police department and other public agency. The largest public agency on the list, the NYC Department of Transportation, has 593 under that name. The only bigger entry is Flock Safety (2,144 cameras), the manufacturer’s name, which volunteers recorded as the operator and which in most cases reflects how the camera was labelled rather than who runs it. Together the two chains account for about 72 percent of the 4,053 cameras volunteers have attributed to operators we classify as private. Both appear in our operator index, where each spelling has its own row.

Read these as floors. The operators volunteers have named on at least five cameras account for only about 15 percent of the readers this site documents; the rest carry no operator tag, a placeholder, or a name too rare to list. A camera in a store’s lot counts toward Lowe’s only if someone saw it and wrote the name down, so the counts establish that volunteers have attributed more than 1,750 cameras to Lowe’s and more than 1,150 to Home Depot, not how many either chain runs; our methodology page explains the data’s limits. This article does not list individual stores; every documented reader, whoever operates it, is on the map.

The companies describe the cameras as loss-prevention and safety equipment. Lowe’s says “Personal Information is collected through ALPRs to help ensure security, prevent theft and fraud, assist with parking enforcement, and to help maintain your safety and the safety of individuals and our properties,” and that ALPR matches “are always verified with additional evidence (such as security camera footage) before being used in any investigation.”¹ Home Depot’s policy names “fraud prevention, security, and asset protection purposes.”² Its board told shareholders the company uses the technology “to protect the safety of customers and associates and to detect and prevent organized retail crime.”⁵

Flock’s own retail marketing shows what that can mean in practice. It pitches cameras that “alert your team the moment a known offender enters your parking lot,” tools for “tracking vehicle patterns across multiple stores” to link suspects in organized retail crime, and a network where retailers can see “when partners flag the same vehicle.” It also pitches the same data for store operations, citing “store traffic patterns and visitor trends.”⁷ That is the vendor describing its product’s capabilities, not either chain describing its own use.

As for what is recorded, Lowe’s says its systems “automatically capture images of vehicles and their license plates, along with the date, time, and general location.”¹ To recognize the hardware itself, see our guide to what a Flock camera looks like.

In Flock’s system, the buyer owns the data (see why that blocks opt-outs) and decides who sees it: “Customers choose whether to share LPR data with other customers in accordance with their laws and policies.”⁸ Government agencies can contribute their cameras to statewide or nationwide lookup networks; Flock told 404 Media that cameras run by private companies have more restrictive sharing options.³ Which agencies can search a store’s cameras is therefore the retailer’s decision.

Both chains have granted access. Besides the Texas sheriff’s access described above, KPBS named both chains in its San Diego County reporting as businesses that give police access to their readers. The same story reports a separate finding: a review of more than 1,500 pages of police records showed agencies in the county with access to dozens of local private Flock camera networks, which include more than 150 previously undisclosed readers.⁴

Home Depot has published the most specific limits. Beyond restricting access to local and state agencies, its board said: “Any sharing of this data by an authorized agency with parties who are not authorized agency users would violate the terms and conditions by which their use had previously been authorized and subject such agency’s access to the Company’s ALPR data to suspension or termination at the Company’s discretion.”⁵ That is a condition Home Depot says it attaches to access, with cutting an agency off as the penalty, and it addresses the route critics worry about: Gideon Epstein of the ACLU of Massachusetts told The American Prospect that local police departments still run searches on behalf of immigration agents⁹; see how those searches work.

Lowe’s wording has changed. When KPBS reviewed it in late 2025, the policy said data could be shared with law enforcement “upon appropriate request and solely in connection with criminal investigations.”⁴ The version updated March 11, 2026 lists, among its examples of when Lowe’s discloses personal information, both “A search warrant, other judicial order, or valid legal process” and “Responding to a request from state or local law enforcement.” It also says it shares ALPR data with the National Center for Missing and Exploited Children.¹ Lowe’s board told shareholders in April that a recent update to the statement covered “how we share information with law enforcement and others.”¹⁰

In writing, through the privacy statements; neither policy mentions signs at the stores. Nor does either name the stores that have readers — Lowe’s says only that it uses them at “some of our stores”¹ — and California’s law, which does apply to private operators, requires a posted policy rather than a sign. Flock’s own guidance to private customers says “SB34 does not require organizations to post physical signage about use of LPR,” though it adds that “some interpret California’s data privacy law to require or recommend the use of physical signage.”¹¹ A Flock spokesperson told KPBS, “It is up to the customer to determine, on the private side, how transparent they want to be.”⁴ Dave Maass of the Electronic Frontier Foundation put the question to 404 Media directly: “Do customers know that these stores are collecting their data and sharing indiscriminately? Probably not.”³

The policies do say how long data is kept, with different precision. Lowe’s keeps ALPR data “typically no more than 90 days (though shorter in certain states), unless it’s needed for an active investigation or to comply with a legal obligation.”¹ Home Depot keeps it “for as long as necessary for the Authorized Purposes” and destroys it when it determines retention is no longer necessary.²

Pressure for more disclosure came from two directions in May 2026. On May 26, nine Connecticut Democratic legislators sent both chief executives a letter with eight questions, among them “Do you require a signed judicial warrant to share any data gathered by the ALPRs you utilize at your stores with federal, state, or local law enforcement?” and whether out-of-state law enforcement agencies can access data from Connecticut stores.¹² And shareholders at both companies asked for reports on the privacy risks of sharing customer data with third parties, citing the parking-lot plate readers and immigration enforcement at or near stores; both boards recommended against.⁵⁹¹⁰ Both proposals failed: at Home Depot, 62,948,880 shares voted for and 645,876,261 against;¹³ at Lowe’s, 38,182,128 for and 380,809,009 against.¹⁴ In September, 56 online creators, in a letter the advocacy group Fight for the Future helped organize, asked both chains to end their contracts with Flock.¹⁵

There is no federal ALPR statute, and most state ALPR laws govern police and other government agencies rather than businesses; our state-by-state reference tracks them. A handful reach a retailer’s parking lot.

California. SB 34 applies to any “person” operating a reader, a term that includes corporations. An operator must keep the data secure, log every access, and post a usage and privacy policy covering seven required points, among them who may access the system, sharing restrictions, the title of the official custodian, and how long data is kept. Someone harmed by a violation may sue whoever knowingly caused the harm; a court may award actual damages or $2,500 in liquidated damages, whichever is greater, and may add attorney’s fees and, for willful or reckless violations, punitive damages.¹⁶ The law is mostly about disclosure. A state appeals court observed in February 2026 that it “does not impose specific substantive requirements on private entities’ collection and use of ALPR data,” while ruling that collecting plate data with no required policy at all is a harm people can sue over; it later added that it was not deciding whether a policy missing some required elements would be.¹⁷ In July a second appeals court agreed that a bare violation is not enough, held that a plaintiff must show actual harm, and said it was “less sure” that the absence of a policy alone qualifies.¹⁸

That is the ground on which both chains are being sued. One of the original complaints against Home Depot, filed May 1, 2026, alleged that its policy lacked at least three of the seven required elements: a custodian’s title, a defined retention period, and meaningful limits on sharing with federal, out-of-state, or immigration authorities.¹⁹ On the first two points, Home Depot’s policy says “Select asset protection associates are responsible for implementing this ALPR Usage and Privacy Policy” and keeps data “for as long as necessary.”² The California cases have been consolidated in federal court in San Francisco as In re Home Depot ALPR Litigation. The plaintiffs filed a consolidated complaint in June, Home Depot moved to dismiss in August, the plaintiffs amended their complaint in September, and a September 1 scheduling order set a jury trial for May 2029.²⁰

Lowe’s faces the same kind of suit. Two cases removed from California state court to federal court in Sacramento in May 2026 were consolidated in June as Harhay v. Lowe’s Home Centers. The plaintiffs filed a consolidated complaint in July, and on August 28 Lowe’s moved to dismiss and, separately, to transfer the case.²¹ One of the two, a proposed class action, as originally filed accepted that Lowe’s posted a policy but alleged that it fell short on all seven required elements, among them that naming the vice president of asset protection as custodian was not enough and that keeping data “typically no more than 90 days” “provides no actual retention period.”²² In both cases the claims are allegations, and both are at the pleading stage.

Where police need legal process. Washington allows an agency to obtain privately held ALPR data “only pursuant to a valid, court-issued, probable cause warrant.”²³ Utah lets a government entity obtain plate data from a nongovernmental entity only under a warrant or a court order issued on specific and articulable facts.²⁴ Arkansas expressly allows commercial businesses to run readers for public safety, crime deterrence, and access control, caps their retention at 60 days, and lets a government entity compel them to release plate data only through a valid subpoena.²⁵

Where sharing is limited. Illinois’s statute covers a privately owned reader “to the extent that data collected by the reader is shared with a law enforcement agency.” Such an operator may not share plate data to investigate or enforce laws that restrict lawful health care or that permit detention or investigation based on immigration status, and may not share it with an out-of-state agency without a written declaration that it will not be used that way.²⁶ New Mexico’s Driver Privacy and Safety Act, in effect since July 1, 2026, applies to any “person or an entity that owns or operates” a reader and bars sharing where the operator has “reasonable belief” the data may be used for immigration enforcement.²⁷

Where retailers may not run them. Maine’s statute says “a person may not use an automated license plate recognition system” unless it is the state transportation department, the State Police screening commercial vehicles, or a law enforcement agency.²⁸ New Hampshire restricts plate readers to “local, county, and state law enforcement officers.”²⁹ Both chains’ policies, as quoted above, make their use conditional on the law.¹² Connecticut’s 2026 law, by contrast, focuses on police use rather than private companies.⁶

As with other Flock deployments, a shopper has no general opt-out. What is available is the paper trail: each chain’s policy is linked in the sources below, and each names an address for questions: privacy@lowes.com and privacy@homedepot.com.¹² We do not publish ways to avoid or defeat the cameras; our editorial policy sets that out.