Flock Safety's Secret Plan to Turn Rideshare Dashcams into Mass Surveillance Tools
Flock Safety proposed leveraging 350,000 rideshare and delivery dashcams from partner Nexar to passively collect license plate data at scale, without any indication that drivers or the public would have been informed or given consent. This represents a fundamental failure in data protection principles, particularly around transparency, purpose limitation, and informed consent. The proposal illustrates how commercial surveillance capabilities can be quietly expanded through third-party partnerships, bypassing the scrutiny that direct government surveillance programs would typically face. When private data collection is embedded into consumer devices and brokered to law enforcement without disclosure, individuals lose meaningful control over how their movements are tracked and stored. This matters because it sets a precedent for covert mass surveillance disguised as private-sector collaboration.
Tactical Insight
Immediate actions
- Audit all third-party data-sharing agreements to identify any arrangements that collect or transmit user data without explicit consent.
- Require legal and privacy review sign-off before any new data-sharing partnership with government or law enforcement entities is finalized.
Long-term improvements
- Implement a formal Data Protection Impact Assessment (DPIA) process for any product feature or partnership that involves large-scale personal data collection.
- Establish a transparent privacy notice update process that notifies users whenever their device data may be shared with third parties or repurposed beyond the original use case.
- Develop and enforce a vendor/partner due diligence program that includes privacy and ethical use requirements in all supply chain contracts.
Detection & Accountability measures
- Deploy data flow monitoring tools to detect unauthorized or undisclosed transmission of sensitive data (e.g., license plates, location) from embedded devices.
- Create a public-facing disclosure policy for law enforcement data requests and partnerships to maintain organizational accountability.