Private Stores and HOAs May Be Liable for Their Flock Cameras

Most of the fight over Flock cameras has been about the police and county commissioners. But a fast-growing part of Flock’s network is private: stores, homeowners associations (HOAs), hospitals, apartments, and shopping centers put up their own cameras. Lowe’s has used them in parking lots.¹ These private owners do not answer to the Fourth Amendment, to public-records law, or to a county vote. What they do answer to is ordinary North Carolina law — the kind that lets one person hold another accountable.

Here is the problem in one breath. A store or HOA has every right to point a camera at its own property. The trouble starts when it turns on “sharing” — because then a government agency can look up its customers’ movements with no warrant, no court order, and no notice to a single shopper. The pictures sit on the vendor’s servers, where they can be used to find and follow people. The owner gets a benefit it paid for. The people in the pictures get nothing, and were never asked.

North Carolina has several laws that might apply — three that could fit many situations, and a fourth aimed at HOAs. None has been tested against a private license-plate network in a North Carolina appeals court yet, so these are possible cases, not sure things. (North Carolina is careful about privacy lawsuits: it allows two kinds and has rejected two others, so everything below stays inside the two the courts accept.²) Here is each one, in plain terms — and where each one is weak.

What these cameras really do

Every one of these cases meets the same defense: “It’s just a license plate reader.” Two public records answer that.

The patent. Flock holds a U.S. patent that describes pulling video from many cameras — even home security cameras and a bystander’s phone — into one searchable network, and searching it using face data. Its own example is the system spotting a subscriber’s teenage daughter and texting the subscriber.³ Flock’s public FAQ, meanwhile, says the product is not a tracking system and that each image is a one-off. Those two do not match. But a patent only proves what a company designed and claimed. It does not prove the feature was built, is sold today, was switched on for any particular store, or was ever used on a real person — and it says nothing about what a store or HOA knew. Proving actual use would take the contracts, the settings, and the logs. The fair move is to ask Flock whether the patent describes anything it sells now, and print the answer. Read it in full.

The device. In September 2026, 404 Media and WIRED took apart the software from a real Flock camera.⁴ The code detects people, not just cars and plates. One passing car produced about 28 pictures — sometimes over 100. In three weeks, that one camera took roughly 1.6 million images and stored 27,000 short video clips. The reporters found the camera itself was not running face recognition; what happens on Flock’s servers — where pictures, plates, police files, and other data can be combined — would take separate proof.

So “just a plate reader” is a claim to test against the records, not an answer. The device is built to find and frame people. But what any one camera and owner actually do is a question for the documents.

1. Using your image for their benefit (the law calls it “appropriation”)

North Carolina has recognized this claim since 1938, in a case where a newspaper used a woman’s photo in an advertisement.⁵ A later case described it as using someone’s photographic likeness for the defendant’s benefit “as part of an advertisement or commercial enterprise.”⁶ That history matters: the claim grew up around advertising, so it is far from clear how well it fits a security camera. This is the newest and weakest of the three claims.

To win, a person would have to show their image was actually used — not just captured — for the owner’s benefit, and that the image was clearly them. A blurry shape in a frame will not do. You would not necessarily need face-recognition software (the newspaper in 1938 used none). But a camera running for security, by itself, is a long way from a business using your identity to make money. What a particular owner did with the images — kept them, analyzed them, sold them — is what a lawsuit would have to dig up. Pointing to Flock’s revenue is not enough; the proof has to connect to you.

2. Invading your private space (the law calls it “intrusion upon seclusion”)

North Carolina recognizes this claim too; it comes from a case about a hidden camera.⁷ The rule: intentionally prying into someone’s private space or private affairs, in a way a reasonable person would find highly offensive, can be a legal wrong.

The obvious catch: a parking lot or a public street is not private. One photo of your car on a road is not an intrusion — and that is correct. So the claim has to rest on the other half of the rule: your private affairs. The harm is not the single snapshot. It is the record. If the pictures are kept and cross-referenced over time, they can show where you worship, which doctor you see, who you spend nights with, and which meetings you attend. (Private owners are not held to the 90-day limit the state puts on police systems, so how long they keep the data depends on their own settings.) The U.S. Supreme Court made a similar point about phone-location records in 2018.⁸ But that was a case about the government searching you — it does not automatically make a private network’s tracking a North Carolina privacy wrong, and stretching it this way would be new ground in this state.

The clearest North Carolina guide is a 2025 case where an appeals court let a jury punish a homeowner whose camera pointed over a privacy fence into a neighbor’s yard.⁹ The lesson is about where a camera points. A camera watching a fenced backyard is a strong case. A camera watching cars on a public road is a much harder one. So the strongest person to bring this claim is not the passing driver — it is the resident whose yard, windows, or front door is in the camera’s view. Even then, a door you can see from the street is not as private as a fenced backyard.

3. Misleading or unfair business conduct (the law calls it “unfair and deceptive trade practices”)

Against a store, this may be the strongest claim. A North Carolina law bans unfair or deceptive business conduct, and it can triple a person’s proven damages.¹⁰ But it has real limits. There has to be actual harm the conduct caused. And if the claim is that the store lied, the customer usually has to show they actually and reasonably relied on the lie.¹¹ Attorney fees are not automatic — they take extra findings, and a customer who brings a baseless claim can be ordered to pay the other side’s fees.¹²

A store photographing every customer and feeding the images to a police-searchable network is “business conduct.” Whether it is deceptive is harder. A statement on Flock’s website is not automatically the store’s promise to you. And simply not posting a sign is not automatically deception. The real gap a lawsuit would point to: nothing at the entrance tells shoppers their face and movements are recorded and shared with a nationwide database the police can search.

California has a law requiring private camera operators to post a proper privacy policy — which is why the Lowe’s and Home Depot lawsuits there say the stores broke that law.¹³ North Carolina has no such law. Here, the same missing policy would have to be argued as “deception” — a theory worth testing, but not a sure substitute for California’s rule.

4. When your HOA is the one watching

An HOA is different. It is not a stranger with a camera — it is a group you belong to, that spends your money, and whose board owes you duties. That tilts things your way.

Board duties. HOA board members must act in good faith and with ordinary care for the association.¹⁴ But a board’s honest, informed decision is often protected, and failing to hold a vote is not automatically wrong — the first question is whether the board had the power to approve the system and followed the right steps. Where it approved a camera network that records and shares members’ faces and movements without even reading the terms, that is a real problem. Whether a single owner can sue on their own (rather than on the whole association’s behalf) depends on the documents and whether that owner was hurt in a specific way.

Going beyond the board’s power (“ultra vires”). Read your declaration and bylaws — honestly. Broad powers to run common areas, hire services, and provide security probably do allow putting up cameras, even if the papers never say “license-plate reader.” A North Carolina court has already upheld an HOA’s power to install an entrance gate and camera.¹⁵ So the fight usually is not the camera itself — it is whether the sharing, the data retention, the access, or the spending went past what the board approved or broke a specific rule.

A camera aimed at your home (“private nuisance”). A camera pointed into your home, fenced yard, or garage might support this — but a visible camera is not automatically a nuisance. It takes a real, unreasonable interference with your use of your property.

Acting together with Flock. North Carolina does not allow a “conspiracy” claim on its own — there has to be an underlying wrong the two agreed to commit. A vendor contract alone is not enough. But where the evidence shows the HOA and Flock worked together on something itself unlawful, it can tie them both in.¹⁶

The first practical step for any HOA member: ask, in writing, for the records — the Flock contract, invoices, board minutes, policies, retention terms, the list of who can search, and any audit logs.¹⁷ The association may fight over what it has to hand over, and some items may not exist. What the records show tells you which claim is strongest.

What about Flock itself — and its competitors?

These same ideas reach the companies, not just the camera owners. Flock — or a competitor like Axon, Rekor, or SoundThinking’s PlateRanger — is in some ways the more natural target: it keeps the images, builds the searchable history, and made the public statements a deception claim would test. Lawsuits already name Flock directly. But as a practical matter, the local store or HOA is the reachable defendant — easy to sue here, within reach of a resident or a small firm, and often willing to just take the cameras down. A giant vendor fights to the end. A smart plaintiff might sue both: the customer for leverage, the vendor for the money.

For some vendors, North Carolina adds a sharp extra hook. Installing or servicing certain security cameras here requires a state license. In August 2026 the licensing board had no license on file for Axon, Rekor, or PlateRanger — but that picture is already shifting: Axon became licensed in October 2026 (and the Board withdrew the complaint against it), joining Flock, which was licensed after a 2023 court order. As of this writing the board still showed no license for Rekor or PlateRanger — a status worth re-checking before relying on it.¹⁸ And North Carolina law says that the unlicensed sale, installation, or service of a security system is itself an unfair and deceptive trade practice — the hardest part of the case, handed to the plaintiff by the statute — and can make the contract unenforceable.¹⁹ A plaintiff still has to show the work needed a license and that they were harmed, but the “deception” piece may already be settled. The licensing complaints, and the board’s confirmation.

The repo-truck and parking-garage data sellers

There is a quieter version of this business: companies that mount plate readers on tow trucks, repossession vehicles, and parking garages — not for security, but to collect and sell location data. The biggest, Digital Recognition Network (owned by Motorola), and rivals like MVTRAC, have scanned billions of plates and sell lookups to lenders, insurers, and investigators.²⁰ Because they openly sell the data, the “business” and “benefit” parts of the claims are easy. But two cautions: these companies have been sued the longest and often won — a California court recently threw out a privacy case against DRN — and they argue that photographing plates in public is free speech. And the licensing hook is shakier here, partly because the law has a special exemption for a device mounted in a vehicle.²¹ It is a fair target, but unsettled.

Who has the strongest case?

The weak spot in every one of these lawsuits is injury. Being filmed, by itself, may not be enough. In the California data-sharing case, a federal judge suggested the plaintiffs had not shown real personal harm — a technical point about which court hears the case, not a ruling that the sharing was legal.²² North Carolina courts are more open on this, but you still need a real legal injury, not just a complaint.

The strongest cases share one thing: something actually happened to the person because of the data.

• A wrongful stop based on a misread plate. (Flock’s own software has mistaken bumper stickers and a flag patch for plates; a Colorado woman was wrongly accused of theft off a Flock hit during her normal commute.)
• An abuser, stalker, or ex who got someone’s movements through a police contact or an HOA board member. Officers running personal searches have been documented in North Carolina and nearby states.
• An HOA member whose home is in the camera’s view and who objected in writing before it went up.
• A customer or member who got a specific promise about the data that turned out to be false.

What about punitive damages — the extra, punishing kind? North Carolina sets a high bar: clear proof of fraud, malice, or reckless disregard of a known, likely harm, and (for a company) sign-off by a manager or officer. They are capped at three times the regular damages or $250,000, whichever is greater, and you cannot stack them on top of the tripled “trade practices” damages — you pick one.²³ Continuing a system after a clear warning about a specific harm moves toward that bar. It does not get you there by itself.

One warning. The camera-software findings above came from a device that was physically removed, which Flock calls illegal. Cite the reporting. Do not become the defendant.

Seven questions a camera owner should be able to answer

For a store or HOA board, the honest test is not whether a lawsuit is coming. It is whether the people who approved the system can answer basic questions about it. If they cannot, that is the story:

1. Who can search the images and plate data our cameras collect?
2. Can police agencies outside North Carolina reach our data?
3. How long is the data kept, and who can extend that?
4. Did we verify the licenses required to install, service, and monitor the system?
5. Did we check our insurance for privacy and data-sharing claims?
6. What happens if the data is misused, or an innocent person is harmed?
7. Has our attorney reviewed the actual contract, the sharing settings, and our privacy duties?

A board that cannot produce its contract, its approval records, or a straight answer about who can search the data has a problem — whatever a court would finally decide.

Does your insurance even cover this?

One question focuses a board or a company lawyer faster than any legal theory: if someone sues over this system, who pays to defend it? A camera owner should ask its insurer, in writing, whether its general-liability, directors-and-officers, or cyber/privacy policy covers claims from ALPR data collection, sharing, hacking, or misuse — and whether the insurer was even told about the system. It should also check whether Flock’s contract covers the owner for these claims, or leaves the owner holding the bag. We are not assuming any policy excludes this. The point is whether anyone has checked. For an HOA, the risk of defense costs landing on the members tends to concentrate the mind.

What you can do now

1. Photograph the camera. Where it is, which way it faces, what it can see, and any sign — or missing sign. Date-stamp the photo.
2. Ask in writing. To a store: what is collected, who gets it, how long it is kept, and whether any agency has asked for access. To an HOA: a formal records request for the contract, minutes, sharing settings, and access logs.¹⁷ The answer — or the silence — is evidence.
3. Object in writing before you sue. A written objection shows what the owner knew and when. By itself, it does not make a lawful camera unlawful.
4. Save what happened to you. If the data was used against you, keep the ticket, the message, the police report, or the court filing.
5. Talk to a lawyer who handles privacy or consumer cases. These claims are real, but untested here, and the first case will set the rule. See our page for attorneys.

The cameras on public roads come down when commissioners vote. The cameras in the store parking lot and at the neighborhood gate come down when the people they photograph decide to hold the owners accountable. North Carolina law gives you the tools.

This post is general information about North Carolina law, not legal advice, and reading it does not create an attorney-client relationship. The author, Mark Spencer Williams, is a North Carolina attorney whose practice is family law. Nothing here should be acted on without first consulting a licensed attorney in your own jurisdiction about your specific situation.

Notes

1. Lowe’s parking-lot deployments are the subject of a pending California class action and were the focus of an August 2026 protest at a Wilmington, NC store (links in Sources). ↩
2. North Carolina recognizes appropriation and intrusion upon seclusion but has rejected the “publication of private facts” (Hall v. Post, 323 N.C. 259 (1988)) and “false light” (Renwick v. News & Observer, 310 N.C. 312 (1984)) privacy torts. ↩
3. U.S. Patent 11,416,545 B1 (granted Aug. 16, 2022; inventors Garrett Langley and Matt Feury). ↩
4. 404 Media / WIRED, “Hackers Stole Flock’s Camera Software…” (Sept. 2026). ↩
5. Flake v. Greensboro News Co., 212 N.C. 780 (1938); see Restatement (Second) of Torts § 652C. ↩
6. Miller v. Brooks, 123 N.C. App. 20 (1996). ↩
7. Miller v. Brooks, 123 N.C. App. 20 (1996); pattern jury instruction N.C.P.I.-Civil 800.70; Restatement (Second) of Torts § 652B. ↩
8. Carpenter v. United States, 585 U.S. 296 (2018) — a Fourth Amendment case about government access to historical cell-site location records. ↩
9. Nichols v. Calhoun, No. COA24-905 (N.C. Ct. App. Sept. 3, 2025). ↩
10. N.C. Gen. Stat. § 75-1.1 (unfair or deceptive acts in or affecting commerce); treble damages under § 75-16. ↩
11. Bumpers v. Community Bank of Northern Virginia, 367 N.C. 81 (2013) (actual and reasonable reliance required for a misrepresentation-based § 75-1.1 claim). ↩
12. N.C. Gen. Stat. § 75-16.1 (attorney-fee conditions, including fees against a plaintiff who brings a frivolous, malicious claim). ↩
13. California class actions against Lowe’s and Home Depot (filed 2026) allege the retailers ran Flock cameras without a compliant usage-and-privacy policy (links in Sources). ↩
14. HOA directors’ duties arise under the North Carolina Nonprofit Corporation Act (Ch. 55A), the Planned Community Act (Ch. 47F), and the governing documents; cf. Ironman Medical Properties, LLC v. Chodri, 268 N.C. App. 502 (2019) (direct vs. derivative claims, condominium context). ↩
15. Happ v. Creek Pointe Homeowner’s Ass’n, 215 N.C. App. 96 (2011) (upholding an HOA’s authority to install an entrance gate and camera; business-judgment rule). ↩
16. North Carolina civil conspiracy requires an underlying unlawful act, an agreement to commit it, and resulting injury; it is not a stand-alone tort. ↩
17. N.C. Gen. Stat. § 47F-3-118, with Chapter 55A and the governing documents, gives HOA members inspection rights, subject to the applicable notice procedure and limits. ↩
18. N.C. Security Systems Licensing Board confirmation (Aug. 2026). Axon became licensed in Oct. 2026 (license 416182-CSA, exp. 10/31/2028) and the Board withdrew the complaint against it; Flock became licensed after a 2023 Wake County order. Rekor and PlateRanger status is per the Board’s Aug. 2026 confirmation — re-check before relying on it. (See the §74D complaints, linked above.) ↩
19. N.C. Gen. Stat. § 74D-14 (unlicensed sale, installation, or service deemed an unfair and deceptive trade practice actionable under Ch. 75; contract unenforceable in specified conditions); § 74D-3(2) (exemption for a device installed in a motor vehicle). ↩
20. Digital Recognition Network (Motorola Solutions) and MVTRAC; reporting on commercial ALPR data brokers (billions of plate scans; lookups sold to lenders, insurers, and investigators). ↩
21. N.C. Gen. Stat. § 74D-3(2) (motor-vehicle device exemption); commercial data brokers have also raised First Amendment defenses, and a California Court of Appeal recently rejected a privacy suit against DRN. ↩
22. Flock data-sharing suit — a federal standing/jurisdiction question; see Courthouse News (link in Sources). ↩
23. N.C. Gen. Stat. Ch. 1D (punitive damages: clear-and-convincing proof of fraud, malice, or willful/wanton conduct; cap of the greater of 3× compensatory damages or $250,000; election against a statutory multiple-damages remedy). ↩

Sources

• U.S. Patent 11,416,545 B1 and DeFlockILM’s analysis
• 404 Media / WIRED: Hackers Stole Flock’s Camera Software (Sept. 16, 2026)
• Miller v. Brooks, 123 N.C. App. 20 (1996)
• N.C.P.I.-Civil 800.70, Invasion of Privacy – Offensive Intrusion
• Nichols v. Calhoun, No. COA24-905 (N.C. Ct. App. Sept. 3, 2025) — Wake Forest Law Review note
• Right of Publicity Roadmap — North Carolina
• Lowe’s ALPR class action (Cal., filed Apr. 2026)
• Home Depot ALPR class action — Daily Journal
• Flock data-sharing suit standing — Courthouse News
• Fight for the Future — Wilmington Lowe’s action, Aug. 19, 2026