When you pull into the parking lot of your local Home Depot to grab a bag of mulch or a box of screws, you probably aren’t thinking about surveillance. You should be.

Since at least March 2025, Home Depot has been operating a network of automated license plate recognition cameras — made by a company called Flock Safety — at every one of its 233 California store locations. The cameras log your plate number, your vehicle’s make, color, and characteristics, and the exact time and location of your visit. That data flows into Flock Safety’s platform, where it is accessible to thousands of law enforcement agencies across the country. And if you ask Home Depot whether it shares any of that information with federal immigration authorities, the company’s website says no. The reality is more complicated.

A class action lawsuit filed April 2, 2026, in Sacramento County Superior Court is forcing that complexity into daylight.

What Flock Safety Actually Is

Flock Safety isn’t a niche startup. It’s one of the dominant players in a rapidly expanding surveillance industry — the private license plate reader market — that has quietly wired American retail parking lots, neighborhood entrances, and public streets into a unified law enforcement data network.

The company sells ALPR hardware to businesses, homeowner associations, and municipalities. Each camera captures license plates, timestamps, GPS coordinates, and vehicle attributes. That data feeds into Flock’s cloud platform, which thousands of police departments subscribe to. When a law enforcement agency wants to check whether a vehicle passed a particular Flock camera — at any business or neighborhood that’s paying for the service — they can query the network directly.

This is the architecture that makes Home Depot’s “we don’t share with federal agencies” statement technically accurate and practically meaningless. Home Depot doesn’t need to hand ICE a spreadsheet. It just needs to operate cameras on a network that local police can access — and local police routinely share data with federal agencies through fusion centers, task forces, and interagency agreements. The wall between “local law enforcement access” and “federal access” in the ALPR ecosystem is, for most practical purposes, not a wall.

A separate class action filed by the Gibbs Mura law group targets Flock Safety itself, alleging the company shared California license plate data with federal agencies 1.6 million times — in apparent violation of California’s strict privacy statutes.

The Lawsuit Against Home Depot

The Sacramento County complaint, filed by five California residents, centers on three specific failures in how Home Depot deployed its ALPR system.

No designated custodian. California’s Automated License Plate Recognition Information Act — Vehicle Code Section 1798.90.5 — requires any operator of an ALPR system to name a responsible custodian for the data. Home Depot’s privacy policy names no such person. Nobody is formally accountable for the records being generated at 233 store locations.

No defined retention period. The law requires a specific retention schedule. Home Depot’s policy sets none. Plate reads taken from your visit last March could, by the terms of Home Depot’s own policy, be retained indefinitely.

No restrictions on immigration or out-of-state enforcement. California law requires ALPR operators to restrict access in ways that protect residents from uses beyond the stated purpose. Home Depot’s policy places no such restrictions on federal agencies, out-of-state law enforcement, or immigration enforcement — leaving a gap that, combined with Flock’s multi-agency network access, means the data’s ultimate destination is essentially unrestricted.

The plaintiffs are seeking statutory damages of at least $2,500 per person — and given that every person who drove to any California Home Depot since March 2025 may have had their plate captured without proper notice, the potential class is enormous. They also want injunctive relief: visible surveillance notices posted at store entrances, mandatory data deletion, independent audits, and a halt to unauthorized data sharing.

Home Depot told reporters that it does not grant access to its license plate readers to federal law enforcement, citing its own website policy. That statement doesn’t address the Flock Safety network architecture, through which law enforcement access occurs without any direct action by Home Depot.

Lowe’s Is Running the Same System

Home Depot isn’t alone in this. Lowe’s operates the same Flock Safety infrastructure — hundreds of AI-enabled ALPR cameras feeding the same national law enforcement portal. Together, the two largest home improvement retailers in the country have turned their parking lots into surveillance nodes.

The reporting that exposed this arrangement — published by 404 Media — documented that law enforcement records show police can actively query cameras at dozens of locations for each chain. The implication: your license plate, captured at a Lowe’s in Sacramento or a Home Depot in Pasadena, can show up in a law enforcement query from an agency in another state, or be accessed by federal agents through a local intermediary, without any of that appearing in Home Depot’s or Lowe’s privacy disclosures.

LAPD and the Wider Flock Problem

The lawsuits against the retailers are part of a broader reckoning with Flock Safety’s deployment model. In May 2026, the LAPD was also dragged into litigation over its use of Flock cameras — raising questions about how extensively the platform is used within city limits, and whether its data-sharing practices comply with California law.

The Gibbs Mura class action targeting Flock Safety directly is the most aggressive of these cases, alleging that the company itself — not just its retail clients — violated California privacy law by transmitting plate data to federal agencies 1.6 million times. That claim, if proven, would establish that Flock’s platform functions as a conduit for data to flow from private camera operators to federal enforcement regardless of what any individual business client’s privacy policy says.

The architecture is the problem. Individual businesses can claim they don’t share with federal agencies. Flock Safety can say it only responds to lawful requests. Local police can say they’re just doing their jobs. And at the end of that chain, ICE or any other federal agency gets location data on specific vehicles — data that would otherwise require a warrant to obtain through traditional investigative means.

The “They Don’t Capture Faces” Dodge

Flock Safety and its retail clients often note that ALPR cameras do not capture driver or passenger faces — framing this as a meaningful privacy protection. It isn’t, in any practical sense.

A license plate is a vehicle identifier that maps directly to an owner’s name and address through DMV records, which law enforcement can access trivially. Knowing that plate XYZ123 visited a Home Depot in Burbank on March 15 at 10:47 AM, then an urgent care clinic on Ventura Boulevard at 11:32 AM, then a pharmacy at 12:15 PM, tells a detailed story about the vehicle’s owner without ever seeing their face. Add historical plate data across weeks or months, and you have a behavioral profile as intimate as anything geofence warrants produce.

The Supreme Court in Carpenter v. United States (2018) recognized that persistent location tracking “provides an intimate window into a person’s life” — a window that “reveals not only his particular movements, but through them his familial, political, professional, religious, and sexual associations.” License plate records assembled over time achieve the same result. The fact that the surveillance device doesn’t look like a face camera doesn’t change what the data reveals.

There are no signs posted at the entrance to most Home Depot parking lots informing customers that their vehicle data is being captured and may be shared with law enforcement. Customers who park there have not been asked for consent. They have not been told that a networked surveillance camera is logging their visit, that the data may persist for an indefinite period, or that it may be accessed by agencies whose jurisdiction has nothing to do with retail theft.

This is not an accident. The lack of notice is a feature of how this surveillance model has expanded — quietly, through business decisions made without public deliberation, at facilities that millions of Americans use as part of ordinary daily life. You don’t consent to location tracking when you shop for lumber. But under the current framework, the absence of an explicit opt-out is treated as consent by default.

California’s ALPR statute was designed to require at least minimal transparency and accountability. The lawsuits now pending suggest those requirements are being routinely ignored.

What This Means For You

The Home Depot lawsuit is not really about one retailer. It’s about the infrastructure beneath a surveillance model that has expanded to encompass grocery stores, apartment complexes, neighborhood entrances, and public streets — all feeding the same networked databases that law enforcement agencies access with minimal oversight and no warrant requirement.

A few practical considerations:

Assume your parking lot visits are logged. If you’re visiting any large retailer, there’s a reasonable chance your plate is being captured, timestamped, and shared. This is especially true in urban areas where Flock Safety deployments are concentrated.

Your plate is your identity. Don’t be reassured by “we don’t capture faces.” A plate tied to your name is functionally equivalent to a name for law enforcement query purposes.

The privacy policy isn’t protecting you. Corporate privacy policies that don’t name a data custodian, set no retention schedule, and place no restrictions on federal access are not meaningful protections — they’re documents that lawyers have written to satisfy a minimum disclosure obligation while preserving maximum operational flexibility.

Support state-level enforcement. California’s ALPR statute gives residents real rights — but only if they’re enforced. The lawsuits now pending are attempting to do that enforcement. Supporting privacy litigation, public records requests about local ALPR deployments, and legislative requirements for mandatory public notice at camera locations are the levers available.

Ask your city council. Local government often has no idea how extensively private ALPR cameras in their jurisdiction feed the Flock Safety network. A public records request for any agreements between your local police department and Flock Safety, or for the number of cameras your department can query, is information worth having.

The Home Depot parking lot was always watched for shoplifters. What’s new is that it’s now feeding a national surveillance network with no meaningful controls, no public notice, and — if the lawsuits are right — no compliance with the law that was supposed to limit all of this.

Protect Your Privacy

Retail parking lots are just one node in a sprawling surveillance network most people never see. Resources for understanding and defending your location privacy:

  • Location data tracking and mobile privacy — Step-by-step guidance for limiting how your devices and behaviors are tracked: MyPrivacy.blog
  • Surveillance law and compliance frameworks — How ALPR laws, data broker regulations, and state privacy statutes actually work: ComplianceHub.wiki
  • Corporate and government data exposure tracking — Breach and surveillance incident reporting: Breached.company

For organizations navigating ALPR warrant compliance, law enforcement data requests, and retail surveillance governance, CISO Marketplace provides privacy program assessment and vCISO consulting.

Sources: Class action complaint filed April 2, 2026, Sacramento County Superior Court; 404 Media reporting on Home Depot and Lowe’s Flock Safety deployments; State of Surveillance reporting on Flock Safety federal data sharing; Daily Journal coverage of Home Depot lawsuit; Gibbs Mura class action filing via BusinessWire; California Vehicle Code § 1798.90.5; Carpenter v. United States, 585 U.S. 296 (2018); Hoodline reporting on LAPD Flock lawsuit.