Flock Cameras on OpenStreetMap: How DeFlock Mapped 336K ALPRs

In May 2026, the second-most-searched query containing the word OpenStreetMap on Google was about Flock cameras. That is unusual. OpenStreetMap is normally associated with hikers, transit planners, and developers who want a map without a Google Maps bill. Flock cameras are automatic licence plate readers, marketed to police forces and homeowners associations, that photograph every passing vehicle and store the data in a searchable national database.

The reason these two appeared together in the search trend is a community project called DeFlock. Over the last two years, volunteers have been crowd-sourcing the location of every Flock camera they can find and uploading the coordinates to OpenStreetMap. The result, as of 2026, is the largest open registry of surveillance infrastructure in the world: 336,000 cameras across more than 113,000 inter-agency data-sharing connections, all queryable, all auditable, all on a map anyone can open.

This guide explains what is happening, why it could only happen on OpenStreetMap, and what it means for any business that relies on location data in 2026.

What Flock Cameras Actually Do

Flock Safety is an Atlanta-based company founded in 2017. It sells small solar-powered cameras that mount on poles, photograph every passing vehicle, and run optical character recognition on the licence plate. Each detection produces a record: the plate string, a timestamp, GPS coordinates, and a "vehicle fingerprint" that captures make, colour, decals, roof racks, and bumper damage.

Customers fall into three buckets. Police departments use the records to track suspect vehicles, recover stolen cars, and run plate searches across multiple agencies. Homeowners associations and private property owners use them as a private security service, often with a direct alert pipeline to local law enforcement. Retailers and parking operators use them for asset protection and access control.

The product is technically a camera, but commercially it is a database. Customers do not pay for hardware so much as for a subscription that includes the camera, the cloud storage, and the right to search across an aggregated network of every other Flock customer's cameras. As of 2026 that aggregated network covers roughly 75,000 cameras in the United States and another 261,000 internationally.

That aggregation is what made Flock controversial. A police department in city A can search a plate observed by a homeowners association camera in city B without a warrant, because the data is pooled by Flock under a single contractual umbrella. Civil-liberties groups argue this constitutes a de-facto national vehicle surveillance network operated by a private vendor outside the constitutional framework that normally constrains police data sharing.

What DeFlock Is

DeFlock is a community-run mapping project at deflock.me. Volunteers walk, cycle, or drive their neighbourhoods, photograph every Flock-style camera they pass, and add a point to OpenStreetMap with a small set of tags.

The canonical tag set is straightforward:

man_made=surveillance
surveillance:type=ALPR
manufacturer=Flock Safety

Once the tag is committed, the camera shows up worldwide on any tool that queries OpenStreetMap. DeFlock itself uses the Overpass API to pull every node tagged surveillance:type=ALPR and render it on a Leaflet map. Other projects do the same, including the Johnson City ALPR Mapping Project for Tennessee and Banish Big Brother for the Bay Area.

The scale is what is striking. By early 2026, the OpenStreetMap registry of ALPR-tagged nodes had passed 336,000 worldwide. That number includes Flock cameras and a long tail of other vendors (Motorola Vigilant, Axon Fleet, Genetec) but Flock dominates. Coverage is uneven, with US metro areas heavily mapped and rural zones partially mapped, but the trend is monotonic: the registry only grows.

The contributor base is heterogeneous. Some are privacy activists. Some are journalists. Some are OSM hobbyists who tag everything they see and added ALPR cameras to their tagging routine because the schema was already there. The decentralised nature of OSM is the point: no single organisation owns the registry, and no single organisation can take it down.

Why It Had To Be OpenStreetMap

A reasonable question is why this registry exists on OpenStreetMap rather than on Google Maps, Apple Maps, or a purpose-built website.

The website-only option was tried and abandoned by several of the early Flock-mapping projects. A standalone site means a single point of failure. If the operator gets a takedown letter, sells the project, or simply gets bored, the data goes with them. OpenStreetMap is durable in a way a single website is not, because the data lives in a distributed planet file replicated worldwide and any user can re-render it.

Google Maps and Apple Maps are non-starters for this kind of project. Both are closed proprietary datasets. A user can suggest an edit but the operator decides whether to accept it. Neither has a tag for ALPR cameras in the public-facing schema, and neither would accept a community campaign to add 336,000 new points of "surveillance camera" to their consumer maps. The decision belongs to Google and Apple, not to the public.

OpenStreetMap is structurally different. The schema is open, the editing is open, and the database is open. A tagging convention can be proposed on the OSM Wiki, debated in the community, and put into use the same week. The surveillance:type=ALPR tag has been documented since 2019. Once a tag exists and a community adopts it, the registry effectively builds itself.

This is the same dynamic that has made OpenStreetMap the default base layer for humanitarian mapping (HOT OSM after disasters), accessibility mapping (Wheelmap), and now surveillance accountability mapping. Open data infrastructure does not just route packages or tile maps. It enables categories of public-interest project that closed maps cannot.

The 2026 Inflection Points

Two events in 2026 turned a niche tagging project into a search trend.

In February, the Mountain View City Council in California voted to end the city's contract with Flock Safety. An internal audit had found that federal agencies, including ICE, had accessed Mountain View's Flock data through inter-agency search even though the city's policy explicitly prohibited federal access. The vote was unanimous. Mountain View was not the first municipality to wrestle with this question, but it was a high-profile early decision and it triggered audits in at least two dozen other cities.

In March, the San Francisco Standard published a tool that overlays the Flock camera registry from OpenStreetMap onto an Apple Maps routing layer, letting a Bay Area resident enter an origin and destination and see exactly which cameras would record their car along the route. The tool went viral. Local TV picked it up. Privacy publications picked it up. The DeFlock project saw a step-function increase in contributors and the search volume spike that brought us here.

The combination of these two events did something that years of activism had not: it moved the camera registry from a niche dataset into a mainstream civic-tech artefact. By April 2026, ALPR mapping was a topic on Reddit's r/AskReddit, on local-news segments, and on the regulatory agendas of half the West Coast city councils.

What This Means for Businesses Using Location Data

If your product uses location data in 2026, the DeFlock story matters even if your product has nothing to do with surveillance.

The first lesson is about data provenance. Customers, regulators, and journalists are now actively investigating where location data comes from, how it is shared, and who has access. Flock built a 336,000-camera private-government data pipeline largely without public scrutiny until 2026. The reaction will reshape what corporate buyers, municipalities, and consumers expect from any vendor that handles location data. Vague answers about "anonymised" or "aggregated" no longer pass.

The second lesson is about open versus closed. The reason DeFlock exists on OpenStreetMap and not on Google Maps is not coincidence: it reflects a structural property of open data infrastructure. As similar accountability projects emerge (around delivery-driver surveillance, gig-worker tracking, retail biometrics), they will gravitate to open map platforms for the same reason. A business that has built on a single closed maps provider has accepted a single point of editorial control. A business that has built on, or alongside, OpenStreetMap has not.

The third lesson is about EU regulatory exposure. Most ALPR deployments in the EU sit under tighter rules than in the US: GDPR treats licence plates as personal data when combined with location and time, and several EU member states require formal data-protection impact assessments before deploying ALPR. The current European caselaw is moving toward a presumption that vehicle-by-vehicle tracking requires explicit lawful basis. A US-style aggregated network would not survive a single GDPR audit. Any business deploying location data products into the EU should treat the ALPR debate as a leading indicator of the questions auditors will ask about other location-data systems.

The Tag That Made It Possible

It is worth spending a moment on the OpenStreetMap tag itself, because the technical decision is what enabled the social outcome.

surveillance:type was documented on the OSM Wiki in 2019 with values including ALPR, camera, mast, and camera_post. Each value comes with sub-tags that describe the device: orientation, height, manufacturer, ownership, retention policy where known. A camera is a node in the graph, not a separate dataset, which means it inherits all of OSM's normal tooling: history, attribution, geocoding, tile rendering.

That last property is the one that turned out to matter. Because ALPR cameras are first-class OSM features, any geocoder, routing engine, or map-styling tool that consumes OSM can show them. A developer can ask the OpenStreetMap geocoding API where the nearest ALPR camera is to a given point with a single Overpass query. A routing engine can be configured to avoid ALPR-dense streets. A custom map style can render them as red dots. None of this required Flock, Google, or Apple to do anything. The community made a tag, populated it, and the rest of the open-source mapping ecosystem already knew how to render it.

This is the part that should interest anyone building location products. The same tag-and-render pattern works for any feature you can describe with a small schema and motivate a community to populate. ALPR cameras today, EV chargers a decade ago, defibrillators five years ago. The bottleneck is rarely technology. It is consensus on a tag and a community willing to walk the streets.

Where This Goes Next

The DeFlock movement is unlikely to slow down in the second half of 2026. Three vectors are visible.

First, more cities will follow Mountain View. The audits underway in Oakland, Berkeley, and several Bay Area municipalities are likely to surface similar federal-access findings. Each contract cancellation drives a press cycle, which drives more contributors to OSM.

Second, the registry is starting to be used as evidence. Civil-rights litigation is now citing the OpenStreetMap camera count by jurisdiction to argue de-facto mass surveillance. The crowd-sourced map has become court-admissible factual material.

Third, vendors are responding. Flock has begun pushing back through legal channels in some jurisdictions, arguing that mapping their cameras is misleading or commercially harmful. To date these arguments have gone nowhere because the cameras are visible from public space and recording public-facing infrastructure has long-established First Amendment protection in the US. The European version of this fight is yet to come.

What is durable, regardless of how the fights resolve, is the underlying pattern: open map data plus a small dedicated community can produce, in 2-3 years, a global registry of any visible category of infrastructure. ALPR cameras are the demonstration. The next demonstration will involve something else.

For anyone building map-driven products, the lesson is the same one that has been quietly true for a decade and is now becoming loud: open map data is not just a cheaper alternative to closed maps. It is structurally different infrastructure, and the difference shows up in the kind of public-interest projects that build on top of it. Closed maps could not produce DeFlock. Open maps did, in two years, with no funding.