Major home improvement retailers have installed AI-powered cameras in their parking lots that log every shopper's license plate, and in some cases, local police can search the resulting database without a warrant.
Home Depot and Lowe's stores across multiple states now use automated license plate reader systems built by a surveillance firm called Flock Safety. The cameras capture not just plate numbers but also the make, model, and color of every vehicle that enters or exits a store parking lot. The data flows into a searchable database, one that law enforcement agencies have tapped into with little public oversight and fewer legal guardrails than govern police-owned surveillance equipment.
The rollout has already triggered a class action lawsuit in California federal court, new state legislation in Connecticut, and pointed questions from privacy advocates about what happens when private corporations build surveillance infrastructure that doubles as a law enforcement tool. For the millions of Americans who stop at Home Depot or Lowe's on any given weekend, the cameras raise a simple question: when did buying lumber become grounds for government tracking?
The scope of the data-sharing arrangements came into sharper focus through reporting by the New York Post. A Texas sheriff's office had searchable access to data from hundreds of Flock Safety cameras tied to both Lowe's and Home Depot locations. That access did not require a warrant. It did not require probable cause. It required a login.
The cameras have been deployed in states including California, Texas, and Connecticut. Flock Safety, the Atlanta-based firm behind the technology, says its system automatically deletes data after 30 days by default, keeps data-sharing toggled off unless a client opts in, and logs every search in what the company calls an "immutable audit trail."
Those safeguards sound reasonable on paper. In practice, privacy advocates say the architecture invites abuse. Robert McWhirter, a constitutional historian and criminal defense lawyer, told the Post the central concern is straightforward:
"The key issue is the relationship with law enforcement and what these companies do with the data in their relationship with law enforcement."
Home Depot has offered a carefully worded defense. A company spokesperson said the cameras "are used solely as a security measure to prevent theft and protect the safety of our customers and associates." The spokesperson added one notable qualifier: "We do not grant access to our license plate readers to federal law enforcement."
That distinction, federal versus local, matters. It means local and state police may still access the data, even as the company positions itself as a responsible steward of customer information. And Fox News reported that the regulatory framework governing private retail use of these cameras is far less stringent than the rules applied to police-owned systems.
Connecticut moved faster than most states. Lawmakers passed new ALPR rules that limit out-of-state data sharing by police departments and explicitly prohibit using the technology for immigration enforcement. On the surface, it looked like a meaningful check on surveillance creep.
But the rules apply to police-operated cameras. They do not directly govern private companies running identical technology in retail parking lots a few miles away. Home Depot and Lowe's stores in Connecticut have installed Flock Safety cameras that capture plates, vehicle descriptions, and timestamps as shoppers come and go, all outside the new law's reach.
That gap is not an accident. It reflects a regulatory blind spot that has grown wider as private-sector surveillance technology outpaces the laws written to constrain it. Lawmakers in both parties have started pushing back, calling for warrant requirements and funding cuts tied to Flock Safety deployments. But legislation moves slowly, and cameras go up fast.
The transparency problem compounds the legal one. Shoppers walking into a Home Depot in Hartford or Bridgeport have no practical way of knowing their plate was scanned, how long the record will exist, or which law enforcement agencies might pull it up later. Flock Safety says the default retention window is 30 days. But "default" is not "mandatory," and retailers can negotiate different terms.
Home Depot now faces a class action lawsuit filed in California federal court. The complaint alleges the company operated a covert surveillance system that fed customer vehicle data into a law enforcement-accessible database, without meaningful notice or consent.
The lawsuit targets the core of the arrangement: a private retailer collecting data on lawful shoppers and making it available to government agencies through a third-party intermediary. That structure sidesteps the Fourth Amendment protections that would apply if police installed the cameras themselves. The open-database model has drawn scrutiny precisely because it lets law enforcement access surveillance data without the procedural hurdles, warrants, subpoenas, judicial review, that exist for a reason.
Home Depot's public statements have not addressed the lawsuit's central allegation directly. The company's spokesperson repeated that the cameras serve a security purpose and that federal law enforcement does not receive access. The lawsuit will test whether that framing holds up when a judge examines the actual data-sharing agreements.
The retailer is not alone in expanding parking-lot surveillance. Walmart, Target, and other major chains have also drawn scrutiny for deploying similar camera systems, suggesting the practice has become an industry norm rather than an outlier experiment.
Nobody disputes that retail theft is a serious and growing problem. Organized shoplifting rings have cost retailers billions. Employees face threats. Customers deserve safe stores. The impulse to fight back with better technology is understandable, and retailers have framed these cameras as a straightforward security upgrade no different from the parking-lot cameras they have used for years.
But a traditional security camera records footage that sits on a hard drive until someone reviews it after an incident. A Flock Safety ALPR camera creates a searchable, timestamped database of vehicle movements that can be cross-referenced across locations, shared with police departments in multiple jurisdictions, and used to reconstruct where a person has been, all without that person ever being suspected of a crime.
That is not a security camera. That is a surveillance network. And when private companies build it, the constitutional limits that restrain government snooping do not automatically apply.
The broader trend is unmistakable. Retailers are layering new monitoring technologies, from surveillance-based pricing algorithms to plate readers, into the shopping experience, often without telling customers. Each system may seem modest in isolation. Together, they amount to a commercial surveillance apparatus that would have been unthinkable a decade ago.
Conservatives who rightly distrust government overreach should not look away when corporations do the government's work for it. A badge and a warrant exist for a reason. When a trip to buy paint thinner generates a police-searchable record, something has gone wrong, and it is not shoplifting.