The cannabis industry has spent a decade arguing about what data a dispensary should keep. Somewhere in that argument, the most revealing record about a cannabis consumer stopped being anything the dispensary holds. It’s the license plate that sat in the parking lot — logged, timestamped, and searchable by police in another state without a warrant.
Two things happened in the last two weeks that make this concrete.
First, reporting surfaced a Wisconsin criminal complaint in which police used Flock automated license plate reader data to establish that a man “travels to Michigan frequently” — Michigan being a legal cannabis state, Wisconsin not — and used that interstate travel pattern as part of the probable cause justification to search his car. The searches and arrest date to April 2025. The bail-jumping charge that started the whole thing was dismissed. He was convicted of one thing: marijuana possession.
Second, Texas’s reclassification of most hemp-derived THC as a Schedule I substance took effect July 31, 2026 — the ban the Texas Supreme Court cleared in May, sweeping delta-8, THCP, THCA and more off shelves and leaving only low-dose delta-9 standing. Texas is also, by advocacy-group estimates, home to more than 10,000 Flock cameras, with 206 local and county agencies now sharing data with the Department of Public Safety — up from 122 in February, a 69% jump in six months. DPS won’t say how many cameras it operates itself.
Texas borders New Mexico (adult-use legal), Oklahoma (medical), and Colorado. It just criminalized products its own residents were buying legally last month. And it has the densest ALPR network in the country pointed at its own roads.
You don’t need a conspiracy to see where that goes. You need a lookup field and a hunch.
What ALPR Actually Does to Cannabis Privacy
The technology is unremarkable and that’s the point. Cameras log every passing plate — number, make, color, sometimes bumper stickers — with time and location, into the largest vehicle-surveillance database in the country. Agencies under contract query it in a few keystrokes, generally without a warrant. Flock’s national lookup reaches across thousands of interconnected camera networks, so a deputy in one state can trace a driver’s movements in another.
Four properties make this a cannabis problem specifically:
It’s retroactive. The record exists before anyone suspects you of anything. Investigators don’t surveil a person; they query a history that was collected on everyone.
It’s inferential. Nobody logs “bought cannabis.” They log a plate at a location at a time — and location plus schedule is a diagnosis. A vehicle at a dispensary every other Tuesday morning, or crossing a state line monthly, produces exactly the kind of pattern that fills in the rest. That’s the same inference logic that makes a cannabis purchase record legally health data in most of the world — except here the inference is drawn by a police search interface rather than a privacy regulator.
It ignores your borders. Cannabis compliance is jurisdictional. ALPR networks default to sharing nationwide. Legal conduct in one state becomes probable cause in the next one over — the Wisconsin case, in one sentence.
It’s outside every consent framework you’ve built. Your privacy policy, your opt-ins, your data-minimization program, your retention schedule: none of them govern a camera on a pole across the street. The customer never agreed to anything and neither did you.
The Dispensary Doorstep Problem
If ALPR were only a highway phenomenon, it’d be a civil-liberties story and not an operator story. It isn’t. The cameras are arriving at cannabis retail specifically.
In Madison Heights, Michigan, a JARS Cannabis location had a Flock camera positioned at its site for roughly a year after opening in September 2025 — with the city expecting continuous monitoring and police data access covering the store’s parking area. The dispensary’s response was to erect a “NO FLOCK ZONE” sign directly in front of the camera to block its view, saying it shared “our community’s concerns about increased surveillance.” The city sent a letter demanding removal within 48 hours or the store would face sanctions.
Read that sequence carefully, because it inverts the industry’s usual assumption. Cannabis operators are used to surveillance mandates pointed inward — cameras on the vault, the scale, the counter, retained for the regulator. This is a surveillance mandate pointed outward, at the customer approaching the door, feeding a police database the operator doesn’t control, can’t audit, and can’t purge.
An operator facing that has a genuinely hard position: the camera is a condition of goodwill with the municipality that issues local approvals, and objecting to it looks like objecting to law enforcement. It is also, functionally, a patient registry maintained by a third party.
Who Actually Gets Hurt
Medical patients in prohibition states. The patient who drives from Texas or Wisconsin to a legal neighbor is the person the Wisconsin complaint describes. Their travel is lawful in both directions; the pattern is what gets used.
Employees and licensees. Cannabis workers commute to cannabis facilities. Plate logs at a cultivation site build a de facto staff roster — useful for a burglary crew, and useful in any dispute over who was where.
Delivery operations. A delivery vehicle’s route history maps your customer base by inference. Fleet plates plus timestamps plus repeat stops is a customer list assembled without touching your database, which is the risk beneath the ordinary driver, data, and chain-of-custody controls for delivery.
Cross-border professionals. Anyone whose employment, licensing, immigration status, or custody arrangement is cannabis-sensitive now carries a movement record they can’t see. Note that Texas ALPR data has already been reached by federal immigration agents through out-of-state departments, despite the vendor’s claims about partnerships — the “who can query this” answer is not stable.
Operators, via subpoena. Here’s the part that lands on your desk. Once a plate log establishes a vehicle at your store, your systems are the natural next request: POS records, loyalty history, delivery manifests, ID scans. ALPR turns your retained customer data into the second half of somebody else’s case. Every record you didn’t need to keep is now discoverable corroboration.
What Operators Should Actually Do
Most of this is unglamorous and cheap. None of it requires taking a political position.
1. Survey the ALPR around your sites. Walk the perimeter and identify cameras covering your entrances, exits, and parking. Community mapping projects and the audit-log lookup at Have I Been Flocked? let you check whether your own plates have been queried — with the caveat that a clean result only means no agency released logs, not that no search happened. You cannot manage an exposure you haven’t located.
2. Push back at the permit stage, not after installation. Where a municipality proposes a Flock camera covering your lot, the negotiable questions are retention period, which agencies may query, whether a warrant is required, and whether the camera’s field of view can be positioned off your customer approach. Those are ordinary siting conversations. They become unwinnable once the pole is up — as Madison Heights demonstrates.
3. Never store license plates yourself. Some POS, loyalty, and curbside-pickup systems capture plate numbers for order matching. Capture it transiently, match the order, discard it. A plate in your CRM is a mandatory-consent-category identifier under several state privacy laws, a subpoena magnet, and a breach liability — the same mistake in a different field as the ID images that produced the industry’s largest exposures. The principle is verify, don’t store, applied to vehicles.
4. Shrink everything a subpoena could reach. Retention limits on purchase history, loyalty profiles, delivery addresses, and camera footage aren’t just breach hygiene — they’re how you avoid becoming the corroborating witness against your own customer. This is the concrete version of the trade-off in seed-to-sale’s hidden privacy costs and the exposure your loyalty program quietly accumulates.
5. Write a law-enforcement request policy before you get a request. Who receives it, who reviews it for legal sufficiency, whether you require a warrant or subpoena rather than a phone call, whether you notify the customer where permitted, and what you log about the disclosure. Operators without this policy hand over more than they’re required to, under pressure, in the first ten minutes. Bolt it onto your incident response plan so it’s in the same binder.
6. Tell patients the truth, plainly. Not legal advice — a factual privacy notice: our lot may be covered by license plate readers we don’t control, ALPR data is shared across states, and here’s what we do and don’t retain. In prohibition-adjacent markets that disclosure is both an ethical obligation and, frankly, a competitive advantage.
7. Watch the Texas template. A state that criminalizes products its residents bought legally last month, while operating the country’s densest plate-reader network, is a natural experiment in enforcement-by-inference. And it’s not settled: 47 cities nationwide have terminated Flock contracts — Austin and Bandera among them — and Rep. Keith Self has proposed requiring federal agencies to get a warrant before touching the data. If Texas becomes the pattern, every prohibition state bordering a legal one inherits it, and the compliance cliff already coming for intoxicating hemp nationally arrives with a surveillance layer attached.
Bottom Line
The industry built its privacy thinking around a threat model where the operator is the custodian: collect less, encrypt it, retain it briefly, and the customer is protected. ALPR breaks that model. The most sensitive cannabis record about a person in 2026 may be one that no operator collected, no customer consented to, and no privacy policy governs — a plate, a place, a timestamp, and a search box in another state.
You can’t opt out on your customers’ behalf. You can decline to be the second half of the file: don’t store their plates, don’t hoard their purchase history, negotiate the camera before it’s installed, and know exactly what you’ll say when the request arrives.
A man in Wisconsin was convicted of possessing something that was legal where he bought it, partly because a network of cameras noticed he’d been there. That is the surveillance environment cannabis now operates in. Design your data accordingly.
Reporting on the Wisconsin case and the Madison Heights dispensary camera originated with 404 Media; Texas camera and data-sharing figures are from The Texas Tribune.
