In December, we documented how Flock Safety rewrote its Terms & Conditions to strip data ownership from customers, expand its intellectual property claims to cover virtually everything its system touches, and move the entire contract onto a vendor-controlled website where it can be changed at will.
Note
February 17, 2026 update
Flock addressed the points below in a blog post, “Flock Provides Terms & Conditions Update to Make Definitions Simpler and Provide Customer Clarity.”
I have added a new section below to explain how that blog does not meaningfully contradict anything here.
On February 16, 2026, Flock updated those terms again. The new version cleans up the structural contradictions in the December terms and locks in a set of provisions that are, in nearly every respect, worse for customers. It includes mandatory arbitration, moves disputes into the state of Georgia, and strips language that could hinder data sales.
The comparison report shows 147 changes across 96 replacements, 21 insertions, and 30 deletions. The document grew from 12 to 15 pages.
Data Ownership: The Elegant Swindle
The December terms pulled an awkward trick. They defined “Footage” separately,[1] excluded it from “Customer Data,” and then told customers they owned “Customer Data” — just not the actual images, video, and audio “their” cameras captured. It was clumsy, and it was obvious.
The February terms fix the clumsiness, but leave the harm.
“Footage” is no longer a defined term. It’s gone. “Customer Data” is redefined to include:
all (a) data and information captured by Flock Hardware on behalf of Customer through the Flock Services (e.g., images, audio, and/or video) and the metadata associated therewith[2]
On paper, this looks like a win — footage is back inside Customer Data! Customers own their data again!
Not quite. Two things happened simultaneously.
First, the December commitment that “Flock does not own and shall not sell Customer Data” was deleted. That sentence no longer appears anywhere in the contract.
Second, the data license was expanded. December granted Flock:
a limited, non-exclusive, royalty-free, irrevocable, worldwide license to use the Customer Data and perform all acts as may be necessary for Flock to provide the Flock Services to Customer[3]
February grants Flock:
a limited, non-exclusive, royalty-free, irrevocable, perpetual, worldwide license to (a) use and disclose Customer Data to provide the Flock Services; and (b) use Customer Data to support and improve Flock’s products and services[4]
That’s two critical additions. The license is now perpetual — it doesn’t expire when the contract ends. And clause (b) allows Flock to use all Customer Data, including the footage it just folded back in, for its own product development. No restrictions. No limitations.
In December, customers owned the metadata but not the footage. In February, customers “own” everything — but Flock has a perpetual, irrevocable license to use all of it for anything it wants, forever.
The customer owns the house. Flock has a permanent, rent-free key.
Training Data Guardrails: Deleted
The December terms, for all their problems, included a detailed Training Data section[5] with ostensible privacy commitments: images “stripped of all metadata and identifying information,” used “solely for the limited purpose of improving the Flock Services through machine learning,” “never sold or shared with third parties,” and “maintained separately and never combined in a manner that would render it personally identifiable.”
February deletes all of it. Section 4.3 is gone. In its place: clause (b) of the new data license — “use Customer Data to support and improve Flock’s products and services.”
Every guardrail the December terms promised for machine learning training has been removed:
- De-identification? Not required.
- Separate maintenance? Not required.
- Limited to “a small fraction of images”? No — the license covers all Customer Data.
- “Never sold or shared with third parties”? That commitment no longer exists.
The scope of data available for product development expanded from “a small fraction of images” stripped of identifying information, to the entire corpus of Customer Data — including footage, metadata, license plate numbers, timestamps, and geospatial coordinates — with no privacy restrictions whatsoever.
Governing Law: Georgia on Everyone’s Mind
This is the most significant net-new change the February terms introduce.
The December terms used the law of the state where the customer is located, with venue in that state’s courts.[6] This was a standard and customer-favorable provision, particularly for government agencies that may have statutory rights to litigate in their home jurisdictions.
February replaces this with:
The Agreement … shall be governed exclusively by, and construed and enforced in accordance with, the laws of the State of Georgia, without regard to its conflicts of laws principles.[7]
And it doesn’t stop at choice of law. The December terms contemplated normal court litigation. February imposes mandatory mediation followed by binding arbitration through the American Arbitration Association:
If any Dispute cannot be settled through direct discussions, the Parties agree to endeavor first to settle such Dispute by mediation administered by the American Arbitration Association under its Commercial Mediation Procedures before resorting to arbitration. The Parties further agree that any Dispute that remains unresolved by mediation shall be settled by arbitration.[7:1]
For a government agency in Iowa, or California, or any state that isn’t Georgia, this means: if Flock breaches the contract, you don’t get to sue in your own courts under your own laws. You mediate, then arbitrate, under Georgia law, through the AAA.
Many state and local governments have statutes requiring government contracts to be governed by local law and adjudicated in local courts. Whether a mandatory arbitration clause in click-through terms can override those requirements is an open question — but one that a city’s attorney should be answering before the Order Form hits the consent agenda, not after.
Iowa’s Arbitration Statute: A Potential Defense
Although this will vary from state to state, for Iowa municipalities in particular, the mandatory arbitration clause may not survive contact with Iowa Code §679A.1(2). That statute provides that arbitration clauses for future controversies do not apply to “take it or leave it” contracts of adhesion.[8]
Given the mechanism we’ve documented — Flock posts terms on its website, changes them at will, blocks Wayback Machine archiving, and requires cities to accept them via Order Form signature with no negotiation — there is a strong argument these qualify.
Iowa law also excludes tort claims from mandatory arbitration unless there is a separate writing executed by all parties specifically agreeing to arbitrate torts.[9] Flock’s T&C is a single document — there is no separate tort arbitration agreement.
So if a city has a negligence claim against Flock — say, a data breach caused by failure to maintain reasonable security — the arbitration clause may not reach it under Iowa law regardless of whether the contract is adhesive.[10]
Unfortunately, the taxpayer would be on the hook for the litigation—which could exceed the cost of the contract—either way.
Liability: The Gross Negligence Loophole Closes
The December terms capped Flock’s liability at 12 months of fees — standard SaaS boilerplate. But they included a critical exception:
NOTWITHSTANDING ANYTHING TO THE CONTRARY, THE FOREGOING LIMITATIONS OF LIABILITY SHALL NOT APPLY (I) IN THE EVENT OF GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, OR (II) INDEMNIFICATION OBLIGATIONS.[11]
February deletes this exception entirely.
Under the new terms, Flock’s liability is capped at 12 months of fees even if Flock acts with gross negligence or willful misconduct. If Flock deliberately or recklessly causes harm — say, through a data breach caused by knowing failure to maintain reasonable security — the customer’s maximum recovery is whatever it paid in the prior year.
The indemnification provisions are gone too. December’s §9.3 required Flock to indemnify customers for IP infringement claims and installation damage. February eliminates all indemnification language — Flock’s and the customer’s.
The removal of customer indemnity (which I flagged in December as a new and concerning addition) is technically customer-favorable in isolation.
The overall trade — dropping indemnification entirely while also removing the gross negligence exception — leaves customers in a strictly worse position.
Non-Appropriation: From Exit Ramp to Dead End
The December terms allowed government customers to terminate for non-appropriation with 30 days’ written notice “without penalty or other cost.”[12]
February adds two restrictions:
Customer shall remain responsible for all amounts incurred prior to termination, and non-appropriation shall not be based on discretionary budget decisions or operate as a termination for convenience right.[13]
The “discretionary budget decisions” language is the operative weapon here. When a city council decides not to fund a surveillance program, is that a “discretionary budget decision”?
Almost by definition, yes.
This provision appears designed to prevent government customers from using non-appropriation as an exit ramp when they simply decide they no longer want the service — which is, of course, the entire point of non-appropriation clauses.
The Constitutional Problem
In Iowa (and many other states), the non-appropriation clause isn’t a negotiating courtesy but the mechanism that keeps multi-year vendor contracts from being classified as “debt” under constitutional limits.
Debt levels for local governments can be capped.[14] The standard way to keep a multi-year contract outside that cap is the non-appropriation clause: because the government can walk away if funds aren’t appropriated, the contract is a “current expense” rather than an enforceable multi-year debt obligation.
Iowa’s Department of Administrative Services procurement manual states that service contracts crossing fiscal year lines “should include a non-appropriation provision.”[15] The Iowa League of Cities’ model debt policy is even more direct: certain agreements “must contain ‘annual appropriation’ provisions so that the agreement does not count against the city’s constitutional debt limit.”[16]
If Flock’s restrictive language effectively nullifies the non-appropriation clause — by preventing cities from exercising it whenever the non-appropriation results from a “discretionary budget decision” — then the contract arguably creates an enforceable multi-year financial obligation.
That’s debt.
And if it’s debt, it may count against the constitutional cap, or worse, may require voter approval that was never obtained.
A Flock contract is unlikely to push a city over its debt limit on its own. But the principle matters: if a vendor can contractually prohibit a municipality from exercising its non-appropriation right, the constitutional protection is meaningless. Every vendor can do it. The debt limit becomes advisory.
Cities should ask their attorneys a simple question before signing: does this non-appropriation clause actually let us non-appropriate?
What Got Better
In the interest of completeness: a few changes are at least facially customer-favorable.
IP non-infringement warranty. February adds a new warranty that Flock’s services don’t infringe valid U.S. patents or registered copyrights.[17] This is a real addition, though the carve-outs for customer combinations and customer breaches are standard.
Insurance specifics. December referenced a vague “Exhibit B” for insurance. February adds a detailed Exhibit A specifying $1M/$2M commercial general liability, $1M auto, $5M professional liability/E&O, and $5M cyber liability.[18] Actual numbers are better than vague promises.
Retention Period coverage. December’s Retention Period applied to “Customer Data” (which excluded Footage), creating the implicit permission for indefinite footage retention that we identified in our previous analysis. February redefines the Retention Period to cover “footage captured by the Flock Hardware or Customer Hardware via the Flock Services and the associated metadata.”[19] This theoretically closes that gap — though the period itself is still “as specified in the applicable Order Form,” which means Flock and the customer still negotiate it (or don’t) separately.
The Pattern
The December revision was the hostile restructuring. February is the cleanup.
December moved contract terms online, carved footage out of customer data, and expanded Flock’s IP claims. But it left contradictions and rough edges — the Training Data section still promised privacy guardrails that the rest of the contract was busy undermining; the governing law provision still favored customers; the liability cap still had exceptions for truly bad behavior.
February resolves those contradictions. Every resolution favors Flock.
The terms are now internally consistent: Flock has a perpetual, irrevocable license to all customer data for any purpose; disputes go to Georgia-law arbitration; liability is hard-capped regardless of fault; and the non-appropriation exit for government customers has been narrowed to the point where it may not function as intended — raising questions about whether these contracts create unconstitutional debt obligations for the municipalities that sign them.
Flock’s marketing materials, as of this writing, continue to claim that “Customers own 100% of the data collected.” The February contract no longer directly contradicts that claim but it does make it an elegant lie.
Flock Loblaw’s Law Blog
This section was added February 17, 2026. The points below address Flock’s blog post.
A Simpler, Clearer Definition of “Customer Data”
Agreed. It’s simple, it’s clear: there’s one big bucket of Customer Data and Flock gets a license to do whatever it wants with it.
Flock Does Not Own or Sell Customer Data
James Cameron owns the movie Titanic, but Walt Disney and Paramount can still charge me to see it. Cameron licensed the movie to them—to “support and improve their services.”
Ownership is irrelevant when the license grants control.
Clarifying the “Perpetual” License
First, “[t]his is a standard software industry provision” should hold no weight here. According to Flock (when it suits), we are dealing with sensitive criminal justice information and information that can jeopardize officer safety. Let’s not base protections on Silicon Valley trends.
The right to use data to support and improve those services must extend beyond the duration of a single customer’s contract.
Why? Why does Customer Data need to be used beyond the duration of the contract to “support and improve products and services”? It would be one thing to hang on to, say, user-submitted feedback, but that category was deleted in favor of the simplified “Customer Data” that includes the footage.
Removing that distinction is a choice.
Updates Around Disclosure Provisions
Similar to the “Customer Data” simplification, this deletes specific disclosure rules for each category of data in favor of a single simple and clear rule: “we can disclose what we want when we want to whomever we want.”
Governing Law
The updated Terms specify Georgia law as the governing law for the agreement, which is standard commercial practice
Standard practice or not, up until two days ago Flock “agree[d] that venue would be proper in the chosen courts of the State of which the Customer is located.”
Flock then quickly fast-forwards on the part where binding arbitration is now mandatory and Georgia law governs. This removes the contract from the state that its local government customers operate under.
Whether the actual arbitration ultimately happens at a Ramada in Des Moines or in a boardroom in Atlanta is irrelevant: the point is that anyone with a contract dispute must now hire a Georgia lawyer to play an Away game.
Standard Terms, Collaborative Approach
Finally, Flock claims it’s happy to negotiate while it continues to make its customers sign order forms that reference the terms on its website—where it can (and just did) update them at any time.
Updated February 18, 2026: Added “Section text” links. Added some clarifying statements.
I am not an attorney. This analysis reflects my interpretation of contract language and is subject to change. Cities should consult qualified attorneys regarding their specific agreements.
December 2025 T&C, §1.11: “‘Footage’ means still images, video, audio, and other raw data captured by the Flock Hardware or Customer Hardware via the Flock Services.” ↩︎
February 2026 T&C, §1.6. ↩︎
December 2025 T&C, §4.1. ↩︎
February 2026 T&C, §4.1. ↩︎
December 2025 T&C, §4.3. ↩︎
December 2025 T&C, §11.6. ↩︎
Iowa Code §679A.1(2)(a). The statute provides that mandatory arbitration clauses for future controversies “shall not apply to … [a] contract of adhesion.” ↩︎
Iowa Code §679A.1(2)©: arbitration clauses do not apply to “any claim sounding in tort whether or not involving a breach of contract” unless “otherwise provided in a separate writing executed by all parties to the contract.” ↩︎
The Iowa Supreme Court confirmed this framework when the court ordered contract claims to arbitration but denied arbitration of the tort claim because §679A.1(2)© excludes torts absent a separate writing. See Wesley Retirement Services v. Hansen Lind Meyer, 594 N.W.2d 22, 26 (Iowa 1999) ↩︎
December 2025 T&C, §9.1. ↩︎
December 2025 T&C, §11.15. ↩︎
February 2026 T&C, §11.12. ↩︎
Iowa Constitution, Article XI, §3: “No county, or other political corporation or subdivision of the State, shall be allowed to become indebted in any manner, or for any purpose, to an amount, in the aggregate, exceeding five per centum on the value of the taxable property within such county or subdivision.” ↩︎
Iowa Department of Administrative Services, Procurement Manual, Chapter 7: “Service contracts may cross biennial and fiscal year lines, and, when they do, the contract should include a non-appropriation provision.” ↩︎
Iowa League of Cities, Debt Policy Model: TIF development agreements “must contain ‘annual appropriation’ provisions so that the agreement does not count against the city’s constitutional debt limit.” ↩︎
February 2026 T&C, §8.2(a). ↩︎
February 2026 T&C, Exhibit A. ↩︎
February 2026 T&C, §1.19. ↩︎