The Fourth Amendment Wasn't Written for Flock Cameras: U.S. Law from D.C. to City Hall

When most of us worry about a camera that never forgets, we reach for a comforting thought: surely there's a law for this. The Fourth Amendment guards against unreasonable searches. We learned it in school, we've heard it in a hundred courtroom dramas, and it feels like bedrock. If the police want to follow you, they need a warrant — and a warrant needs a judge.

It's a fair instinct, and it isn't wrong so much as it's incomplete. So sit with three questions. If the Constitution already covers this, why did a federal judge in Norfolk, Virginia rule in 2026 that a network of cameras logging every passing license plate is not a search at all?¹ Why has Congress introduced a bill to limit federal face recognition four times in five years and passed it zero?²,³ And why can a government agency simply buy location data from a broker that it would need a warrant to seize directly? The honest answer is the one the school-day version leaves out: the Fourth Amendment was written for a world of physical trespass — a constable at your door, a hand in your pocket — and AI surveillance was built, almost by accident, to slip through exactly the seams that doctrine leaves open. A lock can be excellent and still guard the wrong entrance while the visitor walks in through the network.

So the law on AI surveillance is best understood as a two-altitude story. High overhead sits the Constitution, straining to stretch an 18th-century principle over 21st-century machines. Down on the ground sits a patchwork of cities and states improvising in the gap. Let's take them one at a time, because the view is genuinely different from each.

Overhead: the Constitution strains

The modern story starts with a win for privacy. In Carpenter v. United States (2018), the Supreme Court held that police need a warrant to obtain the historical cell-site location records that map a person's movements, because an individual "maintains a legitimate expectation of privacy in the record of his physical movements."¹ The old rule — that anything you hand to a third party (your phone company, your bank) loses its protection — doesn't stretch, the Court said, to a "detailed, encyclopedic, and effortlessly compiled" diary of everywhere you've been. Six years earlier, in United States v. Jones, five justices had already signaled the worry in concurrences: that aggregating enough individually-innocent data points — the "mosaic" — can reveal something the law should protect, even when no single tile would.⁴

That sounds like a tidy principle. Watch what happens when courts try to apply it to the cameras actually being installed. In 2021, the full Fourth Circuit struck down Baltimore's aerial-surveillance program — planes photographing most of the city for hours a day — precisely because it let police reconstruct "the whole of individuals' movements," exactly the harm Carpenter named.⁵ Then in early 2026, a federal judge in the same circuit looked at Norfolk's network of Flock license-plate readers — by the court's count, roughly 75 camera clusters holding 21 days of data — and reached the opposite result: not a search, because it doesn't track "the whole of a person's movements" or open an "intimate window" into where citizens "drive, park, visit, linger, sleep, or patronize."¹ The plaintiffs, represented by the Institute for Justice, are appealing.¹ Same constitutional text, same federal circuit, two different altitudes — and a doctrine visibly straining at the seam between "some cameras" and "enough cameras," with no one quite sure where the line falls. Massachusetts' high court had already conceded the awkwardness in 2020, ruling that license-plate readers could become a search "with enough cameras in enough locations," while declining to say how many is enough.⁶

If the courts are improvising, you might expect Congress to write a clear rule. It hasn't. The Facial Recognition and Biometric Technology Moratorium Act has been introduced repeatedly since 2020 and has never reached a floor vote.² The one measure that gained real traction — the Fourth Amendment Is Not For Sale Act, which would stop agencies from buying the data they'd otherwise need a warrant to get — passed the House 219–199 in April 2024 and then died in the Senate.³ And the executive branch, the third actor, reversed itself inside fifteen months: a 2023 executive order установing federal AI-safety oversight was rescinded on the first day of the next administration in January 2025 and replaced with one aimed at "removing barriers" to AI.⁷ Whatever you think of the policy, the throughline is instability — the federal answer to "what are the rules?" changes with the altitude and the calendar.

On the ground: the patchwork

Because Washington left a vacuum, cities and states filled it — and they did not agree. San Francisco became the first major city to ban government use of facial recognition in 2019.⁸ New Orleans banned it in 2020, then repealed the ban in 2022 amid a crime spike, letting police use it for violent-crime investigations.⁹ Detroit built one of the densest camera networks in the country, then — after three residents were wrongfully arrested on bad face matches — adopted rules in 2024 barring arrests on a face-recognition hit alone.¹⁰ Even San Francisco, the original banner, passed a 2024 ballot measure expanding police authority to deploy cameras and surveillance tools before seeking approval.⁸ One country, opposite directions, sometimes inside the same city a few years apart.

The starkest divide is over whether an ordinary person can do anything when their biometrics are misused. In Illinois, they can: the Biometric Information Privacy Act gives residents a private right to sue, and the state's supreme court held in Rosenbach v. Six Flags (2019) that you don't have to prove a separate injury — the violation itself is enough.¹¹ That single feature is why Illinois produced the marquee outcomes: Facebook's $650 million face-tagging settlement, and the settlement that barred Clearview AI from selling its faceprint database to most private buyers nationwide.¹¹ Cross the border into Texas or Washington and you'll find biometric laws on the books too — but only the state attorney general can enforce them; the resident whose face was scanned has no door into court.¹² Your remedy depends less on what happened to you than on which state line you were standing behind when it did.

The workable middle nobody announced

Here's the part worth standing up for, because it's easy to miss in the noise. Out of all that conflict — straining courts, stalled bills, a contradictory patchwork — a rough consensus has actually been emerging about what reasonable governance looks like. It wasn't decreed from the top. It accreted from the bottom, and it has four recurring features.

First, a warrant or its equivalent for persistent tracking — the principle the Fourth Circuit drew from Carpenter: occasional observation is one thing, reconstructing the whole of someone's movements is another, and the second needs a judge.⁵ Second, community approval before acquisition: more than two dozen jurisdictions, from Boston to Cambridge to San Francisco, have adopted "Community Control Over Police Surveillance" ordinances requiring a public hearing and a council vote before police buy surveillance tech, plus an annual public report on how it was used.¹³ Third, retention limits — the recognition, increasingly common in policy if not yet in law, that data which is never deleted becomes a permanent dossier, so it shouldn't be kept indefinitely.¹⁴ Fourth, audits: a log of who searched what, so misuse can be found rather than merely denied.¹⁴

None of these requires choosing between catching the abductor and protecting the innocent. They're the procedural hinges that let a free society do both — the same way a warrant requirement never stopped a single legitimate search, it just made someone write down why.

I should disclose where I sit, since this is my field: I'm Chief Product Officer at IREX, a company that builds AI for public safety, and the views here are my own, not the company's. I come to this with a stake in the tools being used well — which is exactly why I'd rather see clear rules than a vacuum. Ambiguity isn't freedom for the people who build these systems or the people watched by them; it's just risk deferred until something breaks.

The comforting school-day belief turns out to be half right, which is the most useful kind of wrong. The Constitution does protect us here — but not automatically, and not by its 18th-century terms. It protects us only to the degree we translate its principle into rules fit for machines that never trespass because they never have to. That translation is being written right now, and not mainly in Washington — it's being written in city councils and state houses and the occasional appellate panel willing to say "enough cameras is enough." I could be wrong about how the doctrine settles; the Supreme Court has surprised everyone before and the Norfolk appeal could redraw the line again. I don't think I'm wrong that the principle is durable, even when the doctrine wobbles. The Fourth Amendment wasn't written for Flock cameras. But it was written for exactly this problem — a government that can see too much — and the work of our decade is finishing the sentence the Framers started. That's not a burden. It's an inheritance worth being equal to.

References & Sources

Superscript numbers in the text correspond to the numbered sources below. The timeline figure is an original graphic by the author, built from the cited primary records. This essay is general information about a fast-moving area of law, not legal advice; several items post-date mid-2025 and may evolve, including the pending Norfolk appeal.

1. Carpenter v. United States, 138 S. Ct. 2206 (2018) (warrant required for historical cell-site location records). supremecourt.gov. On the 2026 Norfolk ruling: Schmidt v. City of Norfolk, U.S. District Court for the Eastern District of Virginia (summary judgment for the city; Flock license-plate-reader network held not a Fourth Amendment search; decided Jan. 27, 2026; Institute for Justice appealing to the Fourth Circuit). therecord.media · valawyersweekly.com

2. Facial Recognition and Biometric Technology Moratorium Act (introduced 2020, 2021, 2023, and again June 2025; never enacted), Sens. Markey, Merkley, Sanders et al. markey.senate.gov · sanders.senate.gov

3. Fourth Amendment Is Not For Sale Act, H.R. 4639, 118th Cong. (passed House 219–199 on Apr. 17, 2024; not taken up by the Senate). congress.gov · govtrack.us

4. United States v. Jones, 565 U.S. 400 (2012) (GPS tracking a search; Alito and Sotomayor concurrences articulating the "mosaic" concern over aggregated long-term surveillance). law.cornell.edu

5. Leaders of a Beautiful Struggle v. Baltimore Police Dept., 2 F.4th 330 (4th Cir. 2021) (en banc) (warrantless aerial surveillance enabling reconstruction of "the whole" of movements held an unconstitutional search). justia.com · eff.org

6. Commonwealth v. McCarthy, 484 Mass. 493 (2020) (ALPR use could become a search "with enough cameras in enough locations"; mosaic theory). caselaw.findlaw.com

7. Executive Order 14110, "Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence" (Oct. 30, 2023); rescinded by Executive Order 14148 (Jan. 20, 2025); replaced by Executive Order 14179, "Removing Barriers to American Leadership in Artificial Intelligence" (Jan. 23, 2025). federalregister.gov · skadden.com

8. San Francisco "Stop Secret Surveillance" Ordinance (May 2019; first major U.S. city ban on government facial recognition). pbs.org. San Francisco Proposition E (Mar. 2024; expanded SFPD surveillance authority). missionlocal.org

9. New Orleans City Council vote to allow police facial recognition for violent-crime investigations, reversing its 2020 ban (July 2022). nola.com

10. Detroit Police Department new facial-recognition limits following wrongful-arrest litigation (2024). wdet.org

11. Illinois Biometric Information Privacy Act, 740 ILCS 14 (private right of action); Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186 (no separate injury required to sue). Facebook/Meta $650M BIPA settlement (2021). techcrunch.com. ACLU v. Clearview AI BIPA settlement (May 2022). aclu.org

12. Texas Capture or Use of Biometric Identifier Act, Tex. Bus. & Com. Code § 503.001, and Washington biometric privacy law, RCW 19.375 — both enforced only by the state attorney general, with no private right of action. statutes.capitol.texas.gov · app.leg.wa.gov

13. ACLU, "Community Control Over Police Surveillance" (CCOPS) — model framework adopted in two dozen-plus jurisdictions (notice, hearing, council approval, annual reporting). aclu.org · Boston CCOPS ordinance (2021). aclum.org

14. Brennan Center for Justice, "Automatic License Plate Readers: Legal Status and Policy Recommendations" (retention limits and audit recommendations). brennancenter.org