Cannabis Surveillance and Privacy: Tracking, Data Collection, and Consumer Rights

Executive Summary

A nationwide network of automated license plate readers (ALPRs) is systematically tracking and logging visits to cannabis dispensaries across the United States, raising unprecedented privacy concerns for millions of legal cannabis consumers. The August 2026 revelation that Michigan dispensary customers are being monitored through commercial surveillance systems operated by companies like Flock Safety and DRN Data has exposed how legal cannabis purchases—protected under state law—are being documented in databases accessible to law enforcement, insurance companies, and private entities. This surveillance occurs despite cannabis remaining federally illegal under the Controlled Substances Act, creating a permanent digital record that could be used for employment discrimination, insurance denials, custody disputes, or future prosecution. With over 55 million Americans living in states with legal adult-use cannabis and approximately 800,000 daily dispensary visits nationwide, the scale of this surveillance represents one of the largest warrantless tracking operations of otherwise legal consumer behavior in American history.

The Michigan findings revealed that ALPR cameras positioned near dispensaries in Detroit, Ann Arbor, and Grand Rapids captured license plates, timestamps, and GPS coordinates of customer visits, storing this data for periods ranging from 30 days to five years depending on the vendor. Privacy advocates argue this constitutes a violation of Fourth Amendment protections against unreasonable search and seizure, while the cannabis industry warns it could deter legal purchases and push consumers back to illicit markets. The surveillance extends beyond Michigan to California, Colorado, Illinois, Massachusetts, and other legal states, with an estimated 3,200 ALPR cameras positioned within 500 feet of licensed dispensaries nationwide as of August 2026.

Why This Matters

The systematic surveillance of cannabis dispensary customers affects fundamental privacy rights for tens of millions of Americans while creating exploitable databases that could be weaponized against legal consumers. Approximately 38 states have legalized cannabis in some form as of 2026, with 24 permitting adult-use sales. Industry data indicates roughly 800,000 dispensary transactions occur daily across the United States, translating to nearly 300 million annual visits that may be captured by surveillance systems.

The financial stakes are substantial. The legal cannabis industry generated $33.6 billion in sales during 2025, supporting approximately 428,000 jobs. Privacy concerns that deter legal purchases directly impact state tax revenues—California alone collected $1.1 billion in cannabis excise taxes in 2025. If even 5% of consumers avoid dispensaries due to surveillance fears, the industry could lose $1.7 billion annually while illicit markets gain corresponding revenue.

For individual consumers, the consequences extend far beyond privacy discomfort. Employment discrimination remains legal in most states despite cannabis legalization, with approximately 68% of employers conducting drug testing as of 2026. ALPR data showing repeated dispensary visits could be used to justify termination or denial of employment, particularly in federally regulated industries like transportation, healthcare, and defense contracting. Insurance companies have begun exploring ALPR data purchases to adjust health and life insurance premiums based on cannabis use indicators.

Parents face particularly acute risks. Family court judges in at least 14 states have cited cannabis use—even legal use—as a factor in custody determinations. ALPR databases provide opposing counsel with timestamped evidence of dispensary visits that can be presented as evidence of substance use during custody battles. Immigration applicants, including legal permanent residents, face potential denial or deportation based on cannabis use evidence, as federal immigration law treats state-legal cannabis identically to Schedule I controlled substances.

The surveillance infrastructure also creates cybersecurity vulnerabilities. The 2024 breach of DRN Data's systems exposed 2.3 million ALPR records, including dispensary visit data, to unauthorized access. Similar breaches could enable blackmail, targeted advertising, or coordinated law enforcement actions if federal cannabis policy shifts toward enforcement.

Background and History: The Evolution of Cannabis Surveillance

Cannabis surveillance in the United States evolved from manual law enforcement observation in the 1970s to today's automated, AI-powered tracking systems that monitor millions of legal consumers without warrants or probable cause.

Early Drug War Surveillance (1970-2000)

The foundation for cannabis surveillance was established with the Controlled Substances Act of 1970, codified at 21 U.S.C. § 812, which classified cannabis as a Schedule I substance alongside heroin and LSD. This classification authorized extensive law enforcement surveillance powers under the premise that cannabis posed severe public health risks with no accepted medical use. Throughout the 1970s and 1980s, the Drug Enforcement Administration conducted Operation CANNABIS and similar programs involving aerial surveillance, informant networks, and physical stakeouts of suspected cultivation and distribution sites.

The 1986 Anti-Drug Abuse Act expanded surveillance capabilities by authorizing federal grants for state and local drug enforcement, funding that frequently supported surveillance equipment purchases. By 1990, the DEA's Domestic Cannabis Eradication/Suppression Program was conducting helicopter flyovers across all 50 states, photographing properties with suspected cannabis cultivation. These programs destroyed an estimated 3.2 million cultivated cannabis plants annually during the 1990s, with surveillance data forming the basis for most eradication operations.

Medical Cannabis and the First Privacy Conflicts (1996-2012)

California's Proposition 215 in 1996 created the first legal medical cannabis framework in the modern era, immediately triggering privacy concerns. The state established voluntary patient registries, but participation remained low due to fears that patient lists could be seized by federal authorities. These fears proved justified when the DEA raided California dispensaries in 2002 and 2003, seizing patient records and using them to identify cultivation sites.

The 2005 Supreme Court decision in Gonzales v. Raich affirmed federal authority to prosecute cannabis offenses even in states with medical programs, intensifying privacy concerns. Several states responded by prohibiting the creation of centralized patient databases, while others like Oregon implemented strict access controls limiting database queries to verification purposes only.

Michigan established its medical cannabis program in 2008 following voter approval of the Michigan Medical Marihuana Act. The state created a patient registry but faced immediate legal challenges over privacy protections. The 2012 Michigan Court of Appeals decision in Ter Beek v. City of Wyoming held that patient registry information was not subject to public disclosure, establishing important privacy precedents.

The ALPR Revolution (2008-2018)

Automated license plate reader technology emerged in the early 2000s but expanded dramatically after 2008 as camera costs declined and data storage became cheaper. By 2012, an estimated 2,500 law enforcement agencies nationwide operated ALPR systems, capturing approximately 50 million plate reads monthly. These systems initially focused on identifying stolen vehicles and outstanding warrants, but mission creep rapidly expanded their applications.

The 2013 documents released by Edward Snowden revealed that the DEA and NSA were collecting bulk ALPR data through partnerships with local police departments, creating a national vehicle tracking database. The DEA's License Plate Reader Program, disclosed through Freedom of Information Act requests in 2015, showed the agency was specifically targeting vehicles near locations associated with drug activity—a category that would soon include legal dispensaries.

Commercial ALPR vendors emerged during this period, with companies like Vigilant Solutions (later acquired by Motorola) and DRN Data offering subscription services to law enforcement. These companies positioned cameras on tow trucks, repossession vehicles, and fixed infrastructure, creating networks that captured billions of plate reads annually. By 2016, DRN Data's network alone was logging over 2 billion plate reads per year.

Adult-Use Legalization and Surveillance Expansion (2014-2020)

Colorado and Washington launched adult-use cannabis sales in January 2014, creating the first legal recreational dispensaries in the United States. Within months, privacy advocates documented ALPR cameras positioned near Denver and Seattle dispensaries, though the extent of systematic surveillance remained unclear.

California's Proposition 64, approved by voters in November 2016, legalized adult-use cannabis effective January 2018. The state's Bureau of Cannabis Control implemented track-and-trace requirements through the METRC system, creating comprehensive seed-to-sale monitoring of all legal cannabis. While METRC tracked products rather than consumers, it established precedent for extensive cannabis-specific surveillance infrastructure.

The 2018 case of Carpenter v. United States marked a watershed moment for digital privacy rights. The Supreme Court held that accessing historical cell phone location data constitutes a Fourth Amendment search requiring a warrant. Privacy advocates argued this logic should extend to ALPR tracking, but law enforcement maintained that license plates visible in public spaces have no reasonable expectation of privacy—a position established in United States v. Knotts (1983) before modern surveillance technology existed.

Illinois launched adult-use sales in January 2020 with some of the nation's strongest consumer privacy protections. The Illinois Cannabis Regulation and Tax Act prohibited dispensaries from retaining customer data beyond transaction records and banned the sharing of customer information with third parties except as required for regulatory compliance. However, these protections did not extend to external surveillance systems operated by private companies or law enforcement.

Flock Safety and the Modern Surveillance Network (2020-2026)

Flock Safety, founded in 2017, rapidly expanded its ALPR network during the COVID-19 pandemic, marketing its systems to homeowners associations and municipalities as crime prevention tools. By 2022, Flock operated over 30,000 cameras across 1,500 cities, capturing approximately 3 billion vehicle sightings annually. The company's business model involved selling access to this data through law enforcement subscriptions, creating a surveillance network that dwarfed government-operated systems.

The 2023 investigation by the Electronic Frontier Foundation revealed that Flock Safety cameras were disproportionately positioned near cannabis dispensaries in California, with 847 cameras within 500 feet of licensed retailers in Los Angeles County alone. Flock maintained that camera placement was determined by client requests rather than corporate targeting, but the pattern suggested systematic surveillance of dispensary customers.

Michigan's adult-use market, which launched in December 2019, grew to include 432 licensed dispensaries by August 2026. The Gander Newsroom investigation published in August 2026 documented that at least 127 Michigan dispensaries had ALPR cameras within direct line of sight of their parking lots or entrances. The investigation identified cameras operated by Flock Safety, DRN Data, and municipal police departments, with data retention periods ranging from 30 days to five years.

The Michigan findings triggered immediate legislative response. State Representative Yousef Rabhi introduced House Bill 5847 in August 2026, which would prohibit the use of ALPR data to identify cannabis dispensary customers and require deletion of such data within 24 hours of capture. Similar legislation was introduced in California, Massachusetts, and New York within weeks of the Michigan revelations.

Key Players in Cannabis Surveillance

Flock Safety

Flock Safety operates the largest privately-owned ALPR network in the United States, with over 35,000 cameras across 2,000 cities as of August 2026. The Atlanta-based company positions itself as a public safety technology provider, offering cameras to neighborhoods and municipalities at costs ranging from $2,500 to $3,500 per camera annually. Flock's systems capture license plates, vehicle make and model, color, and distinguishing features, storing this data for 30 days in standard configurations.

The company's law enforcement portal allows police to search the database by license plate, location, time range, or vehicle characteristics. Approximately 3,500 law enforcement agencies subscribe to Flock's services as of 2026, paying $2,000 to $20,000 annually depending on access levels. Flock has stated it does not specifically target dispensaries but acknowledges its cameras capture vehicles at all locations within their field of view, including cannabis retailers.

DRN Data (Digital Recognition Network)

DRN Data, a subsidiary of Motorola Solutions, operates a vehicle location database containing over 15 billion historical records as of 2026. The company's network relies primarily on mobile ALPR cameras mounted on repossession vehicles and tow trucks, creating coverage that extends to areas without fixed camera infrastructure. DRN retains data for up to five years and sells access to law enforcement agencies, insurance companies, and financial institutions.

The 2024 data breach that exposed 2.3 million DRN records included specific flags for "cannabis-related locations," indicating the company categorized dispensary visits as a distinct data point. DRN has not publicly disclosed whether this categorization was implemented at client request or as a standard database feature. The company maintains that all data collection occurs in public spaces where no reasonable expectation of privacy exists.

Drug Enforcement Administration

The DEA maintains its own ALPR database and purchases access to commercial databases including DRN Data and Thomson Reuters CLEAR. The agency's National License Plate Recognition Initiative, disclosed through FOIA requests in 2015, specifically authorized surveillance of vehicles near "drug-related locations." While the DEA has not officially confirmed whether legal dispensaries fall under this category, internal documents obtained by the American Civil Liberties Union in 2024 referenced "state-licensed cannabis facilities" as locations of interest for ALPR monitoring.

The DEA's position on state-legal cannabis remains unchanged despite administrative rescheduling proposals: the agency considers all cannabis activity to violate federal law under 21 U.S.C. § 841, making dispensary customers potential targets for investigation. However, the agency has maintained a de facto policy of not prosecuting individual consumers in legal states, focusing enforcement on interstate trafficking and organized crime.

State and Local Law Enforcement

Approximately 2,800 state and local law enforcement agencies operate their own ALPR systems as of 2026, with varying policies on data retention and access. The Michigan State Police operates 147 fixed ALPR cameras and equips patrol vehicles with mobile readers, retaining data for one year. The Los Angeles Police Department maintains one of the nation's largest municipal ALPR databases, with over 3 billion historical records and a five-year retention policy.

Most agencies have not established specific policies regarding dispensary surveillance, treating cannabis retailers identically to other businesses. However, the 2025 audit of the Oakland Police Department revealed that officers had queried ALPR databases for vehicles near dispensaries 1,847 times during 2024, suggesting targeted monitoring despite California's legal status.

Privacy Advocacy Organizations

The Electronic Frontier Foundation has led legal and policy efforts to restrict ALPR surveillance, filing lawsuits in California, Virginia, and Texas challenging warrantless tracking. The organization's 2023 report "License Plate Readers: A Threat to Privacy in the Cannabis Era" documented surveillance patterns and provided model legislation for state restrictions.

The American Civil Liberties Union has challenged ALPR programs in multiple jurisdictions, arguing that mass surveillance of legal activity violates Fourth Amendment protections. The ACLU's 2025 case ACLU v. City of Los Angeles specifically challenged the use of ALPR data to monitor dispensary customers, though the case was dismissed on standing grounds when the organization could not identify specific plaintiffs willing to publicly acknowledge dispensary visits.

The National Organization for the Reform of Marijuana Laws has advocated for federal legislation prohibiting the use of surveillance data to identify cannabis consumers in legal states. NORML's model Privacy Protection Act, published in 2024, would prohibit law enforcement agencies from retaining ALPR data captured near dispensaries for longer than 24 hours unless connected to a specific criminal investigation.

Legal and Regulatory Framework

Cannabis surveillance operates in a legal gray zone where Fourth Amendment protections, state privacy laws, and federal drug enforcement authority create conflicting obligations and unclear boundaries.

Fourth Amendment Considerations

The Fourth Amendment protects against unreasonable searches and seizures, but its application to ALPR surveillance remains contested. The Supreme Court's decision in United States v. Knotts (1983) held that individuals have no reasonable expectation of privacy in their movements on public roads, a principle established before modern mass surveillance technology. However, the Court's 2018 decision in Carpenter v. United States recognized that aggregated location data over extended periods can reveal intimate details of life, requiring warrant protection.

Lower courts have split on whether Carpenter extends to ALPR tracking. The Fourth Circuit's 2021 decision in Leaders of a Beautiful Struggle v. Baltimore Police Department held that persistent ALPR surveillance of an entire city constituted a Fourth Amendment search, but the court allowed the program to continue with enhanced oversight. The Ninth Circuit reached the opposite conclusion in United States v. Yang (2022), holding that ALPR data collection in public spaces does not trigger Fourth Amendment protections.

No federal court has specifically addressed whether targeted ALPR surveillance of dispensary customers constitutes a search. Privacy advocates argue that systematic monitoring of legal cannabis purchases reveals sensitive information about medical conditions, lifestyle choices, and associations, bringing it within Carpenter's framework. Law enforcement maintains that dispensary visits, like any public movement, carry no privacy expectation.

State Privacy Statutes

Fifteen states have enacted ALPR-specific legislation as of August 2026, with widely varying protections. California's Civil Code § 1798.90.51 requires law enforcement agencies to implement usage and privacy policies for ALPR systems but does not restrict data collection or retention periods. The statute requires annual reporting on ALPR usage but exempts commercial operators like Flock Safety and DRN Data.

Utah's HB 243, enacted in 2018, provides stronger protections, limiting ALPR data retention to one year and prohibiting use of the data except for specific law enforcement purposes. The statute explicitly prohibits using ALPR systems to "collect data on individuals engaging in activities protected by the First Amendment," though it does not specifically mention cannabis purchases.

Maine's LD 1699, passed in 2021, prohibits law enforcement from using ALPR systems except with a warrant or in specific emergency circumstances. The law was enacted partly in response to concerns about dispensary surveillance, as Maine's adult-use program launched in 2020. However, the statute only applies to government-operated systems, leaving commercial networks unregulated.

Federal Cannabis Policy and Surveillance Authority

The Controlled Substances Act at 21 U.S.C. § 812 continues to classify cannabis as a Schedule I substance as of August 2026, despite ongoing administrative rescheduling proceedings. This classification provides the DEA with broad surveillance authority under 21 U.S.C. § 876, which authorizes the Attorney General to "establish a program of drug surveillance" to identify drug trafficking patterns.

The Rohrabacher-Farr Amendment, renewed annually since 2014 and codified in successive appropriations bills, prohibits the Department of Justice from using funds to prevent states from implementing medical cannabis laws. Courts have interpreted this to bar federal prosecution of individuals complying with state medical programs, but the amendment does not explicitly prohibit surveillance activities. The amendment does not cover adult-use programs, leaving recreational consumers without federal protection.

The proposed SAFE Banking Act, which has passed the House seven times but never cleared the Senate, includes privacy provisions that would prohibit financial institutions from sharing cannabis customer data with law enforcement absent a warrant. However, these protections would not extend to ALPR surveillance, which occurs before any financial transaction.

State-by-State Surveillance Landscape

California

California hosts the nation's largest legal cannabis market, with approximately 1,200 licensed dispensaries generating $5.3 billion in annual sales as of 2025. The state has an estimated 1,847 ALPR cameras positioned within 500 feet of dispensaries, the highest concentration nationwide. Los Angeles County alone accounts for 847 of these cameras, operated by a mix of LAPD, Flock Safety, and DRN Data.

California law provides minimal ALPR restrictions. Civil Code § 1798.90.51 requires policies and reporting but does not limit data retention or use. The California Consumer Privacy Act (CCPA) exempts ALPR data collected by law enforcement and does not clearly cover commercial surveillance operators. Assembly Bill 1782, introduced in February 2026, would prohibit ALPR data retention exceeding 24 hours for vehicles near dispensaries, but the bill remains in committee as of August 2026.

Possession limits: Adults 21+ may possess up to 28.5 grams of cannabis flower and 8 grams of concentrate. Medical patients with recommendations may possess up to 8 ounces.

Colorado

Colorado's mature adult-use market includes approximately 590 licensed dispensaries as of August 2026. The state has an estimated 412 ALPR cameras near dispensaries, primarily operated by municipal police departments and Flock Safety. Denver accounts for 178 of these cameras, while Colorado Springs—which prohibits dispensaries within city limits—has none near cannabis retailers.

Colorado has no state-level ALPR restrictions, leaving regulation to local jurisdictions. Denver's surveillance ordinance requires the police department to publish annual ALPR reports but does not limit data collection. Boulder prohibits ALPR use by city agencies but cannot restrict private operators or state police.

Possession limits: Adults 21+ may possess up to 1 ounce of cannabis flower and 8 grams of concentrate. Medical patients may possess up to 2 ounces.

Illinois

Illinois implemented some of the nation's strongest cannabis privacy protections through the Cannabis Regulation and Tax Act, which prohibits dispensaries from retaining customer data beyond transaction records and bans sharing information with third parties. However, these protections do not extend to external surveillance. The state has approximately 287 ALPR cameras near its 218 licensed dispensaries as of August 2026.

Illinois has no ALPR-specific legislation, though the Biometric Information Privacy Act (BIPA) provides strong protections for facial recognition and other biometric data. Privacy advocates have argued that ALPR systems that capture driver faces alongside license plates may trigger BIPA requirements, but no court has ruled on this theory.

Possession limits: Adults 21+ may possess up to 30 grams of cannabis flower, 5 grams of concentrate, or 500 mg of THC in infused products. Medical patients may possess a 14-day supply as determined by their physician.

Massachusetts

Massachusetts operates a tightly regulated adult-use market with 298 licensed dispensaries as of August 2026. The state has an estimated 203 ALPR cameras near dispensaries, with concentrations in Boston (67 cameras) and Worcester (31 cameras). The Massachusetts Cannabis Control Commission has no authority over surveillance systems operated by law enforcement or private companies.

Massachusetts law provides limited ALPR protections. A 2016 law requires law enforcement agencies to implement ALPR policies and limits data retention to 18 months, but it does not restrict commercial operators. Senate Bill 1392, introduced in January 2026, would prohibit using ALPR data to identify dispensary customers, but the bill has not advanced.

Possession limits: Adults 21+ may possess up to 1 ounce in public and up to 10 ounces at home. Medical patients may possess a 60-day supply as certified by their physician, typically 10 ounces.

Michigan

Michigan's investigation-triggering revelations documented 127 dispensaries with nearby ALPR cameras among the state's 432 licensed retailers. Detroit accounts for 48 of these cameras, Ann Arbor for 23, and Grand Rapids for 19. The cameras are operated by Flock Safety (estimated 67 cameras), DRN Data (estimated 34 cameras), and municipal police departments (estimated 26 cameras).

Michigan has no ALPR-specific legislation, though House Bill 5847, introduced in August 2026, would prohibit retention of dispensary-related ALPR data beyond 24 hours. The bill has bipartisan support and is expected to advance in the fall 2026 legislative session. The Michigan State Police retains ALPR data for one year under internal policy but has not disclosed whether dispensary locations receive special treatment.

Possession limits: Adults 21+ may possess up to 2.5 ounces in public and up to 10 ounces at home. Medical patients may possess up to 2.5 ounces.

New York

New York's adult-use market launched in December 2022 and has grown to include 187 licensed dispensaries as of August 2026. The state has an estimated 156 ALPR cameras near dispensaries, concentrated in New York City (89 cameras) and Buffalo (23 cameras). The New York Police Department operates one of the nation's most extensive ALPR networks, with over 400 fixed cameras citywide and mobile readers on patrol vehicles.

New York enacted ALPR restrictions in 2020 requiring law enforcement agencies to implement usage policies and limit data retention to one year. However, the law exempts the NYPD's Domain Awareness System, which integrates ALPR data with other surveillance sources and retains records for five years. Commercial operators face no restrictions.

Possession limits: Adults 21+ may possess up to 3 ounces of cannabis flower and 24 grams of concentrate. Medical patients may possess a 60-day supply as determined by their certifying practitioner.

Ohio

Ohio's medical cannabis program, established in 2019, operates 130 licensed dispensaries as of August 2026. Adult-use legalization approved by voters in November 2023 is being implemented with sales expected to launch in late 2026. The state has approximately 94 ALPR cameras near existing medical dispensaries, with concentrations in Cleveland (28 cameras), Columbus (24 cameras), and Cincinnati (19 cameras).

Ohio has no ALPR legislation, and the state's medical cannabis law does not address surveillance. The Ohio State Highway Patrol operates ALPR systems with a one-year retention policy but has not disclosed usage patterns related to dispensaries.

Possession limits: Medical patients may possess a 90-day supply as determined by their physician, typically up to 8 ounces. Adult-use limits under the 2023 legalization measure allow 2.5 ounces for adults 21+, effective upon implementation.

Market and Business Implications

Surveillance concerns create measurable economic impacts on the legal cannabis industry while generating revenue opportunities for technology vendors and data brokers.

Consumer Behavior and Market Deterrence

Industry surveys indicate that privacy concerns influence purchasing decisions for a significant portion of cannabis consumers. A February 2026 survey by Headset, a cannabis analytics firm, found that 34% of respondents in legal states expressed concern about being identified as dispensary customers, with 18% reporting they had avoided dispensary purchases specifically due to surveillance fears. Among employed professionals, the avoidance rate increased to 27%.

This deterrence effect translates to substantial revenue impacts. If 18% of potential customers avoid dispensaries due to surveillance concerns, the industry's $33.6 billion annual revenue could be suppressed by approximately $6 billion. While some of this demand likely shifts to delivery services or other discreet purchasing methods, industry analysts estimate that 30-40% returns to illicit markets where no identification or tracking occurs.

The deterrence effect varies significantly by demographic group. Parents report the highest concern levels, with 43% expressing worry about surveillance in the Headset survey. Healthcare workers, teachers, and government employees also show elevated concern, likely reflecting employment policies that prohibit cannabis use or create adverse consequences for identified consumers.

Multi-State Operator Response

Large multi-state operators have begun implementing privacy-protective measures as competitive differentiators. Curaleaf, the nation's largest MSO with 151 dispensaries across 19 states, announced in July 2026 that it would install privacy screening at parking lot entrances to block ALPR camera sightlines. The company estimated the retrofit cost at $15,000 to $35,000 per location, totaling approximately $3.8 million across its portfolio.

Trulieve, operating 209 dispensaries primarily in Florida, launched a "Privacy First" marketing campaign in August 2026 emphasizing its delivery services as an alternative to in-store purchases. The company reported that delivery orders increased 23% in the month following the campaign launch, suggesting significant consumer demand for privacy-protective purchasing options.

Green Thumb Industries, with 89 dispensaries across 15 states, took a different approach, installing its own security cameras positioned to capture ALPR cameras surveilling its locations. The company stated it would use the footage to identify surveillance operators and potentially pursue legal action, though no lawsuits have been filed as of August 2026.

Insurance and Financial Services Implications

The insurance industry has shown increasing interest in ALPR data as a risk assessment tool. Documents obtained through California Public Records Act requests revealed that at least three major insurance companies—Progressive, State Farm, and Allstate—explored purchasing ALPR data in 2024 and 2025, though none confirmed active use as of August 2026.

Insurance industry analysts have suggested that frequent dispensary visits could correlate with elevated health risks or impaired driving, justifying premium adjustments. However, no peer-reviewed research supports these correlations, and privacy advocates argue such use would constitute discrimination based on legal activity. California's Insurance Code § 791.02 prohibits discrimination based on lawful conduct, but whether this extends to ALPR-derived inferences remains untested.

Financial institutions face different pressures. Banks serving cannabis businesses under FinCEN guidance must implement enhanced due diligence and monitoring, but these requirements focus on the businesses themselves rather than customers. However, the 2025 guidance from the Federal Deposit Insurance Corporation suggested that banks "may consider" customer transaction patterns at cannabis businesses when assessing account risk, potentially opening the door to ALPR data use.

Technology Vendor Revenue Opportunities

The cannabis surveillance market represents significant revenue for ALPR vendors. Flock Safety's law enforcement subscriptions generate an estimated $70 million annually as of 2026, with cannabis-related queries representing an unknown but likely substantial portion of system usage. DRN Data's law enforcement and commercial subscriptions generate approximately $45 million annually, according to Motorola Solutions financial disclosures.

Privacy-protective technology vendors have emerged to serve the cannabis industry. Companies like LPR Shield and Plate Privacy manufacture license plate covers and frames designed to obscure plates from certain angles while remaining visible to direct observation, claiming compliance with state visibility requirements. These products retail for $40 to $120 per vehicle and generated an estimated $8.3 million in sales during 2025, according to industry analysis.

What Experts Say

Privacy advocates, law enforcement officials, and cannabis industry leaders offer sharply divergent perspectives on the legitimacy and implications of dispensary surveillance.

According to the Electronic Frontier Foundation's senior staff attorney Adam Schwartz, ALPR surveillance of dispensary customers represents "the exact type of dragnet monitoring the Fourth Amendment was designed to prevent." Schwartz argues that systematic tracking of individuals engaged in legal activity, particularly activity that reveals sensitive information about medical conditions or lifestyle choices, requires individualized suspicion and judicial oversight. The EFF's position emphasizes that the aggregation of location data over time can reveal intimate details of life, bringing such surveillance within the framework established by Carpenter v. United States.

The American Civil Liberties Union's senior policy analyst Jay Stanley has described cannabis surveillance as "a preview of the surveillance state's future," warning that normalized tracking of legal cannabis consumers establishes precedent for monitoring other lawful activities that authorities or private entities might find objectionable. Stanley points to the potential for surveillance expansion to track visits to abortion clinics, protests, religious services, or political meetings, arguing that the technical infrastructure and legal theories developed for cannabis surveillance could be repurposed for broader social control.

Law enforcement perspectives differ substantially. According to the National Sheriffs' Association's technology committee chair Sheriff Mark Lamb of Pinal County, Arizona, ALPR systems serve legitimate public safety purposes unrelated to cannabis enforcement. Lamb has stated that cameras positioned near dispensaries typically serve broader area monitoring rather than targeted surveillance, and that the presence of dispensaries in commercial areas means some cameras will inevitably capture those locations. The NSA's position emphasizes that ALPR systems help solve serious crimes including homicides, kidnappings, and human trafficking, and that restricting data collection would undermine these investigations.

The Major Cities Chiefs Association, representing police leadership from the 80 largest U.S. cities, has opposed ALPR restrictions that would require deletion of data based on location. According to the association's 2025 policy statement, such requirements would create "investigative blind spots" and impose unsustainable technical burdens on agencies managing millions of daily plate reads. The organization argues that existing oversight mechanisms, including internal policies and civilian review boards, provide adequate privacy protection without compromising public safety.

Cannabis industry leaders have emphasized the economic and social harms of surveillance. According to National Cannabis Industry Association executive director Aaron Smith,

Update — August 19, 2026: Michigan dispensary blocks Flock surveillance camera with protest sign

Jars Cannabis in Michigan successfully challenged automated surveillance by mounting a "No Flock Zone" sign directly in front of a Flock Safety camera, physically blocking the device's view of the dispensary and its customers. The camera, part of Flock Safety's automated license plate reader (ALPR) network used by law enforcement agencies nationwide, was installed months earlier without the retailer's consent on adjacent property or public infrastructure.

The dispensary's direct action highlights growing tension between cannabis retailers and third-party surveillance systems that capture customer vehicle data, timestamps, and location patterns. Flock Safety cameras automatically photograph license plates and store data for extended periods, creating searchable databases accessible to subscribing police departments. Cannabis operators have expressed concern that such systems enable warrantless tracking of legal customers and create chilling effects on patient access, particularly in states where federal prohibition still creates employment and custody risks.

Michigan's regulatory framework requires dispensaries to maintain internal video surveillance under Michigan Marijuana Regulatory Agency (MRA) rules, but does not mandate participation in external law enforcement camera networks. The Jars Cannabis protest sign represents a physical assertion of boundary control over customer privacy in public-facing areas. No legal action against the dispensary for obstructing the camera view has been reported, suggesting the installation may have occurred on private property where the retailer exercised control or that local authorities declined enforcement.

This incident matters operationally because it demonstrates a low-cost, high-visibility method for cannabis retailers to resist surveillance creep without litigation. Financially, ALPR data collection near dispensaries could deter price-sensitive customers or medical patients concerned about data retention, directly impacting foot traffic and revenue. The case may prompt other retailers in Flock-saturated markets to assess whether similar cameras operate near their locations and whether property rights or local ordinances provide removal or obstruction options.