From the Gloucester Outlets to Home Depot: Businesses using license plate readers come under scrutiny

It wasn’t a deal that caught Adam Sheridan’s eye as he drove through the Gloucester Premium Outlets this summer.

It was an automated license plate reader.

“I looked up, because all I do now is look up at every telephone pole, and there’s a camera right there,” he said. “I don’t know if it’s new or just no one ever noticed.”

Regardless of when three Flock-brand cameras were strategically placed at the entrance and exit points of the outlets, people like Sheridan are taking notice.

The technology is designed to capture license plates, along with car make and model, and any bumper stickers a vehicle might have.

How the outlets manage that data is less clear.

Until recently, local law enforcement has drawn much of the scrutiny over the use and misuse of automated license plate readers, brought to light through internal audits and public records requests. It is through those mechanisms that the public learned police followed a woman leaving Texas to self-administer an abortion and three former Georgia deputies used the cameras to stalk people.

Privacy advocates note no such transparency tools are required for businesses, which have largely been prickly about revealing too much about their camera use. Many businesses opt to keep private the number of cameras they have on site, who gets to see data collected, and data-sharing agreements. Seizing on a growing backlash against Big Tech and artificial intelligence, critics want to force a conversation about camera use by private businesses.

Sarah Hamid is director of strategic campaigns at the Electronic Frontier Foundation, which has been studying surveillance technology for more than 30 years.

When private businesses use this type of surveillance, there’s “less of a paper trail” if the data are misused, she said.

“So the public can’t point to this undeniable record, because regardless of what PR statement comes out of a large retail vendor, at the end of the day, what the data-sharing rules are for that corporation are many times not just specific to that corporation — and private — but also specific to the specific store and location,” Hamid said.

Take the Simon Property Group, the country’s biggest mall owner, with the Gloucester Outlets among its properties.

A 2024 report in Forbes found Simon had a nationwide contract with Flock, the lead manufacturer of license plate readers, with a network of cameras across 49 states. Internal emails at the time showed Simon was directly sharing its feeds with at least two law enforcement agencies in California, regardless of a crime taking place. But it is unclear if such a data-sharing agreement exists with the Gloucester Township Police Department.

Simon did not respond to requests for an interview regarding its Flock cameras at the outlets or other properties, including the King of Prussia Mall. Local police did not respond to questions regarding data sharing with the outlets.

Determined to raise awareness about the ubiquity of these license plate readers, a group of local, privacy-minded residents created DeFlock South Jersey over the summer. They have peppered town council meetings and filed records requests to learn about the contracts their local municipalities have with these camera manufacturers. To get the attention of businesses, they have opted for boycotts and a showman’s approach.

DeFlock South Jersey’s inaugural event was an August “camera tour” at the Cherry Hill Mall, a Lowe’s in Lawnside, and a Home Depot in West Berlin to highlight their use of automated license plate readers. Stuffed into a life-size, homemade Flock costume — white Mickey Mouse-style gloves included — one member gestured to the cameras above.

Bill Helfand, 81, held up a sign that read “Big Brother is watching you,” as the group tried to talk about privacy concerns before the light turned green for waiting cars. Helfand kept his warning short.

“If Home Depot wants to give up somebody else’s information, they can do it,” he said.

Businesses using automated license plate readers have access only to the data collected on their property, but they can opt to make their data accessible to local law enforcement. If the local police department is contracting with a company like Flock, which has data-sharing agreements with law enforcement agencies across the country, a vehicle’s identifying information could suddenly be part of a national database.

The thread of who has access to the data can be easy to lose and has come to matter in cases involving U.S. Immigration and Customs Enforcement, though Flock says it does not have a contract with the agency and Home Depot says it does not grant license plate reader access to federal law enforcement.

404 Media reported last year that local Texas law enforcement was sharing Flock data from Home Depot and Lowe’s with federal immigration authorities. Both retailers have had their parking lots targeted by ICE as the Trump administration pursues its mass deportation campaign.

A Home Depot spokesperson said parking area security cameras have been in place for many years, declining to say how long license plate readers have been part of the mix. The spokesperson directed The Inquirer to the company’s website, which says the readers are for “detecting and preventing theft and protecting the safety of our customers and associates.”

Lowe’s website said its cameras “automatically capture images of vehicles and their license plates, along with the date, time, and general location,” for all the reasons Home Depot listed and the added task of assisting with parking enforcement.

“We only disclose your personal information if required by law or legal process, or when we believe doing so will help protect the safety, property, or rights of individuals or Lowe’s,” says the company’s website.

Home Depot and Lowe’s did not say how many of their stores in New Jersey use the cameras.

Like the home improvement stores, a Cherry Hill Mall spokesperson declined to reveal the brand of cameras the mall uses or how many, citing security concerns and directing The Inquirer to the mall’s website for any information about the automated license plate readers.

Owned by Pennsylvania Real Estate Investment Trust (PREIT), the mall captures license plate data, as well as the location and time of sighting, according to the site.

“This same information can be observed by any person walking through the parking lot,” reads the mall’s website, which says the data are kept for 30 days and then deleted.

It is an argument supporters of the technology often make and one being increasingly met with pushback by groups like DeFlock South Jersey, determined to keep the pressure.

On Saturday, Flocky, the human-size anti-Flock mascot, will be hitting the streets of South Jersey again, this time at a Home Depot in Lawnside.