Elgin College's Battle with Flock Safety Cameras Highlights Gaps in AI Surveillance Governance

In September 2025, Elgin Community College in Illinois attempted to dismantle six Flock Safety license‑plate recognition cameras that had been installed the previous spring to "enhance student safety." The college’s administration, alarmed by privacy concerns and mounting maintenance costs, issued a cancellation notice to the vendor. Flock Safety, however, refused to remove the hardware, citing contractual obligations and a claim that the cameras remain operationally necessary.

The dispute quickly escalated into a legal confrontation, drawing attention from privacy advocates, state regulators, and the broader AI policy community. At the heart of the controversy lies the Illinois Biometric Information Privacy Act (BIPA), which regulates the collection and storage of biometric data—including license‑plate information, which is considered a unique identifier under the law. Critics argue that the college’s original deployment may have violated BIPA’s stringent consent and data‑retention requirements, while the vendor’s refusal to disengage raises questions about the enforceability of service agreements in the AI surveillance market.

From a security standpoint, the cameras employ edge‑AI algorithms to parse vehicle data in real time, flagging stolen or unauthorized plates and alerting campus police. Proponents contend that such capabilities can deter criminal activity and expedite emergency response. Yet the lack of transparent governance—no publicly disclosed data‑handling policy, ambiguous retention schedules, and limited oversight—creates a fertile ground for mission creep. The technology’s ability to track movements across campus borders the line between safety and pervasive monitoring.

The standoff underscores a broader systemic issue: AI‑driven surveillance tools are proliferating faster than the regulatory frameworks meant to contain them. While Illinois has taken a leading role with BIPA, many jurisdictions lack clear statutes addressing AI‑generated visual data. Moreover, the incident reveals a contractual asymmetry; vendors often embed clauses that limit removal or data deletion, effectively locking institutions into long‑term surveillance arrangements.

For the AI ecosystem, the Elgin case serves as a cautionary tale. Institutions must conduct rigorous impact assessments before adopting AI surveillance, ensure compliance with biometric privacy laws, and negotiate exit strategies that allow for swift de‑deployment. Policymakers, meanwhile, should consider updating existing privacy statutes to explicitly cover AI‑derived visual identifiers and mandate auditability of vendor contracts. Without such measures, the promise of AI‑enhanced safety risks being eclipsed by unchecked data collection and erosion of civil liberties.

Photo: SM Rodriguez / Unsplash (https://unsplash.com/@smrodriguez)