What's documented

Home Depot is the world's largest home-improvement retailer — 2,359 stores across all 50 states, $164.7 billion in sales last fiscal year. California is its biggest single-state market: 233 stores, about 12% of its entire U.S. footprint. According to a class-action complaint filed May 1, 2026 in the Northern District of California, those 233 stores are also running what the lawsuit calls "a covert surveillance operation" in their parking lots.

We read the complaint directly. Schmierer et al. v. Home Depot U.S.A., Inc. et al. (Case No. 3:26-cv-03967) says Home Depot installed automated license-plate-recognition (ALPR) cameras — supplied by vendor Flock Safety — at the entrances and exits of its California parking lots. The cameras capture every vehicle's plate, make, model, color, and "distinguishing features," log it with a timestamp and location, and feed it into a centralized, searchable database that law-enforcement agencies across the country can query. Home Depot isn't named for having cameras — the complaint's actual claim is narrower and more specific: that its posted ALPR policy fails to meet at least three of the seven disclosure requirements California's ALPR Privacy Act makes mandatory. It names no specific job title responsible for the system. Its data-retention window is "as long as necessary for the Authorized Purposes" — language the complaint calls circular and effectively indefinite. And its law-enforcement-sharing clause covers "enforcement of laws and regulations" with no stated limit on out-of-state agencies, federal agencies, or immigration enforcement specifically.

That last gap matters because of a legal precedent the complaint leans on — though only partly covers Home Depot's actual situation. In Bartholomew v. Parking Concepts, Inc. (Cal. Ct. App., Feb. 5, 2026), the court held that failing to post any ALPR policy at all is itself the harm the statute protects against — no misuse has to be proven. Whether a policy that's posted but missing required pieces, which is Home Depot's actual situation, gets the same treatment is a question the same court explicitly left open in a February 27 modification order; the Schmierer complaint argues it should, but that argument hasn't been decided. The suit seeks statutory damages of at least $2,500 per class member, plus punitive damages and injunctive relief: delete improperly retained data, post real notices, submit to independent audits.

The two times Flock's own record shows the restrictions didn't hold

The complaint's most serious argument isn't hypothetical. It cites two documented, publicly confirmed incidents where cities that explicitly restricted Flock's data-sharing had those restrictions quietly overridden anyway.

Mountain View, January 2026. City police disclosed that Flock had set the department's very first deployed ALPR camera to "nationwide" sharing without the city's permission or knowledge. Over four months in 2024, that camera's data was accessed by the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives; Langley Air Force Base in Virginia; the U.S. GSA Office of Inspector General; a Nevada national recreation area; and an Ohio Air Force base. An audit found the "statewide" search setting had been enabled on 29 of the department's 30 deployed cameras — against the access controls the city believed it had in place. Police Chief Michael Canfield shut the entire network down: "The existence of access by out-of-state agencies, without the City's awareness, that circumvented the protections we purposefully built and believed were in place is frankly unacceptable." Mayor Emily Ann Ramos put it more bluntly: the council had been told "it definitely would not be used by anyone in the federal government, and that clearly wasn't the case."

Ventura County, February 2026. A sheriff's office audit found out-of-state agencies had accessed its Flock data more than 364,000 times in a single two-month window in early 2025 without the department's approval. Of those searches, 299 listed immigration enforcement — including explicit references to ICE — as the justification. Ventura had disabled Flock's "National Lookup" feature back in 2023 specifically to comply with California law. It had been secretly re-enabled without the department's knowledge. Flock's own explanation to the county: "other agencies experienced similar issues," it was "impossible to determine the specific cause," and the re-activation could have come from "a Flock employee, a system bug, or someone at the Sheriff's Office." Oxnard's police department suspended Flock entirely; its chief, Jason Benites, said: "We were disappointed when Flock Safety's shortcoming, the cause of which remains without explanation, allowed unauthorized data sharing. Proper guardrails must not only be in place, but they must work reliably."

Home Depot isn't a defendant in either incident, and Flock isn't a defendant in the Home Depot case at all — it's named only as the vendor. But the complaint's point is direct: the same enterprise-level Flock architecture that failed two California cities' explicit access controls is the identical system running at Home Depot's 233 stores. A public-records request confirmed the same national network connects Home Depot's Texas stores to law enforcement; a separate KPBS investigation independently found Home Depot is among the private businesses giving police access to its plate readers, with a policy KPBS said was "very similar" to a comparison retailer's — offering no meaningful disclosure of sharing arrangements, no defined retention period, no named custodian.

Not just California, and not just cameras

Home Depot is facing three separate privacy lawsuits this year, over three different technologies, in three different states.

In Illinois, Jankowski v. The Home Depot (N.D. Ill., filed Aug. 1, 2025) alleged the company's self-checkout cameras used facial-recognition technology to collect shoppers' faceprints without the consent Illinois' Biometric Information Privacy Act requires. That case was voluntarily dismissed without prejudice on October 31, 2025 — meaning it could be refiled, but as it stands, it's closed.

In Virginia, Wright v. The Home Depot Inc. (E.D. Va., filed July 1, 2026) alleges something different again: that Home Depot sells customers' personal information through its retail media network, "Orange Apron Media," using a LiveRamp "clean room" to build "enhanced profiles" for advertisers — without notice or consent, violating Virginia's Personal Information Privacy Act. This one has nothing to do with cameras or Flock; it's an ad-tech data-broker claim.

Three lawsuits, three legal theories, three states, one company, one year. None of them are proven — these are allegations a court hasn't ruled on, and Home Depot has not been found liable in any of them. What the three complaints allege, in common, is a pattern: that Home Depot adopted a surveillance or data-monetization capability, and that its own public-facing privacy policy did not clearly account for what the underlying technology actually does. That's the plaintiffs' claim, not a finding.

The playbook for when this becomes a fight

None of this happens in a vacuum. 404 Media recently obtained a coaching guide Flock Safety gives to police departments — not retailers — on how to talk to city councils about its cameras, tied to a company webinar titled "How to Speak to City Councils: Meeting the Moment with Confidence." An anonymous local activist who has opposed Flock in their own community gave 404 Media the document; Flock did not respond to the outlet's request for comment.

The guide's central instruction is to "own the narrative before someone else does" — get ahead of public opposition by championing the technology before public-comment periods let it organize. On the "mass surveillance" label specifically, it tells police not to fight the framing: "Don't avoid the concept of mass surveillance because you're not going to convince opponents that it's not." Instead, reframe around "accountability." The guide also tells agencies to brief city managers early, since "they meet with council members before votes occur," and to build "carefully scripted presentation[s]" — and to reframe cost debates around "the cost of unresolved crime" rather than what the cameras cost.

Sarah Hamid, director of strategic campaigns at the Electronic Frontier Foundation, told 404 Media: "Flock isn't just selling surveillance, it's scripting the public case for buying it." She added that because Flock "treats public trust as a messaging problem rather than a governance outcome, that script keeps officials focused on 'accountability' in the abstract instead of the concrete harms and documented abuses its network has already enabled" — the kind of harms Mountain View and Ventura County just lived through.

The guide's own examples show the tactics work even against organized, informed opposition. In Oakland, more than 140 public comments and the city's own Privacy Advisory Commission opposed a Flock contract — the council approved it anyway, after officials shifted the debate to "accountability" language. In Richmond, California, a Flock contract was suspended over concerns about ICE data-sharing, then reinstated after police presented local statistics: 274 arrests, 259 vehicle recoveries.

What this piece is not saying

This isn't saying Flock Safety is a defendant in the Home Depot lawsuit — it isn't; the complaint names only Home Depot U.S.A., Inc. and The Home Depot, Inc. It isn't saying the leaked coaching guide was written for or used in response to the Home Depot case specifically — the guide is aimed at police departments managing city-council politics, a different audience than a corporate retailer managing a class action, and we found no evidence connecting the two directly. It isn't asserting any of the three lawsuits' underlying claims as proven fact — Home Depot has not been found liable in any of them, and the Illinois case was dropped, not decided. And it isn't claiming Home Depot itself caused the Mountain View or Ventura County access failures — those were documented at police departments, not at Home Depot stores; the complaint's argument is that the same vendor architecture runs in both places.

What can I do

If you shop in California, you can check whether Flock cameras are logging your own plate: Have I Been Flocked lets you search Flock's audit logs directly, free, and doesn't store what you search. It shows you when an agency actively queried your plate — not just when a camera passed you, but when someone typed your plate number in and why.

The ACLU's Get the Flock Out toolkit is built for exactly the fight the leaked guide describes: it's a real, practical resource for organizing before a city council vote, not after one — the same window Flock's own guide tells police to seize first.

If you're a California resident whose vehicle may have been captured at a Home Depot parking lot, the case is public record: Schmierer et al. v. Home Depot U.S.A., Inc. et al., No. 3:26-cv-03967, N.D. Cal. The case has been filed but not certified as a class yet, so there's no claims process to sign up for -- but you can track the docket yourself rather than waiting for a settlement notice to explain it to you later.

The Receipts