3 ms·

Wait, is it your data? If you drive your car in front of a Ring camera on my house (I don't have a Ring camera don't @ me), is it your claim that you own the da

by tptacek 7mo ago

Wait, is it your data? If you drive your car in front of a Ring camera on my house (I don't have a Ring camera don't @ me), is it your claim that you own the data on that camera?

kstrauser 7mo ago
Did you put up a Ring camera on a stand in front of your house for the specific purpose of selling that I drove past at this specific timestamp? If so, yes. The CCPA[0] gives me explicit legal rights: * The right to know about the personal information a business collects about them and how it is used and shared; * The right to delete personal information collected from them (with some exceptions); * The right to opt-out of the sale or sharing of their personal information including via the GPC; This isn't someone incidentally taking pictures of license plates in an otherwise noncommercial setting. It's a company literally created to collect and sell PII. Laws are different for them than for us. [0]https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa
- snowwrestler 7mo ago
  “Personal information” has a legal definition and photos of you in a public street might not satisfy it, regardless of the photographer’s intent.
  - kstrauser 7mo ago
    I think it'd be challenging to rule that a license plate number is not personally identifiable information, when the same regulations often state that an IP address is.
    - uoaei 7mo ago
      "Anyone could have been driving my car, you can't positively identify me in the driver's seat with the evidence you have submitted" is routinely used to toss out cases involving traffic violations. It's not necessarily common but it does happen. By this logic a license plate does not personally identify the person driving, only the person the car is registered to.
      - lcnPylGDnU4H9OF 7mo ago
        Right, but in this context the license plate number is still personal information, just of a different person.
        uoaei 7mo ago
        Then the key aspect of our discussion is the "identifiable" part, which you've left out.
        lcnPylGDnU4H9OF 7mo ago
        Are you now saying that one cannot possibly "identify" the "person" who owns a vehicle, solely with the "information" on a license plate?
        ndsipa_pomu 7mo ago
        You may be confused, but the owner of a vehicle is not necessarily the same as the driver of a vehicle. Recording a vehicle's license plate does not necessarily identify the driver unless they also happen to be the owner. (c.f. vehicle hiring companies)
        kube-system 7mo ago
        The CCPA explictly says: > “Personal information” does not include [...] Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer
        tptacek 7mo ago
        California has an entire statute regulating ALPR information, so we don't need to derive this axiomatically.
        kube-system 7mo ago
        One generally has to follow all of the laws, so evaluating what the CCPA says here is relevant for evaluating CCPA compliance.
    - adrr 7mo ago
      Or home address, phone number, etc
  - lcnPylGDnU4H9OF 7mo ago
    Indeed, that definition is included in the CCPA. > (v) (1) “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following [...]: > (E) Biometric information. > (H) Audio, electronic, visual, thermal, olfactory, or similar information. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.140.&lawCode=CIV https://leginfo.legislature.ca.gov/faces/codes_displaySectio... To your point, the intent would presumably still matter for exceptions to when deletion requests must be honored (say for journalism), but a photo of someone walking down a public street would still logically be considered the subject's personal information, by the above definition.
  - necovek 7mo ago
    Personal information usually does include photos of someone in public without their consent: exceptions usually hold for taking photos of people where it is in the public interest to be able to show them or impractical to get consent. This covers large gatherings and celebrities, but a portrait photo of a stranger might put you on the wrong side of the law. Obviously, the idea is to not disallow having someone take a photo of you as a background, passing figure as they take a front-and-center photo of their family, but not allow you to be the main subject unknowingly and especially when you object explicitly. On the other hand, a photographer still owns the copyright to a photo, so a subject (including in a portrait) cannot claim it or distribute it without permission even if they can potentially stop the photographer from distributing that photo. IANAL, but you are not by default allowed to use anyone's "likeness" for your individual profit.
    - patrickmay 7mo ago
      > Personal information usually does include photos of someone in public without their consent This is not the case in the United States. There is no presumption of privacy in public. In fact, there is a whole genre known as "street photography" that involves taking pictures in public without explicit consent of the subjects.
      - necovek 7mo ago
        You seem to be right, thanks for the correction! If https://legalclarity.org/can-you-post-someones-picture-without-their-permission/ https://legalclarity.org/can-you-post-someones-picture-witho... is to be trusted though, at least you get protection from your likeness being used for commercial purposes, though that seems a bit more limited than I'd expect.
      - tadfisher 7mo ago
        This is true, and it may also be true that location tracking through surveillance networks crosses a line into violating one or more Constitutional rights. One of Flock's revenue streams is explicitly selling access to data made available by other customers. A commonly-cited example is the ability of local law enforcement to locate abortion suspects in other states using the Flock camera network [0]; one could imagine dragnet-style or geofenced queries to also cross the line. [0]: https://www.eff.org/deeplinks/2025/10/flock-safety-and-texas-sheriff-claimed-license-plate-search-was-missing-person-it https://www.eff.org/deeplinks/2025/10/flock-safety-and-texas...
  - tadfisher 7mo ago
    Well, it matters if the photographer is the government (or contracted by the government, or subpoenaed by the government): see Chatrie v. United States [0]. The Fourth Amendment exists, and it remains to be tested whether querying massive surveillance networks is a "reasonable" search. [0]: https://www.scotusblog.com/cases/case-files/chatrie-v-united-states/ https://www.scotusblog.com/cases/case-files/chatrie-v-united...
    - snowwrestler 7mo ago
      True but the Fourth Amendment doesn’t rely on the CCPA for authority!
- tptacek 7mo ago
  I think you're going to find that you're wrong about this, and that you're not going to get anywhere targeting Flock in particular, as opposed to the owners of Flock cameras. Consider that California has had multiple rounds of legislation about red light camera legislation, including new limitations on it, and all of those cameras are also from commercial providers collecting your PII. Your argument proves too much. You're going to get a lot of cheerleading and support about this in venues like HN and Reddit, because you're narrowcasting to an audience already primed to be hyperconcerned about surveillance technology (I am too). I think you're going to find those attitudes do not in fact generalize to the public at large, and especially not to the legal system. Best of luck either way. It'll be an interesting experience to write up, and I'm happy to read about the outcome, even if I do think it's highly predictable.
  - john_strinlai 7mo ago
    >you're not going to get anywhere targeting Flock in particular, as opposed to the owners of Flock cameras. fyi, flock owns the cameras. "We operate using a lease model. What does that mean? Since we own the hardware, we own the problems that occur."
  - kstrauser 7mo ago
    FWIW, I just did this as an experiment and turned it into a blog post afterward. I didn't really set out with an agenda or a deliberate audience, and I didn't share it here. Don't get me wrong, I'm happy to chat about it! But this ended up here without any special effort on my part.
    - tptacek 7mo ago
      I know the feeling! My arguments here are positive, not normative. I don't know that I think it would be a worse world if your hypothesis was correct. I'm just reasonably sure it isn't.
      - kstrauser 7mo ago
        For sure. This is the sort of conversation I'd typically rather be having at a bar with appropriate beverages. If it sounds like I'm arguing, it's because it's the kind of thing I'd debate with my friends for the fun of it.
mindslight 7mo ago
"Your data" isn't really a well defined term, right? But yes, data that can be used to track my movements in my vehicle is certainly a type of personally identifiable information. I'd argue there should be some exemptions for individuals operating on a small scale, which I believe the CCPA has (and if we actually got a US GDPR, that it should have). But also that kind of exception shouldn't apply to a camera jointly operated by and backhauling to Ring.
necovek 7mo ago
I believe you are still the owner of that data, but if you are holding someone's PII — which time of passage, car model and license plates can be argued to be especially with a fixed location — according to privacy regulations, they can ask a business to remove it unless they have a legally acceptable reason to keep it (eg. they hit-and-run a parked vehicle). Now, with you likely not keeping that Ring tied to a business account, how that applies to non-businesses holding PII is a different matter.
danudey 7mo ago
The laws say that data about you is your data, information about you is your information. No one is saying that you "own the data", but by virtue of the data being personal information about you specificially you are allowed to exert control over that data, such as asking for it to be deleted.
- kasey_junk 7mo ago
  That view of data ownership is _highly_ jurisdiction dependent and is not the overwhelming norm in the US.
  - captaincrisp 7mo ago
    While that's definitely true, in this particular case he's invoking his rights under CCPA.
    - tptacek 7mo ago
      They're invoking a right they do not in fact have under CCPA. Flock is a service provider under CCPA, and isn't required to respond to their request so long as they're operating under the terms of their contract with the municipality (which is, in turn, exempt from CCPA.)
windexh8er 7mo ago
Who paid for the camera? If I did with taxpayer dollars then, you're damn right I should have a say. The "my Ring camera" trope is a fun strawman, though.
- tptacek 7mo ago
  If it's the municipality holding the data it's even less an issue! Municipalities are exempt from CCPA!
  - windexh8er 7mo ago
    They aren't. Flock is, so are they? Also, the state I live in has a GDPA that would override CCPA, so it's not exactly that cut and dry as you very well know. The Ring example is garbage. You paid for it and it's on your property. Nothing remotely similar. I guess then it's OK for Flock to be required installed on your mobile device so they can check your geo history for the last hour and that you don't match the profile of the guy who stole Billy's Huffy bike? What happens when the municipalities buy time on your device since, well, you don't own it and have no right to the software running on it because of ToS you agreed to. Or that awesome "save the children from CSAM pedos" bill you cheered for that paved the way for the USG and states to be guaranteed citizen introspection app slots on your device? Because the piece of paper says so, it should then just be accepted as is!
    - tptacek 7mo ago
      I've lost track of what you're talking about. Flock cameras are installed by municipalities. They're physical devices. Nobody is required to have "Flock" installed on their mobile device. That's not a thing.
      - windexh8er 7mo ago
        I never said it was, the hypothetical was clearly hard to follow.

by tptacek 7mo ago

Wait, is it your data? If you drive your car in front of a Ring camera on my house (I don't have a Ring camera don't @ me), is it your claim that you own the data on that camera?

kstrauser 7mo ago

Did you put up a Ring camera on a stand in front of your house for the specific purpose of selling that I drove past at this specific timestamp? If so, yes. The CCPA[0] gives me explicit legal rights: * The right to know about the personal information a business collects about them and how it is used and shared; * The right to delete personal information collected from them (with some exceptions); * The right to opt-out of the sale or sharing of their personal information including via the GPC; This isn't someone incidentally taking pictures of license plates in an otherwise noncommercial setting. It's a company literally created to collect and sell PII. Laws are different for them than for us. [0]https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa

snowwrestler 7mo ago
“Personal information” has a legal definition and photos of you in a public street might not satisfy it, regardless of the photographer’s intent.
- kstrauser 7mo ago
  I think it'd be challenging to rule that a license plate number is not personally identifiable information, when the same regulations often state that an IP address is.
  - uoaei 7mo ago
    "Anyone could have been driving my car, you can't positively identify me in the driver's seat with the evidence you have submitted" is routinely used to toss out cases involving traffic violations. It's not necessarily common but it does happen. By this logic a license plate does not personally identify the person driving, only the person the car is registered to.
    - lcnPylGDnU4H9OF 7mo ago
      Right, but in this context the license plate number is still personal information, just of a different person.
      - uoaei 7mo ago
        Then the key aspect of our discussion is the "identifiable" part, which you've left out.
        lcnPylGDnU4H9OF 7mo ago
        Are you now saying that one cannot possibly "identify" the "person" who owns a vehicle, solely with the "information" on a license plate?
        ndsipa_pomu 7mo ago
        You may be confused, but the owner of a vehicle is not necessarily the same as the driver of a vehicle. Recording a vehicle's license plate does not necessarily identify the driver unless they also happen to be the owner. (c.f. vehicle hiring companies)
      - kube-system 7mo ago
        The CCPA explictly says: > “Personal information” does not include [...] Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer
        tptacek 7mo ago
        California has an entire statute regulating ALPR information, so we don't need to derive this axiomatically.
        kube-system 7mo ago
        One generally has to follow all of the laws, so evaluating what the CCPA says here is relevant for evaluating CCPA compliance.
  - adrr 7mo ago
    Or home address, phone number, etc
- lcnPylGDnU4H9OF 7mo ago
  Indeed, that definition is included in the CCPA. > (v) (1) “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following [...]: > (E) Biometric information. > (H) Audio, electronic, visual, thermal, olfactory, or similar information. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.140.&lawCode=CIV https://leginfo.legislature.ca.gov/faces/codes_displaySectio... To your point, the intent would presumably still matter for exceptions to when deletion requests must be honored (say for journalism), but a photo of someone walking down a public street would still logically be considered the subject's personal information, by the above definition.
- necovek 7mo ago
  Personal information usually does include photos of someone in public without their consent: exceptions usually hold for taking photos of people where it is in the public interest to be able to show them or impractical to get consent. This covers large gatherings and celebrities, but a portrait photo of a stranger might put you on the wrong side of the law. Obviously, the idea is to not disallow having someone take a photo of you as a background, passing figure as they take a front-and-center photo of their family, but not allow you to be the main subject unknowingly and especially when you object explicitly. On the other hand, a photographer still owns the copyright to a photo, so a subject (including in a portrait) cannot claim it or distribute it without permission even if they can potentially stop the photographer from distributing that photo. IANAL, but you are not by default allowed to use anyone's "likeness" for your individual profit.
  - patrickmay 7mo ago
    > Personal information usually does include photos of someone in public without their consent This is not the case in the United States. There is no presumption of privacy in public. In fact, there is a whole genre known as "street photography" that involves taking pictures in public without explicit consent of the subjects.
    - necovek 7mo ago
      You seem to be right, thanks for the correction! If https://legalclarity.org/can-you-post-someones-picture-without-their-permission/ https://legalclarity.org/can-you-post-someones-picture-witho... is to be trusted though, at least you get protection from your likeness being used for commercial purposes, though that seems a bit more limited than I'd expect.
    - tadfisher 7mo ago
      This is true, and it may also be true that location tracking through surveillance networks crosses a line into violating one or more Constitutional rights. One of Flock's revenue streams is explicitly selling access to data made available by other customers. A commonly-cited example is the ability of local law enforcement to locate abortion suspects in other states using the Flock camera network [0]; one could imagine dragnet-style or geofenced queries to also cross the line. [0]: https://www.eff.org/deeplinks/2025/10/flock-safety-and-texas-sheriff-claimed-license-plate-search-was-missing-person-it https://www.eff.org/deeplinks/2025/10/flock-safety-and-texas...
- tadfisher 7mo ago
  Well, it matters if the photographer is the government (or contracted by the government, or subpoenaed by the government): see Chatrie v. United States [0]. The Fourth Amendment exists, and it remains to be tested whether querying massive surveillance networks is a "reasonable" search. [0]: https://www.scotusblog.com/cases/case-files/chatrie-v-united-states/ https://www.scotusblog.com/cases/case-files/chatrie-v-united...
  - snowwrestler 7mo ago
    True but the Fourth Amendment doesn’t rely on the CCPA for authority!
tptacek 7mo ago
I think you're going to find that you're wrong about this, and that you're not going to get anywhere targeting Flock in particular, as opposed to the owners of Flock cameras. Consider that California has had multiple rounds of legislation about red light camera legislation, including new limitations on it, and all of those cameras are also from commercial providers collecting your PII. Your argument proves too much. You're going to get a lot of cheerleading and support about this in venues like HN and Reddit, because you're narrowcasting to an audience already primed to be hyperconcerned about surveillance technology (I am too). I think you're going to find those attitudes do not in fact generalize to the public at large, and especially not to the legal system. Best of luck either way. It'll be an interesting experience to write up, and I'm happy to read about the outcome, even if I do think it's highly predictable.
- john_strinlai 7mo ago
  >you're not going to get anywhere targeting Flock in particular, as opposed to the owners of Flock cameras. fyi, flock owns the cameras. "We operate using a lease model. What does that mean? Since we own the hardware, we own the problems that occur."
- kstrauser 7mo ago
  FWIW, I just did this as an experiment and turned it into a blog post afterward. I didn't really set out with an agenda or a deliberate audience, and I didn't share it here. Don't get me wrong, I'm happy to chat about it! But this ended up here without any special effort on my part.
  - tptacek 7mo ago
    I know the feeling! My arguments here are positive, not normative. I don't know that I think it would be a worse world if your hypothesis was correct. I'm just reasonably sure it isn't.
    - kstrauser 7mo ago
      For sure. This is the sort of conversation I'd typically rather be having at a bar with appropriate beverages. If it sounds like I'm arguing, it's because it's the kind of thing I'd debate with my friends for the fun of it.

mindslight 7mo ago

"Your data" isn't really a well defined term, right? But yes, data that can be used to track my movements in my vehicle is certainly a type of personally identifiable information. I'd argue there should be some exemptions for individuals operating on a small scale, which I believe the CCPA has (and if we actually got a US GDPR, that it should have). But also that kind of exception shouldn't apply to a camera jointly operated by and backhauling to Ring.

necovek 7mo ago

I believe you are still the owner of that data, but if you are holding someone's PII — which time of passage, car model and license plates can be argued to be especially with a fixed location — according to privacy regulations, they can ask a business to remove it unless they have a legally acceptable reason to keep it (eg. they hit-and-run a parked vehicle). Now, with you likely not keeping that Ring tied to a business account, how that applies to non-businesses holding PII is a different matter.

danudey 7mo ago

The laws say that data about you is your data, information about you is your information. No one is saying that you "own the data", but by virtue of the data being personal information about you specificially you are allowed to exert control over that data, such as asking for it to be deleted.

kasey_junk 7mo ago
That view of data ownership is _highly_ jurisdiction dependent and is not the overwhelming norm in the US.
- captaincrisp 7mo ago
  While that's definitely true, in this particular case he's invoking his rights under CCPA.
  - tptacek 7mo ago
    They're invoking a right they do not in fact have under CCPA. Flock is a service provider under CCPA, and isn't required to respond to their request so long as they're operating under the terms of their contract with the municipality (which is, in turn, exempt from CCPA.)

windexh8er 7mo ago

Who paid for the camera? If I did with taxpayer dollars then, you're damn right I should have a say. The "my Ring camera" trope is a fun strawman, though.

tptacek 7mo ago
If it's the municipality holding the data it's even less an issue! Municipalities are exempt from CCPA!
- windexh8er 7mo ago
  They aren't. Flock is, so are they? Also, the state I live in has a GDPA that would override CCPA, so it's not exactly that cut and dry as you very well know. The Ring example is garbage. You paid for it and it's on your property. Nothing remotely similar. I guess then it's OK for Flock to be required installed on your mobile device so they can check your geo history for the last hour and that you don't match the profile of the guy who stole Billy's Huffy bike? What happens when the municipalities buy time on your device since, well, you don't own it and have no right to the software running on it because of ToS you agreed to. Or that awesome "save the children from CSAM pedos" bill you cheered for that paved the way for the USG and states to be guaranteed citizen introspection app slots on your device? Because the piece of paper says so, it should then just be accepted as is!
  - tptacek 7mo ago
    I've lost track of what you're talking about. Flock cameras are installed by municipalities. They're physical devices. Nobody is required to have "Flock" installed on their mobile device. That's not a thing.
    - windexh8er 7mo ago
      I never said it was, the hypothetical was clearly hard to follow.