When the US opens the 2026 FIFA World Cup on June 11, fans driving toward any of the 11 American host stadiums will pass within range of a license-plate camera network the size of a small city's worth of streetlights, and the company that built most of that network says the data those cameras collect is not its to control.
WIRED identified 1,181 automatic license plate readers (ALPRs) within a five-mile radius of the 11 US venues, a tally built on top of the crowdsourced DeFlock mapping project. Flock Safety, the Atlanta-based company that sells most of the country's ALPRs, manufactured the majority of the cameras in that count. Smaller shares belong to Motorola Solutions and Genetec. These are the same kinds of cameras that already log tens of millions of plates a week for police departments, HOA patrols, and private businesses; what makes a World Cup venue different is density, foot traffic, and the presence of federal agencies already under scrutiny for how they use the data.
SoFi Stadium in Inglewood hosts the most American matches in the tournament, and its surrounding five miles hold 53 ALPRs: 39 Flock cameras and 14 Motorola units. NRG Stadium in Houston sits inside the densest Flock cluster of any US venue, with 323 Flock cameras in its five-mile radius, separate from a separate Harris County Sheriff's Office pool of 480 Flock cameras countywide. Mercedes-Benz Stadium in Atlanta, the de facto home of Flock's headquarters, has 188 Flock cameras within range, alongside 39 Genetec units and 13 Motorola units. MetLife Stadium in New Jersey, which will host the final, sits inside a thinner net: 28 Motorola and 13 Flock cameras. The full stadium-by-stadium map is on WIRED's site; the count is theirs, not an exhaustive census, and the agency noted that the DeFlock dataset "may not be a full picture of all the ALPRs in a given area."
The reason this matters is the mechanic most readers have never seen explained. An ALPR is a fixed or vehicle-mounted camera that photographs every passing license plate, runs optical character recognition on the plate, and checks the result against a "hot list" of plates the camera's owner wants flagged: stolen vehicles, missing persons, specific suspects. A read at one camera, by one police department, against one hot list, is a single lookup. The problem is that the same camera is also logging every other plate that passes by, with a timestamp and a GPS pin, and uploading it to a searchable database the camera's owner can query later.
That database is the part that turns a stadium-area camera into something larger. Flock's product, like several competitors', is built around a cross-operator search function. A Flock camera in Houston can be searched by a Flock customer in Atlanta, with the searcher's identity logged and the search subject's plate, time, and location returned, because the cameras are networked, not siloed. The aggregator Have I Been Flocked? has tracked 4,437,098 distinct plates seen across 184,195,968 known Flock searches to date. A read at a Houston stadium lot is, in practice, a permanent entry in a national queryable log that any participating agency can pull from.
What an ALPR actually captures is more than a plate string. The DHS Science & Technology Directorate's June 2025 LPR market survey report confirms that some providers collect vehicle make, model, year, and even bumper-sticker descriptions in addition to plate text. A camera that flags a stolen car also captures the soccer mom in the minivan two cars ahead, the rideshare driver, and the federal agent in the unmarked SUV, all with location and time. The hot-list match is what police want; the archive is what gets retained.
Flock Safety's position, on the record through spokesperson Paris Lewbel, is that the company does not have a direct relationship with US Immigration and Customs Enforcement or Customs and Border Protection. "We do not have a relationship with DHS, including CBP," Lewbel told WIRED. Customers, not Flock, "own and control their data, decide if, when, and with whom to share it." The framing puts the question of who can search the data one level down, onto the thousands of local police departments and private customers that buy Flock's cameras. That is a company claim, not a documented architecture. Whether the data ever reaches federal agencies is a separate empirical question, and the record on that question is not clean.
In August 2025, Illinois Secretary of State Alexi Giannoulias announced an audit finding that US Customs and Border Protection had been accessing Illinois Flock camera data in violation of state law, a finding the office made public through a news release covered by local press and aggregated nationally. The audit did not establish how long the access had been occurring or how many plates had been queried, but the fact of access was confirmed by the state's chief election officer, a Democrat, in a finding that has not been retracted. WIRED's reporting does not pin the World Cup surveillance footprint on that finding; the finding is what makes the company framing above a claim rather than a fact.
Other documented cases sit further from the World Cup but close enough to be relevant. In 2024, 404 Media reported that Flock employees accessed ALPR cameras inside a children's gymnastics facility in Dunwoody, Georgia, as a sales-pitch demonstration, then pitched the city's police department on the product. The city renewed its contract. Flock's blog post on its testing and development program characterized the employees as "well-intentioned" and noted the access was done with the facility's "explicit permission." The optics are the optics. Separately, an Institute for Justice investigation and a string of state-level reporting have documented officers accused of using ALPRs to track ex-partners, romantic interests, and personal acquaintances, in some cases without a department-approved reason, surfacing the failure mode that "customers control the data" is supposed to prevent.
Not all vendors frame the product the same way. Genetec, the second-largest ALPR vendor by WIRED's count, is positioning itself differently. VPs Andrew Elvish and Tracey Ades, on the record to WIRED, said the company focuses on parking applications rather than aggregated plate-data products and has called for federal legislation to restrict how customers can use plate-read data. Motorola Solutions, the third vendor in the count, did not respond to WIRED's request for comment, and that silence is the only on-record position.
Local governments are still buying. Harris County, Texas, in March 2026, renewed its Flock contract through June 2027 for just under $869,000, a renewal that followed public hearings in which the sheriff's office cited recent stolen-vehicle and kidnapping recoveries as the program's value case. In Cobb County, Georgia, the police department approved a separate $9.6 million anti-drone contract with Axon, framed in local press as World Cup and America 250 preparation. None of those decisions were framed as World Cup surveillance expansions. None of them would have happened on this timeline without the tournament.
The pushback exists and is organizing. The DeFlock mapping project now lists dozens of cities that have terminated Flock contracts, with a national week of action planned for August under the banner of the noalprs.com coalition. Some of those terminations are privacy-driven; some are budget-driven; some followed documented incidents. The map itself is crowdsourced and imperfect, which is also a constraint on the WIRED tally: both are built by people who chose to log a camera, and the cameras that nobody logged are not in either count.
What fans and residents can do with this information is the part the story does not finish. A driver attending a match at NRG can look up the cameras in the parking lot they plan to use and decide whether to take a different lot, a rideshare, or accept that the plate on their personal vehicle is going to be logged by a Flock camera feeding a national database. A resident near SoFi can write to the Inglewood city council and ask whether the 39 Flock cameras in their five-mile radius are on the cross-operator search network or siloed. A voter in Harris County can ask the sheriff's office how many of those 480 cameras are queryable by which other agencies, and on what legal authority. The map is a tool, and the tool is a request, and the request is the kind of thing local officials can be asked to answer on the record.
The World Cup is a temporary event with a permanent data layer underneath it. Cameras installed for a tournament stay installed after the tournament. Contracts renewed for a 2026 kickoff renew again in 2027, 2028, and beyond. The number 1,181 is a snapshot of a system that is still being built, still being bought, and still being mapped by people who think the readers deserve to know it exists.