Flock Safety's Marketing Failures Hold a Hard Lesson for AI Teams

The Oshkosh reversal is the kind of marketing failure that should make every AI product team slow down before approving a single customer-facing claim.

In April 2026, a Flock Safety representative told the Oshkosh, Wisconsin, city council that the company’s license plate reader system could not create heat maps tracing vehicle movement. The council approved the contract. The next day, after discovering that heat maps did exist, the city revoked it. The ACLU later described it as the shortest contract in Flock’s history.[1]

That sequence matters because nothing about it required a long philosophical debate about artificial intelligence, surveillance, or public safety. A buyer asked, in effect, whether the product could do something operationally sensitive. The answer materially shaped a public vote. The answer turned out not to match the product reality. The contract disappeared.

For AI companies selling into cities, police departments, hospitals, schools, financial institutions, or any other trust-heavy environment, this is the line. A claim does not become acceptable because a lawyer can defend one narrow reading of it. If a reasonable council member, procurement official, journalist, or affected resident would walk away with a materially different understanding than the underlying facts support, the claim has failed.

The controversy around Flock Safety’s audio surveillance work and AI ethics in marketing did not emerge from one sloppy sentence. The credibility problem grew because different kinds of claims kept failing in different rooms: product capability claims, federal relationship claims, data-sharing explanations, partnership language, accuracy assurances, and sales enablement tactics. Each one might have been survivable in isolation. Together, they created a pattern.

The Pattern Was Bigger Than One Bad Answer

The Oshkosh heat map denial is the cleanest case because the distance between claim and consequence was unusually short. But it sits inside a wider record of disputed or retracted statements that reached different audiences.

These are not identical failures. That distinction matters. A false capability denial is different from an exaggerated partnership claim. A technically narrow data-sharing answer is different from an accuracy assurance without public substantiation. A private training session for police is different from a public marketing page. But they share a mechanism: each reduces buyer friction by removing a fact that would have made the decision harder.

That is exactly why the pattern is so damaging. Sensitive-domain buyers are not only buying software. They are buying a defensible explanation they can repeat in public. If that explanation collapses, the buyer owns the embarrassment, the meeting, the records request, the lawsuit risk, and the angry resident who wants to know why a capability was described one way before approval and another way afterward.

The Heat Map Claim Was a Capability Disclosure Failure

Capability disclosure is one of the hardest disciplines in AI marketing because product teams often know too much. They know the feature has limits. They know it depends on permissions, settings, retention windows, integrations, or admin roles. They know a scary-sounding capability may be less dramatic in ordinary use. That knowledge can tempt a team into answering the least alarming version of the question rather than the question a buyer is actually asking.

The Oshkosh council did not need a semantic tour of every possible interface state. It needed to know whether the system could help reveal patterns of vehicle movement. If heat maps existed, that fact belonged in the answer. The appropriate marketing posture would have been plain: the system includes this capability; here is what it shows; here is who can access it; here are the controls; here is how the city can disable, restrict, audit, or govern it.

For AI teams, the lesson is not to bury every sales call in product architecture. It is to maintain a claims inventory for sensitive capabilities. If a feature can identify, infer, rank, predict, cluster, summarize, monitor, detect, or trace people, vehicles, voices, locations, behaviors, or relationships, it needs a verified answer set. Sales should not improvise around it. Product marketing should not soften it until it sounds harmless. Legal should not be the first team to discover how the field explains it.

The Federal Contract Denial Turned a Narrow Point Into a Credibility Problem

Flock’s federal relationship claims created a second kind of problem: the answer that may have been intended to distinguish contracts from pilots, but landed as a categorical denial.

NPR reported in February 2026 that Flock’s CEO had publicly denied having federal contracts, then later acknowledged pilot projects with Customs and Border Protection and Homeland Security Investigations. He said that “some of our public statements inadvertently provided inaccurate information.”[2]

That admission is important because it shows how quickly a categorical claim can become brittle. In regulated or politically sensitive markets, the difference between a paid contract, a pilot, a data-sharing arrangement, an integration test, and an agency inquiry may matter internally. Externally, the buyer’s question is usually broader: are federal agencies using, testing, accessing, or benefiting from this system in any way that could affect local policy, public perception, or legal exposure?

A safer answer would separate commercial status from operational reality. “We do not have a production contract with X” is a different claim from “X has never used the product.” “We have a pilot” is different from “we share live customer data.” “We are in discussions” is different from “there is no relationship.” AI marketers need a vocabulary for these distinctions before the press call, not after it.

The ICE Data Wording Shows Why Technical Truth Is Not Enough

The ICE dispute is where marketing language becomes especially dangerous, because the company’s public wording answered one version of the question while critics said the operational reality answered another.

According to the ACLU, Flock published a blog post titled “Does Flock Share Data With ICE? No” while knowing that local police departments were conducting searches on ICE’s behalf.[1] The distinction matters. A company might argue that it did not directly share data with ICE. A resident or city official may care just as much whether ICE could obtain the practical benefit of the data through local law enforcement searches.

This is the failure mode that often survives legal review and still detonates in public. The sentence can be technically defensible and materially misleading at the same time. In sensitive domains, “Do you share data with X?” often means more than direct database access. It can include agency-to-agency requests, delegated searches, mutual aid workflows, fusion center access, query forwarding, export practices, audit log visibility, and informal workarounds.

The marketing rule is straightforward: data-practice claims should describe the path of practical access, not just the contractual route. If a third party can receive, request, cause, trigger, or benefit from a search, the public explanation should not stop at “we do not directly share.” That phrase may win a paragraph. It loses the room when the workflow becomes visible.

Partnership Claims Need the Boring Version of the Truth

Partnership language is one of the most abused tools in B2B marketing because it compresses many relationships into a prestige word. A vendor can meet with an organization, receive feedback, join a coalition, attend the same working group, exchange comments on a bill, or discuss a draft. None of those automatically means “partnered with.”

The ACLU said Flock’s Senior Director of Public Affairs posted on LinkedIn that the company had “partnered with the ACLU of New Mexico” to craft legislation. The ACLU stated that it had never partnered with Flock.[1]

That kind of embellishment does more than irritate the named organization. It borrows credibility from a party that may be skeptical, neutral, or merely present in the same policy conversation. It also gives sales teams and public officials a phrase that can travel far beyond the original post: if even the ACLU partnered with the company, the product must have passed some civil-liberties test. When the named organization rejects the claim, the borrowed credibility turns into evidence of opportunism.

For AI marketers, the fix is not complicated. Use relationship labels that can survive a screenshot sent to the other party. “Met with,” “received feedback from,” “participated in a working session with,” “submitted comments alongside,” and “co-sponsored” mean different things. If the other organization would not approve the noun, do not use it.

Accuracy Claims Must Be Substantiated Where Buyers Can Inspect Them

Accuracy language is especially treacherous for AI-enabled systems because buyers often hear a single percentage as a product guarantee. The actual performance may depend on lighting, camera placement, jurisdictional data quality, alert configuration, plate condition, weather, vehicle type, human review, and how the metric is defined. “Accuracy” can mean read accuracy, match accuracy, alert accuracy, false-positive rate, false-negative rate, or some vendor-specific blend.

Two Flock accuracy episodes show why vague confidence language is not enough. Business Insider reported that a Flock employee told Coralville City Council the system’s accuracy was around 90%; the company later said the employee had misspoken and that its accuracy was “consistently in the high 90 percentiles,” while refusing to publish the actual data behind that assurance.[3]

Separately, Malwarebytes reported that an LAPD Inspector General audit found 32.3% of Flock alerts inaccurate over a two-month period, with 161 vehicles falsely flagged as stolen.[4] That finding does not prove every Flock deployment performs that way. It does prove that broad accuracy reassurance is a weak substitute for metric definitions, deployment conditions, confidence intervals, and independent validation.

The marketing control here should be strict. Any accuracy claim should answer four questions before it reaches a deck: what exactly is being measured; over what sample and time period; under what conditions; and whether the result was produced by the company, the customer, or an independent auditor. If the company will not publish the supporting data, the public claim should become narrower, not louder.

The Sales Enablement Problem Was Not Just What Flock Said Publicly

Marketing does not stop at the website. In enterprise and government sales, the most consequential messaging often moves through customer champions, partner decks, FAQ documents, objection-handling scripts, forwarded emails, and private webinars. That is why Flock’s training for police deserves attention even though it is not a traditional advertisement.

The Oaklandside reported in May 2026 that Flock quietly trained more than 1,000 law enforcement officers in a webinar on “How to Speak to City Councils.” The session taught officers to reframe concerns, respond to “misinformation,” and sway councils; journalists and privacy commissioners were blocked from attending.[5]

There is nothing inherently wrong with helping customers explain a complex product. In fact, vendors should help public agencies answer hard questions accurately. The problem begins when enablement turns intermediaries into pressure valves for controversy rather than carriers of verified information. If the goal is to neutralize objections instead of disclose tradeoffs, the company is no longer just supporting a buyer. It is shaping the public decision environment while avoiding direct accountability for every phrase used in the room.

AI companies selling to regulated buyers should treat sales enablement as claims distribution. The same review standard that applies to web copy should apply to objection-handling scripts, customer champion decks, council talking points, partner FAQs, and webinar training. If the company would hesitate to publish the training, that hesitation is useful evidence.

The Audio Surveillance Launch Raised the Stakes

The controversy around Flock is not limited to license plate readers. In October 2025, The Record reported that Flock had launched a product that detects human voices.[6] Flock later published a July 2026 blog post explaining how its audio detection works and addressing concerns it said it hears most often.[7]

Flock’s own explanation deserves inclusion because a company should be allowed to state its position. But the marketing lesson is not whether one blog post settles the audio surveillance debate. It is that once a company has an established credibility deficit, every new sensitive capability arrives pre-contested. Voice detection, gunshot detection, license plate recognition, vehicle movement analytics, and cross-jurisdictional search are not judged one claim at a time after trust has been damaged. They are judged through the pattern the market already sees.

That is the hidden cost of earlier ambiguity. The next product launch carries the burden of old denials, old corrections, old screenshots, and old public meetings. Even a carefully written explanation has to fight the memory of less careful ones.

Credibility Debt Became Commercial Debt

The consequences were not abstract reputational vibes. The Oaklandside reported that 90 Flock contracts had been terminated since August 2021, including 47 in 2026 alone.[5] NPR reported on cities ditching Flock license plate readers in February 2026.[2] Malwarebytes described the backlash as spreading in July 2026.[4]

The partnership damage also reached consumer-facing brands. Variety reported in February 2026 that Ring canceled a Flock partnership after backlash over a Super Bowl ad.[8] The research record also includes federal investigations, multiple lawsuits, and cities including Austin, Santa Cruz, and Oshkosh terminating relationships.[5]

There is also a downstream human risk that should not be inflated into a claim about every deployment, but should not be dismissed either. Malwarebytes cited Institute for Justice reporting on more than 22 documented cases of officers using automated license plate reader systems to stalk romantic interests.[4] That does not mean every ALPR deployment is abusive. It does mean marketing claims about access controls, auditability, and use restrictions are not cosmetic. They describe safeguards around systems that can be misused.

By July 17, 2026, the story was still moving quickly, with at least four Detroit-area suburbs canceling contracts in the same week this article was reviewed. That timing matters for marketers because crisis communications often assume the company can isolate an incident. A pattern removes that option. Each new cancellation becomes fresh evidence for the next skeptical council packet.

Six Marketing Controls AI Teams Should Build Before They Need Them

The useful response is not to tell AI marketers to be less ambitious. Ambitious positioning is part of the job. The response is to make claims governance operational enough that ambition does not depend on ambiguity.

1. Maintain a sensitive-capability register. Any feature that can monitor, infer, detect, identify, trace, rank, or predict behavior needs pre-approved public language, product verification, owner signoff, and a last-reviewed date.
2. Separate “no relationship” from “no contract,” “no pilot,” “no direct access,” and “no operational benefit.” Buyers and journalists will not forgive internal distinctions that were invisible in public language.
3. Define accuracy before claiming it. A percentage without a metric definition, sample, time window, deployment context, and substantiation source is not a proof point; it is a future correction waiting for discovery.
4. Use partnership nouns only when the named party would use the same noun. “Partnered with” should require explicit approval, not proximity, consultation, or participation in the same policy process.
5. Describe practical data access, not just direct sharing. If another agency can request, trigger, receive, or benefit from a search through an intermediary, the public explanation should make that workflow understandable.
6. Review private enablement as public claims. Council scripts, objection-handling guides, customer webinars, and partner decks should meet the same evidence standard as website copy because they are how decisions actually get shaped.

The last control is crisis-specific: once a pattern is established, stop treating each challenged claim as an isolated communications problem. The company needs a public claims audit, not another defensive blog post. That audit should identify what was said, what was wrong or incomplete, what the corrected wording is, who approved the new claim, what evidence supports it, and when it will be reviewed again.

The Standard Is Operational, Not Decorative

Sensitive-domain AI marketing cannot be managed as a polish layer over sales urgency. It has to function like a trust-control system. Claims need evidence requirements. Product and legal need to verify capability language before it reaches the field. Caveats need to be documented where buyers can see them. Accuracy numbers need definitions. Partnership labels need permission. Data-practice wording needs to follow real workflows, not just the narrowest defensible interpretation.

Flock’s case is a hard lesson because the short-term incentives are familiar. Simplify the answer. Calm the council. Neutralize the objection. Borrow credibility. Avoid the caveat. Keep the deal moving.

But once the market believes a company trims the truth, every future claim becomes more expensive to prove. That cost lands on sales teams, legal teams, customers, public officials, partners, and the next product launch. For AI companies operating in sensitive domains, marketing review is not a brand exercise. It is part of the product’s safety case.

References

1. Flock Safety Credibility Lost as it Repeatedly Lies to City Councils, Police Departments, and Public Across the Country, ACLU, July 2026.
2. Why some cities are ditching their Flock license plate readers, NPR, February 2026.
3. Flock Safety's AI Cameras Misread Plates. Innocent People Pay., Business Insider, March 2026.
4. The backlash against Flock cameras is spreading, Malwarebytes, July 2026.
5. Flock is quietly training Bay Area police to sway city leaders to buy surveillance tech, Oaklandside, May 2026.
6. License plate reader company Flock launches new product that detects human voices, The Record, October 2025.
7. How Flock's Audio Detection Works, and the Concerns We Hear Most, Flocksafety.com, July 2026.
8. Ring Cancels Flock Partnership After Backlash Over Super Bowl Ad, Variety, February 2026.