🎧 Prefer to listen? This edition runs 15 minutes. → Play on Spotify

Every state that legalized required licensees to install cameras. Almost none wrote a rule for who gets to search the footage.

Drive to a dispensary in most American cities and you will pass three or four license plate readers before you arrive. One at the pharmacy. One at the bank. One at the hardware store, mounted on a pole at the edge of the customer lot, about the height of a stop sign, gray, solar panel on top, entirely unremarkable. No sign tells you it is there. In fact, most states don’t require a notice at all.

Then you park. The camera at the entrance to the dispensary lot looks exactly like the one at the hardware store. Same pole, same gray housing, same company. The difference is not visible from the parking space. That one is there because a state agency wrote a rule requiring it, with specified coverage, specified retention, and specified access.

I ran one of those agencies.

We wrote rules requiring licensees to install cameras covering entrances, points of sale, storage, and virtually everywhere else, to keep the recordings, and to make them available to the Commission on request. There was some logic to it, even if it was a bit overkill. The question in 2018 was public safety and diversion, whether product was leaving through the back door, or a safe full of cash was at risk. Cameras answer that question well. Nobody was asking in 2018 what a searchable national network would eventually do with ninety days of footage, because there was not one yet.

So the only camera on that whole trip that a government affirmatively demanded is the one pointed at people buying cannabis. Not the pharmacy, where the merchandise is more dangerous. Not the bank, where the money sits in bulk. Every state that has legalized has said, in its own regulations, that this is the errand worth recording.

We spent ten years arguing that buying cannabis was ordinary, and we wrote the opposite into the code.

That has been sitting with me as news has emerged out of Wisconsin about a criminal complaint.

On April 26th of last year, a Brown County deputy received an alert on a vehicle registered to Edward Abrams-Phillips, who was wanted on a felony warrant connected to a domestic violence case. Deputies could not find the car, so they followed it through the camera network instead. It hit a reader on Highway 41, another at County Line in Marinette, and a third crossing into Michigan. At 3:56 that afternoon it came back south toward Green Bay, and deputies were waiting.

The complaint explains what the deputy made of the trip. “Based on prior flock hits, the vehicle travels to Michigan frequently which is a known source State for Marijuana as it is legal there.”

The stop had other grounds, including the warrant, and the search rested on an officer’s claim that he smelled raw cannabis after the driver declined to consent. Deputies found a grinder, a jar with residue, two resealable bags, and a pre-roll. Eight and a quarter grams. With it was a receipt in his name from the Nirvana Center in Menominee, Michigan, where every item on it was purchased legally. The bail-jumping count was dismissed. He was eventually convicted of possessing marijuana.

He is a poor mascot for anything and this argument does not need him to be otherwise. He bought the cannabis legally in Michigan. A Wisconsin deputy treated the trips themselves as grounds for suspicion, and the only reason the deputy knew about the trips was a camera network that nobody in either state ever voted for.

Legalization is territorial. Every version voters or legislators have ever approved stops at their state line, because that is where their authority stops. Michigan decided what would be lawful on Michigan ground, and nothing in that decision follows a person off it. Menominee sits on the Michigan bank of the river and Marinette sits on the Wisconsin bank, and the dispensary economy along that stretch of the Upper Peninsula exists because of the borders. Everybody involved understood the arrangement. A Wisconsin resident could drive across, buy legally, and carry their own risk home. For six years it worked the way border commerce has always worked, on the general understanding that nobody was keeping a list, or surveilling.

Somebody is keeping a list now, and it reaches communities in 49 states.

I cannot prove this next part, and nobody has measured it. The cost lands on the person in Marinette who reads about that conviction and decides not to make the drive next month, on the patient who does not sign up for the medical program in a state where the registry is a government list and the parking lot has a camera on it, and on the customer who keeps buying from the guy he has always bought from, in cash, because the legal store leaves a record he cannot see, held by a company he did not choose, searchable by departments he will never hear from.

Nothing has to happen to any of them. That is how a chilling effect works, and it never turns up in an enforcement statistic, because it works on the people who stay home.

And it lands harder here than anywhere else, because cannabis is the only thing on that drive that people went to prison for buying. Everyone in this business knows somebody with a record for it. Legalization was supposed to mean the surveillance ended, that walking into a licensed store made the purchase nobody’s business. Legal markets already compete against legacy Nobody planned this

In fairness, nobody planned this. No one sat down and designed it. It has developed gradually.

The cameras at the pharmacy and the hardware store went up because a vendor made it easy and because organized crime rings really do hit the same stores in the same vehicles across a metro area, which is why the tool reads plates instead of watching aisles. Home Depot says its readers are there to prevent theft and to protect customers and employees, and there is no reason to doubt that is why they were installed. A regional manager signed a contract. The company that operates the network says the data belongs to the business and that sharing with police is off by default. It is also true that when a Connecticut newsroom pulled the records this spring, Lowe’s and Home Depot locations were giving local departments access to their lots’ databases, some under written agreements providing continuous, ongoing access. California supposedly has the strongest law in the country governing private plate readers, and what it requires is that the operator post a usage and privacy policy conspicuously on its website. Not at the lot. Not where you park. To a website you’ve never visited.

One state saw this coming.

Illinois wrote the strongest plate reader privacy law in the country, the first anywhere to prohibit sharing data with out-of-state police for reproductive health or immigration enforcement. Last May, a Johnson County, Texas deputy ran two searches of the network, the second reaching 6,809 networks and 83,345 cameras, with the stated reason recorded on both as a woman having had an abortion. The sheriff’s office and the company have called it a “welfare check” for a missing person. Records later obtained by the Electronic Frontier Foundation describe deputies opening a death investigation and consulting prosecutors about charges. Both searches carried the same case number as the death investigation. Illinois cameras were accessed as part of that search.

The Illinois statute carries no penalty provision. The prohibition existed, the query ran, and the state found out from reporters. Texas, where the officer physically sat, has no plate reader statute at all. The only reason there is any record of the search is that the company keeps an audit log, which is a product feature rather than a legal obligation. If a company’s engineering choices decide whether your statute is enforceable, can you really call it privacy?

That vendor made some decisions this week.

Flock announced it will cut standard retention from thirty days to seven, require a case number from the agency’s records system on every search, mandate an audit tool that locks out users showing abnormal search behavior, and let customers choose which offense types outside agencies may search their cameras for. Optional becomes mandatory January 1st.

These are real improvements and they are stronger than anything pending in Michigan, where pending legislation would set retention at fourteen days and a bipartisan House package has languished in committee since late January. A company under pressure moved faster and further than the legislatures confronting the same questions. Bureaucracy is not often known for being nimble.

It should embarrass all of us that it took a product announcement.

Run that Wisconsin search from earlier through these new rules, though. It passes. The search was near real-time, so a seven-day retention window changes nothing. It was attached to a live felony warrant, so there was a case number to type.

The changes were built against the scandals, the officers looking up ex-girlfriends and the Texas query, and they address those. Wisconsin is not a scandal. When a deputy watches a car cross into a legal state and draws his own conclusion about what the driver bought there, the system is working exactly as designed. No audit tool will ever flag that.

You've worked hard to fund your portfolio — your investment strategy should work just as hard to maximize your after-tax returns. On August 20, join Range's CFPs and CPAs live for the practical moves that put more of your returns back in your pocket. 

What we'll cover:

 • Investment moves to maximize your after-tax returns

 • How tax-loss harvesting can lower the taxes you owe

 • When direct indexing works (and when it doesn't) 

• How to build a diversified portfolio that reduces tax drag. 

Range is all-in-one AI wealth management — tax, investments, retirement, and estate in one place. Bring your questions for the live Q&A. Free to attend, and seats are limited.

Reserve your spot today

_{This webinar is for informational purposes only and does not constitute investment advice or a recommendation to buy, hold, or sell any security. Forward-looking statements involve risks and uncertainties. Past performance is not indicative of future results. Range defines "high earners" as households with income over $300k.}

So go back to the parking lot.

In Madison Heights, outside Detroit, JARS Cannabis was required to install a plate reader at the entrance to its customer lot and give the police department unhindered live access to the camera, the footage, and any and all data it collects. That is not based on any rule. Arctic Fox LLC applied for a license in August of 2022, was denied, and sued. The council rejected a settlement in November of 2023 by a vote of four to three, then approved one in January 2024, when a single member changed his vote. The package included $175,000 up front, $25,000 a year to a community fund, one percent of net profits, and the camera. Late last month JARS mounted a sign reading NO FLOCK ZONE in front of the lens. The company says the city answered with a demand letter giving it forty-eight hours to take the sign down. So the sign came down.

Other states got there first, by rule. Nevada requires that cameras covering entrances, vaults, and points of sale be capable of remote access by a law enforcement agency in real time upon request, a right that exists independently of the Cannabis Compliance Board. Missouri reads much the same. Illinois names the agency outright, giving the Illinois State Police a round-the-clock portal into licensee cameras, written into the administrative code. El Monte, California requires licensees to provide the police department twenty-four-hour live-stream access by name.

Across twenty-seven state codes, not one conditions police access to cannabis surveillance footage on a warrant. One state wrote an exception, and it is a narrow one. Massachusetts requires that footage from delivery drivers’ body cameras go to law enforcement only under a court order or search warrant demonstrating probable cause, and that it be destroyed after thirty days.

The reasoning was about doorsteps. A delivery camera arrives at a home, and what it picks up of who answers and what is behind them is not what a retail transaction puts on display. We understood that a camera pointed at private life earns a higher standard than a camera pointed at a retail sales floor, and distinguished.

That principle is sound, and it reaches further than delivery. A doorstep camera catches one moment at one address. A plate reader network reconstructs where a person has been for weeks, which is a good deal more of somebody’s private life than any delivery driver ever sees.

Every state that licenses cannabis already tells licensees what to record, how long to keep it, and what to produce on request. That authority runs to the business rather than to the police, which is exactly what let Massachusetts impose a warrant standard on delivery footage without legislating about law enforcement at all. The regulation tells a licensee what it may hand over and on what showing, and nothing in that mechanism is peculiar to delivery. It would work for the camera at the entrance to a parking lot, the one whose entire output is a record of who came and when, and it would work in Nevada, where the rule currently points the other way.

That is rulemaking rather than legislating. It requires no session, no legislative sponsor, and no floor vote. The rule can be lifted from Massachusetts with ease. A rule like that reaches the licensee and stops there. It cannot tell a Wisconsin deputy what he may conclude from a travel pattern, and it cannot keep Illinois cameras from answering a Texas query. Those do take a legislature, and two states have already written them. Washington provides that a positive match alone does not amount to reasonable suspicion, which is the sentence the Wisconsin complaint needed and did not have. Virginia bans sharing into another state’s database outright, which is the only provision anywhere that would have stopped the Texas search at the keyboard.

None of that eliminates a camera. Somebody just has to decide, out loud, what a picture of a perfectly legal errand is worth and how long it deserves to last.

I helped build some of this. We required security cameras and I would probably still require many of them today. That call was right on what we knew in 2018, and what we know now is different. The rule was written when a licensee’s footage sat on a hard drive in a back office, or somewhere in the cloud, before anybody had built the thing that makes a record like that worth searching from a different time zone. Leaving it there now would be stubborn. Addressing it costs redlining a Word document.

Somebody is pulling into a dispensary lot right now, in a state where every part of what they are about to do is legal. They voted for that, or their neighbors did, and what they were promised was that this would finally stop being anybody’s business.

Nobody asked whether the promise came with a record of the trip. Nobody had to. That record exists because of a condition in a license, a term in a settlement, and a line in a security contract, and not one of those documents had a checkbox for the customer’s consent.

Sources

Full source list, statutes, and company statements →

Today's piece ends on what voters were promised. Tomorrow's episode is about whether they get to keep it.