Footage showing identifiable people or vehicles is personal data under GDPR. Before it is published, handed to a data subject or authority, shared with a processor or used for model training, those elements must be masked. Detector-plus-tracker pipelines find faces, bodies and plates in every frame and blur or replace them, replacing manual frame-by-frame editing with automated processing and a short human review.
Problem & value
- Today: municipalities, police and transport operators, mapping and inspection providers, media teams and AV developers edit footage manually or send it to service providers. This is slow, expensive and error-prone: one missed frame can be a data breach.
- AI value: automatic detection and tracking across frames, consistent masks, batch and edge processing, an audit trail, and review of only uncertain segments.
- Drivers: access and disclosure requests (GDPR Art. 15 must not reveal third parties; freedom-of- information requests), publication of street-level or drone imagery, sharing of training data, and the Law Enforcement Directive for body-cam disclosure. Vendor time-saving figures are marketing claims; measure your own baseline.
- Legal nuance: blurring is not automatically anonymisation in the GDPR sense (Recital 26): people can still be identified by clothing, gait, context or other data. Treat output as reduced-risk, often still pseudonymised, unless a documented re-identification assessment concludes otherwise [1][2].
Variants
- Public-sector disclosure: body-cam, CCTV and council footage released on data-subject or freedom-of-information requests; redaction of bystanders (Axon, Veritone Redact).
- Mapping and street-level imagery: faces and plates blurred before publication (mobility, utilities, real estate, infrastructure inspection, see VIS-003, VIS-004).
- AV and robotics training data: fleet camera data anonymised at the edge or in the cloud before sharing; optional synthetic face replacement ("deep natural anonymisation") that keeps model-relevant cues such as gaze direction.
- Live/streaming: real-time masking on edge devices or inside the video management system.
- Private use: blurring bystanders in photos or dashcam clips before sharing online; built into many phone galleries and consumer editors.
How it works
- ingest (files, streams, VMS export, cloud bucket)
- decode frames
- detect (faces, heads, bodies, plates, optionally screens, documents)
- track across frames (bridge occlusions and detection gaps)
- mask (blur, pixelate, opaque box, segmentation-shaped mask, or generative replacement)
- quality control (recall estimate, flag low-confidence spans, sample review)
- encode + export with audit log (metadata/EXIF and audio handled)
- Detection: YOLO-class or face-specific detectors tuned for high recall on small, profile, masked and motion-blurred faces; plate detectors for EU plate formats.
- Tracking: multi-object tracker plus temporal smoothing and padding so a one-frame miss does not leak identity. Recall, not precision, is the key metric.
- Masking: simple blur is cheap but can be partly reversible by modern deblurring; strong pixelation, opaque masks or synthetic replacement are safer. Synthetic faces must not resemble the real person.
- Human-in-the-loop: reviewers inspect flagged segments and a random sample, fix misses and approve release. For legal disclosure a named person remains accountable.
- Beyond pixels: voices, spoken names, GPS/timestamp metadata, on-screen text and reflections can still identify people.
Data preparation
The data is video and photo material: CCTV and VMS recordings, body-cam and dashcam files, drone or inspection photos. In an SMB it typically sits on NVR/VMS storage, file shares, phones and USB drives, in mixed codecs and with unclear retention.
Typical gaps: scattered storage, proprietary video formats, no catalogue of which footage contains people, missing deletion rules, and unclear access rights to raw originals. Preparation steps: inventory footage sources and owners, export to standard formats (FFmpeg, ONVIF export), define which classes to mask (faces, plates, screens, bodies), and separate raw originals with strict access from the anonymised copies that may circulate. Build a small evaluation set of difficult scenes (night, motion blur, crowds, small faces) and measure the miss rate, because one missed face is a data breach.
Effort share: about 20-30 percent, mostly storage clean-up and evaluation. Related groundwork: PREP-007 (format conversion), PREP-009 (storage restructuring), PREP-018 (evaluation sets), PREP-022 (pseudonymisation) and PREP-024 (classification rules).
Implementation paths
Which path for whom
- smb: A - mature EU-hosted blurring services and VMS add-ons exist at SMB prices for a standard task such as publishing or sharing footage.
- enterprise: C - large video volumes make per-minute fees high, the raw footage is sensitive, and a shared internal pipeline serves many use cases.
- developer: C - open-source detectors plus FFmpeg give full control, and the same pipeline can be reused across products.
- public: C - footage from public spaces and authorities should stay on sovereign, self-operated or German cloud infrastructure.
Path A — Buy (recommended for SMBs)
- EU vendors: Celantur (Austria; faces and plates, cloud API, on-premises container, edge), brighter AI (Germany; "Deep Natural Anonymization" with synthetic replacement, automotive and mobility data). Pimloc Secure Redact (UK) is a further option.
- Public-safety suites: Axon Redaction Assistant, Veritone Redact, and privacy-masking features in video management systems such as Genetec and Milestone XProtect.
- Hyperscaler features: Google Video Intelligence, Amazon Rekognition and Azure AI Vision provide detection that can drive masking, but not always a finished redaction workflow.
- Check: EU hosting or on-premises option, data processing agreement, reported recall rather than accuracy, plate formats, edge deployment, audit log, no use of your footage for vendor training.
- Choose A when: volume is moderate and you need a compliant, supportable workflow quickly.
Path B — Build on cloud APIs
- Use cloud detection (Azure AI Vision, Google Cloud Vision/Video Intelligence, Amazon Rekognition, all with EU regions) for faces and text, add plate logic, and mask with FFmpeg/OpenCV.
- Open-vocabulary detectors or VLMs help for rarer classes (name tags, laptop screens) but are too slow and costly per frame; run them on sampled keyframes only.
- Orchestrate with storage events, a queue and GPU batch jobs; keep everything in one EU region.
- Choose B when: you need custom classes or integration into an existing media or data platform.
Path C — Self-host (open source)
- Models/tools: Ultralytics YOLO (check AGPL/enterprise licence), RT-DETR or YOLOX (Apache-2.0) fine-tuned on face and plate data, OpenCV YuNet face detector, SAM 2 for segmentation-shaped masks, ByteTrack/BoT-SORT tracking, FFmpeg, NVIDIA DeepStream for streams, and the open-source deface tool for ready-made face blurring. Check dataset and model licences before commercial use.
- Hardware: HW1 for single streams on Jetson-class edge devices; HW2 for batch and multi-stream work; HW3 for large 4K archives and generative replacement.
- Ops effort: moderate; needs recall evaluation on your own footage and regression tests.
Path D — Custom training
Worth it for unusual viewpoints (fisheye, thermal, drone nadir, low-light dashcam), very small faces or domain-specific plates. Needs a few thousand labelled frames per domain, including hard negatives and occlusions. Reviewer corrections become training data; track recall at a fixed false-positive rate.
State of the art (2026)
- Face and plate detectors are mature and fast, real-time on edge hardware, with high recall on clean footage. Weak spots: tiny or distant faces, profile and rear views, masks, motion blur, night/IR footage, reflections and partial occlusion.
- Video tracking with temporal fill-in has largely replaced frame-independent blur, which flickers and leaks.
- Generative replacement (diffusion or GAN-based) preserves utility for ML training but needs validation: the synthetic face must not resemble the original, and realistic synthetic media may raise AI Act Art. 50 transparency questions if published.
- Reversibility: deblurring and diffusion models can partly recover weakly blurred faces; use strong masks. Body shape, clothing, tattoos, vehicle and location still identify people.
- Limits: no automatic system reaches 100 percent recall; real-world recall must be measured on your own footage, and high-stakes releases need a human check and documented residual risk.
Shared resources & combinations
- Same stack (object-detection + tracking + edge-runtime): VIS-010 surveillance, VIS-011 plate recognition, VIS-012 traffic analytics; one detector server can serve several. Privacy-by-design variants of those run anonymisation at the edge before storage.
- Text counterpart: DOC-018 document redaction; synthetic data: DATA-005.
- Upstream/downstream: VIS-003/VIS-004 inspection imagery, VIS-027 moderation, SEC-018 privacy operations (DSAR handling, records of processing).
- Contrast: VIS-016 (face recognition) identifies people; this use case does the opposite.
Effort, cost & KPIs
- Path A: days to weeks; pricing typically per hour of video, per stream or per image.
- Path B: 1-3 months for a production pipeline with storage and review UI; GPU cost dominates.
- Path C: 2-4 months including evaluation set; GPU server plus operations.
- KPIs: recall of faces/plates (per frame and per track), missed-identity incidents, review minutes per hour of video, throughput (x real time), cost per hour of footage, time to answer a disclosure request.
People & change
Involve management for the policy (what is blurred, who may see originals), the department lead or security manager as process owner, IT for storage and GPU capacity, and the data protection officer from the start: anonymisation is a processing of personal data and requires a legal basis, an AVV (Art. 28 GDPR) with any cloud provider and, for systematic video processing, often a DPIA (Art. 35 GDPR).
Works council: depends. The tool itself reduces exposure, but where it is introduced together with CCTV that records employees, or logs who reviewed which footage, co-determination under section 87(1) no. 6 BetrVG applies. Inform the council in good time (section 90(1) no. 3 BetrVG), ideally within the existing video-surveillance works agreement; public bodies involve the staff council.
AI literacy: support the people handling footage with short training on the tool's limits and the review step (Art. 4 AI Act). Communicate that anonymisation protects employees and the public. Start with one camera group or one project as pilot. Keep humans in control: a person spot-checks samples and approves before any footage leaves the company, and raw material is only released by named roles.
Guides: GUIDE-005, GUIDE-004, GUIDE-013.
Risks, regulation & compliance
- EU AI Act: typically minimal risk; masking identifies nobody. Do not combine it with Art. 5 prohibited practices (untargeted facial-image scraping, real-time remote biometric identification in public spaces for law enforcement outside narrow exceptions, emotion recognition at work or school). Generative replacement published as realistic content may fall under Art. 50 [3].
- GDPR / LED: anonymising is itself processing of personal data and needs a legal basis, a DPA with vendors, retention rules for originals and a DPIA where surveillance footage is involved. Recital 26 sets the bar for true anonymisation; blur alone often yields pseudonymised data. The Law Enforcement Directive applies to police footage.
- Other: national video-surveillance rules (e.g. German BDSG), works councils for workplace video, and evidence integrity: redacted copies must be traceable to untouched originals.
- Mitigations: recall-first thresholds, padding, strong masks, sample QA, audit logs, access control to originals, regression tests, processing inside the EU.
Getting started
- Define purpose and policy: recipients, classes to mask, retention of originals; run a DPIA if needed.
- Collect 1-2 hours of your hardest real footage (night, crowds, fisheye) as an evaluation set.
- Trial 2-3 Path A vendors and one open-source baseline; compare recall, not just visual quality.
- Build the review step (flagged spans plus a random sample) and the audit log.
- Document residual risk and whether the output counts as anonymised or pseudonymised.
Sources
- Regulation (EU) 2016/679 (GDPR), Recital 26 - https://eur-lex.europa.eu/eli/reg/2016/679/oj
- EDPB Guidelines 3/2019 on processing of personal data through video devices - https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32019-processing-personal-data-through-video_en
- Regulation (EU) 2024/1689 (AI Act) - https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- Celantur - https://www.celantur.com/
- brighter AI - https://brighter.ai/
- Axon - https://www.axon.com/
- Ultralytics YOLO documentation - https://docs.ultralytics.com/
- SAM 2 (Meta) - https://github.com/facebookresearch/sam2
- deface (open-source video anonymisation) - https://github.com/ORB-HD/deface