Build Your Own Face Blurring Tool or Buy One? A Real Cost Comparison for Engineering Teams

TL;DR: If your team processes recorded video or image datasets and needs faces and license plates blurred, building your own detector is cheaper only in month one. Maintenance, recall testing, codec handling and audit evidence are the costs that compound. Gallio PRO is on-premise anonymization software for engineering leads, MLOps teams and dataset owners who would rather license that maintenance than staff it.

The build decision is a maintenance decision

Almost every engineering team that evaluates anonymization software runs the same internal argument first: we have a GPU, we have Python, a pretrained detector plus a Gaussian blur is a weekend. That is true. A working prototype really is a weekend.

The prototype is not the deliverable. The deliverable is a process that produces defensible output every day, on footage nobody anticipated, with a record of what was redacted and why. That is the thing that has to be owned, versioned, tested and staffed for years. When teams compare build against buy, they usually price the weekend and ignore the decade.

What a DIY pipeline actually costs

Below is the work that sits between a prototype and something you would attach to a data sharing agreement. Effort is given in engineering days so you can apply your own loaded rate.

Work item	Initial build	Annual upkeep
Face detector selection, threshold tuning	5 to 10 days	3 to 5 days
License plate detection as a separate model	5 to 15 days	3 to 5 days
Temporal smoothing and tracking across frames	10 to 20 days	4 to 8 days
Container, codec and rotation metadata handling	5 to 10 days	3 to 6 days
Manual correction interface for missed objects	15 to 30 days	5 to 10 days
Recall test set, QA harness, regression runs	10 to 15 days	10 to 15 days
Documentation for auditors and security reviews	5 days	3 days

That is roughly 55 to 105 days to reach parity and 31 to 52 days every year afterwards just to hold position. A Gallio PRO Standard licence is EUR 89 per month, or EUR 1,068 per year with the annual discount. The break-even is not close, and it is not close by an order of magnitude.

Five places DIY pipelines break in production

1. Recall on hard faces. Open models score well on frontal, well lit, medium distance faces. Real footage is profile views, motion blur, backlight, low camera height and partial occlusion. Your demo set will not contain your failure set.
2. Plates are a second problem. License plate detection is a different task with different failure modes, different aspect ratios and country specific layouts. Teams routinely budget for one model and discover they need two.
3. Frame to frame consistency. A face detected in frames 1 to 40 and missed in frames 41 to 43 produces three frames of exposed identity. Single frame accuracy is not the metric that matters in video.
4. Containers and codecs. Rotation metadata, variable frame rate, audio track preservation and timestamp integrity are unglamorous and they are where output gets rejected by the recipient.
5. No correction path. When automation misses something, someone has to fix it before release. Without an editor, the fallback is a video editing suite and an afternoon.

For a deeper treatment of the detection side, see our breakdown of face blur for data privacy in deep learning.

The compliance gap that costs the most

Blurring is a technical act with a legal consequence, and the legal bar is higher than most build plans assume.

• GDPR Recital 26 places truly anonymous data outside the scope of the Regulation. Data that is merely pseudonymised stays inside it, with every obligation attached.
• Article 29 Working Party Opinion 05/2014 sets the three tests any anonymization technique must survive: singling out, linkability and inference. Reversible or partial blurring fails them.
• GDPR Article 25(1) requires data protection by design and by default, which means the redaction must be the default state of the export, not a manual step someone can forget.
• GDPR Article 32(1) requires technical measures appropriate to the risk, and expects you to be able to demonstrate them.
• GDPR Article 35(3)(c) triggers a data protection impact assessment for systematic monitoring of publicly accessible areas on a large scale.
• EU AI Act, Regulation (EU) 2024/1689, Article 5 prohibits untargeted scraping of facial images from the internet or CCTV to build facial recognition databases, which reshapes how visual datasets may be assembled in the first place.

An internal script has no vendor documentation, no third party validation and no change log a supervisory authority can read. You will write all three yourself, or you will not have them when asked.

How to run the build versus buy decision in six steps

1. Define the redaction scope in writing. Faces only, plates only, or both. Note separately anything else in frame such as badges, screens or documents, because no tool detects those automatically and they will need a manual pass.
2. Assemble a hostile test set. Pull 200 to 500 frames from your worst conditions, not your best: night, rain, wide angle, crowd depth, moving vehicles.
3. Measure recall, not accuracy. The number that matters is missed objects per thousand frames. A single missed face is a disclosure, regardless of how good the average looks.
4. Price the upkeep, not the build. Take the annual upkeep column above, multiply by your loaded engineering rate, and compare that to an annual licence.
5. Run the same test set through the Gallio PRO demo. The demo is free and unlimited, watermarked and capped at 720p, which is enough to measure recall on your own footage before any purchase.
6. Decide on cost per hour of processed footage. Include the manual correction time in both options. That single number ends most build versus buy arguments.

What Gallio PRO does and does not do

Gallio PRO runs entirely on your own machine or server. Processing is local, so footage never leaves your infrastructure, and the software stores no detection logs and no personal data. It is available as a desktop application for Windows 10 and later, macOS 10.14 and later and Linux with glibc 2.35 or newer, as a Docker container, and with a REST API for integration into an existing pipeline. GPU acceleration delivers up to ten times faster processing. Supported formats are JPG and PNG for images, MP4 and MOV for video.

Automatic detection covers faces and license plates only. Tattoos, name badges, company logos, documents and monitor screens are not detected automatically, and are handled in the built in manual editor, which also lets you remove blur selectively before export. Gallio PRO processes recorded files and does not perform live stream processing. If your requirement is a live feed, this is the wrong category of tool and you should say so early.

When building your own still makes sense

Three cases justify the investment. First, redaction is your product rather than a step inside it. Second, your primary detection targets are objects no commercial tool automates, in which case you are building a detector anyway. Third, your formats sit outside standard image and video containers, for example raw sensor output or proprietary telemetry.

If you are anonymizing training data at scale, the practical middle path is usually a licensed engine inside your own orchestration. Our guide to anonymization workflows for AI training datasets covers that pattern, and automated video and image anonymization explains how the detection stage behaves at volume.

For most teams the honest conclusion is narrow: you can build it, and the reason to buy it is that you would rather spend those 40 engineering days on the product your company actually sells. You can test that claim against your own footage using Gallio PRO video anonymization.

FAQ

Is blurring faces enough to make data anonymous under GDPR?

Only if the result survives the singling out, linkability and inference tests in Article 29 Working Party Opinion 05/2014. Irreversible blurring of every identifying element can reach that bar. Partial or reversible blurring leaves the data personal, and GDPR continues to apply in full.

Can open source models detect license plates as well as faces?

Not out of the box. Plate detection is a separate task with country specific layouts and aspect ratios, and it usually needs its own model, its own training data and its own evaluation set.

How long does it take to build a face blurring pipeline in house?

A prototype takes days. A production pipeline with tracking, codec handling, a correction interface and a QA harness typically takes 55 to 105 engineering days, then 31 to 52 days per year to maintain.

Does Gallio PRO blur tattoos, badges or screens automatically?

No. Automatic detection covers faces and license plates. Anything else is redacted in the built in manual editor.

Can Gallio PRO run without an internet connection?

Yes. Processing is fully local on your own hardware, and the software stores no detection logs and no personal data.