Think carefully before storing a video on the cloud, sharing it with another person, or uploading it to YouTube, TikTok, or other social media platforms. If it shows license plates and other personal data, you might legally need to blur parts of the video to help protect people’s privacy.
The law on blurring license plates in videos varies by region. In some circumstances, publishing a video showing people’s license plates might be illegal or lead to a lawsuit. As we’ll see, people have even used license plate numbers to commit serious crimes.
Anonymizing a video by blurring license plates is a quick and simple process. So even if it’s not clear whether privacy law requires you to blur someone’s license plate or face before sharing a video, it’s likely a good idea to do so.
Does the law require you to blur license plates in a video or photo before sharing it? Like with almost every legal question: It depends.
As a general rule, you should always take reasonable steps to protect people’s privacy. This includes using video anonymization software, which provides an easy way to blur faces and license plates in videos. In some circumstances, the law is even clearer.
Here’s how the law applies to videos of license plates in Europe and the United States.
In Europe, the main law that covers blurring license plates is the General Data Protection Regulation (GDPR).
The GDPR applies across the European Economic Area (EEA)—that’s every EU country plus Iceland, Liechtenstein, and Norway. A practically identical law exists in the UK, known as the “UK GDPR,” and Switzerland has similar legislation.
Individuals, businesses, and other organizations are covered by the GDPR regardless of their size or sector.
There’s an exemption to the GDPR for “purely personal or household activities.” However. regulators and courts across Europe have found that this exemption does not apply to activities like:
Uploading videos to YouTube, social media, or even a personal website is likely covered by the GDPR if the videos include personal data.
The GDPR is all about “processing personal data.”
License plates can be personal data, and recording or publishing videos of license plates can be “processing personal data”.
Under the GDPR, you must take steps to protect personal data and avoid violating people’s rights. Such steps can include anonymizing videos by blurring license plates and faces.
The principle of “data minimization” requires that you only process the personal data necessary for a specific purpose.
If you blur license plates and other personal data from a video or photo, the video will be anonymous and not subject to the GDPR. You can publish the blurred video without worrying about data protection law. You’ll still need to comply with the GDPR with respect to the unblurred video.
Here’s a real example of how the GDPR applies to images of license plates, from November 2023.
A Greek property company published a photo of a house on its website. The company had seized the house from its previous owner. The previous owner’s son’s car was parked in the driveway, and the photo showed the car’s license plate.
The individual complained that the property company had violated his privacy. Because his license plate was visible, his social circle identified his car and learned that his family’s property had been seized.
When the individual complained, the property company replaced the photo with an anonymized version where the license plate was redacted. But it was too late—the company received a €20,000 fine, partly for failing to redact the car’s license plate before publishing the photo.
Note that, while someone’s privacy was violated in this case, data protection regulators can enforce the GDPR against a company even if no one has been harmed or even made a complaint.
The complex US privacy landscape mostly consists of state law, sector-specific regulation, and many, many lawsuits.
For example, in June 2024, a California court will hear a case against a company that allegedly scanned people’s license plates and sold information about their locations.
Some federal privacy laws cover license plate numbers indirectly. For example, an image of a student’s license plate might form part of an “education record” under the Family Education Rights and Privacy Act (FERPA).
But the US has also passed a privacy law specifically to protect license plate numbers and other driver-related data.
Before the mid-90s, individuals in most US states could use a person’s license plate number to obtain their home address from the Department of Motor Vehicles (DMV). This policy led to a series of serious crimes.
In 1989, 21-year-old actor Rebecca Schaeffer was murdered by a stalker who had obtained her home address using her license plate number.
Speaking in support of stricter driver privacy legislation in 1993, Senators Barbara Boxer and Chuck Robb cited several similar crimes committed by people who had obtained people’s home addresses via their license plate numbers, including:
In response to these and other cases, Congress passed the Driver’s Privacy Protection Act (DPPA) in 1994, restricting access to motor vehicle records.
More broadly, these incidents show how important it is to protect license plate numbers and other personal data.
While the DPPA doesn’t necessarily require the redaction of license plate numbers, new privacy laws at the state level might have relevant implications.
US privacy law is developing fast, and businesses are held to increasingly high standards when processing personal data.
Seventeen US states have now passed “comprehensive privacy laws” that apply across sectors and require the protection of a broad range of personal data, including:
These laws use GDPR-style language to define “personal data” or “personal information,” which could include license plates.
They require covered businesses to establish reasonable security measures to protect personal information. In certain circumstances, this could include blurring license plates and other identifiers before sharing a video.
