License plate blurring is a form of visual data anonymization that masks vehicle registration marks in photos and videos so that a person linked to that plate cannot be identified. Under GDPR and UK GDPR, a license plate is personal data when it relates to an identifiable individual, considering means reasonably likely to be used by the controller or anyone else to identify that person [1]. Regulators and guidance generally treat plates captured in images and footage as personal data in many circumstances, which makes license plate blurring a common compliance control for publishing visual content [2][3].
In business publishing scenarios - marketing campaigns, PR materials, product demos, public-sector transparency footage - blurring is generally expected when the unblurred plate would constitute personal data and there is no strong reason to show it unmasked. Two core GDPR-UK GDPR duties drive this decision: 1) have a lawful basis to publish an identifiable plate, and 2) apply data minimization - only disclose what is necessary for the purpose [1][4]. If showing the plate is not necessary, anonymize it before publication.
A practical decision path used by many compliance teams is:
Street scenes used in brand campaigns: publish, with license plate blurring and face blurring by default. It rarely helps the viewer to see the exact plate, and blurring reduces identification risk.
Customer testimonials filmed in car parks: if the plate relates to the featured person and they have provided informed consent for an unblurred image, some organisations still blur the plate to meet minimization and to avoid downstream reuse beyond the consent context. Consent must be valid and can be withdrawn - blurring keeps the content broadly usable.
Product demonstrations for automotive technology: where a working plate is needed to illustrate a feature, organisations often use controlled assets - their own vehicles with plates set to non-real/test values - or use synthetic overlays rather than publishing real-world plates.
Police or parking enforcement footage released by public authorities: this is subject to separate laws and policies (and, in the UK, may involve law-enforcement processing regimes). For publication, many authorities use blurring unless showing the plate is necessary for a specific public interest communication established in law, policy, or an operational need.
If identification of a natural person is not reasonably likely considering available means, the GDPR-UK GDPR regime does not apply [1]. Examples include plates that are already unreadable in the image because of distance, motion or resolution, or plates that cannot be linked to an identifiable person in practice. This is context-dependent - what is reasonably likely for a broadcaster or platform differs from a private individual - and should be recorded in the risk assessment. When in doubt, license plate blurring remains a low-cost control.
Processing by a natural person in the course of a purely personal or household activity falls outside GDPR scope [1]. This exemption is narrow. It does not cover business publishing, company social channels, or creators acting for commercial purposes. Case law confirms that systematic monitoring of public space can defeat the exemption. Businesses should not rely on this exception.
EU Member States and the UK provide exemptions or derogations to reconcile data protection with freedom of expression and information [1][5]. News reporting, documentary filmmaking, and certain artistic works may rely on national special-purpose regimes that modify or disapply some GDPR obligations. The details are jurisdiction-specific and often require necessity and accountability measures. Marketing and advertising do not normally fall under these special purposes. Where the exemption applies, teams document the purpose and necessity - blurring may not be required if showing the plate is editorially essential.
Topic | EU GDPR | UK GDPR
|
|---|---|---|
Are plates personal data? | Yes, if an individual is identifiable directly or indirectly - Recital 26 test [1] | Same approach - UK interpretation aligns with ICO guidance [3][4] |
Common lawful basis to publish | Legitimate interests may apply (with an assessment); consent is possible but fragile for broad publishing [1] | Same - legitimate interests often used, subject to the required assessment approach under UK GDPR/ICO guidance [4] |
Data minimization | Show only what is necessary for the purpose - blurring used when the plate adds no value [1] | Same duty under UK GDPR and DPA 2018 (where applicable) [4] |
Freedom of expression exemptions | Implemented under national law per Article 85 - scope varies [1] | Set out in the Data Protection Act 2018 for special purposes journalism, academia, art and literature [5] |
Household exemption | Applies only to purely personal activities - narrow [1] | Same - does not cover business publishing [4] |
Video-specific guidance | EDPB Guidelines 3/2019 on processing of personal data through video devices [2] | ICO guidance on video surveillance and images as personal data/accountability [3][4] |
Teams that publish visual content at scale typically implement five controls:
For an on-premise option aligned to these practices, Check out Gallio PRO.
Legitimate interests is often a workable lawful basis for publishing street images. The assessment considers viewer expectations, whether the scene is public, and whether the same purpose can be achieved with license plate blurring. If the purpose is unaffected by masking, many organisations treat blurring as a straightforward way to reduce risk and support the assessment. Where showing a plate is necessary - for example, an investigative documentary under a freedom of expression regime - necessity should be recorded with clear editorial justification.
Interested in testing a workflow for visual data anonymization with on-premise processing and reviewer checkpoints? Download a demo.
1) Automate plate detection with models trained for regional formats and challenging angles. 2) Combine detection with strong masking - mosaic or Gaussian blur - and render at the final output resolution. 3) Cascade face blurring alongside license plate blurring to cover both identifiers in one pass. 4) Keep a reversible pipeline only in a secure environment and publish irreversibly anonymized versions. 5) Provide a redaction UI for manual touch-ups before export.
Looking for vendor-neutral guidance or a privacy review of an existing pipeline? Contact us.
No. They are personal data when an individual is identifiable with means reasonably likely to be used. In many real-world publishing scenarios, plates are treated as personal data, so blurring is a common compliance approach [1][2][3].
Not necessarily. Many organisations rely on legitimate interests for public-space imagery, subject to an assessment and data minimization. Consent can work for controlled shoots but is fragile for broad reuse and withdrawals [1][4].
Only if the activity is purely personal or household. Commercial, organisational, or creator-for-hire activity is unlikely to qualify for the household exemption [1].
Public location does not switch off data protection. If a plate identifies a person, publishing still requires a lawful basis and minimization. Blurring remains a proportionate control [1][2].
It can be, if the mask is irreversible at the published quality and no other identifiers remain. If reversal is possible or other cues identify a person, the output may still be personal data - decisions are context-dependent [1][2].
If the plate does not relate to an identifiable natural person, the risk is lower. However, plates can still enable inferences about employees, routes, or customers depending on context. Many teams still blur; this is context-dependent.
Many organisations choose on-premise software to minimize transfers of raw footage and to retain control over security and retention. Any performance or cost benefits depend on the specific environment and scale.
