How to Anonymize First-Person (Egocentric) Video

The pipeline is the same five-step pass used on any footage: detect every face, plate, and screen in each frame; track each detection across frames so it stays covered as the wearer moves; blur each tracked region irreversibly into the delivered pixels; have a human reviewer scrub the episode to confirm nothing un-consented is identifiable; and record the pass — detector version, timestamp, reviewer — against the episode ID in the batch data card.

What is different for egocentric footage is not the pass itself but what it must leave alone. A head-mounted camera is pointed at the wearer’s own task, so the frame is dominated by the consented operator’s hands and the objects they are manipulating — exactly the content the dataset exists to capture. Anonymization targets the un-consented third parties who appear incidentally, not the subject doing the task.

A fixed security camera frames a static scene, so the faces that need blurring tend to be forward-facing and roughly the same size from frame to frame. A head-mounted camera moves with the wearer’s head, so a bystander’s face can turn away, blur with motion, shrink into the background, or re-enter frame after leaving it — all within the same clip. Detection has to hold up across profile views, motion blur, and partial occlusion, not just a single clean angle.

Tracking carries more of the load for this reason: linking the same detected face across frames is what keeps coverage from flickering off the moment a bystander turns their head or walks behind the wearer’s hand. A detector that only catches forward-facing faces leaks every profile and every re-entry.

The same categories of personal data turn up in egocentric footage as in any video capture, just reached through the wearer’s own movement through a space: bystanders walking through a kitchen or workshop, licence plates visible through a window or doorway, and screens or documents the wearer happens to glance at or pick up. Spoken identifiers — names, addresses, numbers — can also appear in the audio track.

No — the consented operator, their hands, and their point of view stay in frame. Anonymization targets un-consented third parties, not the training signal the dataset was collected to carry. For manipulation and whole-body policies, the hands, the objects, the gaze, and the scene are exactly what a model needs to learn from; blurring them would delete the data the capture was commissioned for.

Anyone who signed a release stays unblurred for the same reason the operator does: a release means they consented to appear, so they are not the population the pass is protecting. If a use case genuinely needs identifiable people — a named actor, a specific face — that is an explicitly consented capture scoped up front, not an exemption carved into the anonymization pass after the fact.

Blurring is a pixel-level redaction, not a frame-level transformation, so it does not touch the geometry carried alongside the video. Depth, IMU, hand pose, camera intrinsics and extrinsics, and action segment or keypoint labels are computed from the same underlying capture and are unaffected by which pixel regions get covered — the blur changes what a viewer sees in a bystander’s region, not the scene geometry, timestamps, or labels tied to the operator’s hands and the objects they touch.

This is also why the pass fails closed rather than loosely: if a reviewer cannot confirm a region is fully covered, the episode is held or discarded rather than shipped with a partial blur. A failed anonymization pass costs an episode, not a compromise on the labels or geometry of the episodes that do ship.

The pass runs automatically at ingest, before any footage is reviewed for delivery — every episode goes through detection and blurring as a standard stage, not an optional add-on requested after the fact.

Every episode passes a human review step after the automated detect-track-redact pass: a reviewer scrubs the footage and confirms no un-consented person is identifiable in any frame before the episode is cleared for delivery. If the reviewer is unsure a region is fully covered, the episode is held or discarded rather than shipped at reduced confidence.

The record of that check travels with the data. Each episode in the batch data card lists the de-identification pass, the detector version, and the reviewer who confirmed it, so the claim is checkable per file rather than asserted only at the batch level.

Consent and anonymization cover two different populations in the same capture. The consented operator — and anyone else who signed a release — appears in the delivered footage because they agreed to it; that consent is tracked as its own chain, separate from the anonymization pass. Anonymization is what protects everyone else: the bystanders, passersby, and incidental third parties who never agreed to appear and who the capture was never scoped to include.

Because anonymization is irreversible — the blur is baked into the delivered pixels with no un-redacted master shipped alongside and no key to reverse it — the de-identified footage of those third parties falls outside privacy regimes that apply to personal data, as distinct from a reversible mask that would keep it in scope.