What counts as anonymization for video under GDPR or CCPA?

Broadly, data is anonymized when a person can no longer be identified from it by any reasonably likely means, which is why our redaction is irreversible and covers more than faces — a plate, a screen, or a spoken name can each re-identify someone. We are a processor, not your legal advisor: we give you an auditable per-file record of what was removed and how, so your counsel can make the determination. See our guide on video anonymization and privacy law.

Do you anonymize the audio too?

Optionally, yes. Names, addresses, numbers, and other spoken identifiers are muted on the waveform and removed from any transcript we deliver, aligned to the video timeline. If you only need the picture redacted, we leave the audio untouched.

How is this different from just blurring faces?

Face blurring covers faces. Full video anonymization also covers licence plates, legible screens and documents, badges, and identifying speech — anything that re-identifies an un-consented person. If faces are genuinely the only exposure in your footage, the face-blurring service is the right, cheaper fit.

Is the redaction reversible or auditable?

Irreversible, and auditable. Each region is blurred into the delivered pixels with no reversible mask, and every file carries a record of the classes redacted, detector versions, reviewer sign-off, and measured recall — so a batch can be checked against its own certificate.

Can you process our existing archive?

Yes. Send a sample first; we anonymize it, you confirm the classes and recall meet your bar, and then we run the archive to the agreed spec with a delivery date. Ongoing feeds run as a standing pipeline.

Services / Video anonymization

Anonymize a whole video, not just the obvious faces.

Faces are the headline, but a plate through a window, a name on a monitor, a badge, or a spoken address re-identifies a person just as easily. Our pass finds and irreversibly redacts all of it, across the picture and the audio, then a reviewer signs off per clip.

Redaction: Irreversible, pixel-level
Detection: Bounding box + confidence
Review: 100% human sign-off
Scales with: GPU, not headcount

A first-person cycling frame with a green bounding box labelled face 0.80 drawn around the rider’s detected face. — Stage one. A vision model scans the frame and returns a bounding box around every face, with a confidence score. Nothing is altered yet — this labelled view stays internal.

A real frame at both stages. Detect returns the bounding box and confidence; Blur bakes the redaction into the delivered pixels.

What it is

Video anonymization, defined.

Video anonymization is the process of removing every personal identifier from a video so no individual can be recognised — faces and heads, licence plates, legible screens and documents, and identifying speech in the audio — with the redaction baked irreversibly into the delivered file.

What it covers

The cases a naive pass misses.

Recall is decided by the hard detections, not the easy ones — profiles, reflections, small and moving subjects. Those are what the tracking and the human review exist for.

Faces & headsEvery un-consented person, including profile, reflected, occluded, and distant faces, tracked across the clip.

Licence platesVehicle plates in traffic, car parks, and through doorways or windows — see the dedicated plate service for automotive-scale feeds.

Screens & documentsPhone and monitor content, forms, letters, badges, and mail that would leak names, addresses, or account numbers.

Tattoos & unique marksOn request, distinctive identifying features that make a person recognisable even with the face covered.

Identifying speechNames, addresses, phone numbers, and account details muted in the audio track and removed from any transcript we deliver.

At scale

Built to run continuously, not one file at a time.

Throughput scales with the GPU you allocate, so the pass keeps up with a standing feed instead of a person watching clips.

Identifier types: Choose which classes to redact per project — faces only, or the full set including plates, screens, and speech.
Volume: One-off archives through continuous ingest of hundreds of hours; throughput scales with GPU allocation.
Audio: Optional diarized transcript with identifiers removed, plus muted spans on the waveform, aligned to the video timeline.
Recall target: Per class. Set the acceptable miss rate in the spec; we report achieved recall on a labelled sample per class.
Turnaround: Delivery date quoted for batches; standing pipelines run continuously.

How it works

Detect, track, redact, review, certify.

Detection returns a box and a confidence per region; tracking keeps it covered across frames; the blur is irreversible; a human signs off; and the certificate records it per file.

1 · Detect: A vision model runs on every frame, returning a bounding box and a confidence score for each face, head, licence plate, and legible screen or document it finds.
2 · Track: Boxes are linked across frames into stable tracks, so a subject that turns away, blurs in motion, or leaves and re-enters is covered for the entire time they are on screen — not just the frames they face the camera.
3 · Redact: Each tracked region is irreversibly blurred into the pixel data of the output. There is no separate mask layer, no metadata toggle, and no key that restores the original region.
4 · Review: A human reviewer scrubs the output and confirms no un-consented person or identifier survives in any frame. If a region is uncertain, the clip is held or dropped rather than shipped.
5 · Certify: The detector version, pass timestamp, reviewer ID, and per-file settings are recorded against the clip, so the anonymization claim is checkable per file rather than asserted in a brochure.

See the detection-to-blur pipeline in full on the automatic anonymization page, and the step-by-step method in how to blur faces in video automatically.

What you get back

The output, plus proof it was done.

Output: The anonymized video in your format, optional redacted transcript, and an optional sidecar of detections per class.
Certificate: Per file: which classes were in scope, detector versions, reviewer ID, and measured recall per class.
Compliance record: A data-processing record suitable for a DPIA, listing what was redacted, how, and the source-handling decision.
Source handling: Return anonymized output only and delete the source, or return both and retain nothing — recorded in writing.

The guarantees

Irreversible, fails closed, auditable.

Automatic blurring is common. These are the commitments that make the result something your counsel can rely on.

Irreversible by construction: Blur is baked into the delivered pixels. No un-redacted master is shipped alongside, and there is no reversible mask or key.
Fails closed: When a reviewer is unsure a region is fully covered, the clip is held or discarded — never downgraded and shipped to hit a deadline.
Consented subjects preserved: Anyone who signed a release — your operator, your talent — can stay in frame. The pass targets un-consented third parties, not your usable signal.
Auditable per file: Every output carries the detector version, timestamp, reviewer sign-off, and redaction settings, so a batch can be spot-checked against its own record.
You keep the source, or we destroy it: Your choice, in writing: we return only the anonymized output and securely delete the source, or return both to you and retain nothing.

Where teams use it

Common jobs this service is sent.

GDPR / CCPA-aligned release of footage containing the public
Sharing recordings with analytics vendors or researchers under a DPA
Clearing training and evaluation video of all personal data
FOIA / public-records disclosure of bodycam and municipal video
Redacting depositions, telehealth, and insurance video

FAQ

Video anonymization — questions teams ask first.

What counts as anonymization for video under GDPR or CCPA?: Broadly, data is anonymized when a person can no longer be identified from it by any reasonably likely means, which is why our redaction is irreversible and covers more than faces — a plate, a screen, or a spoken name can each re-identify someone. We are a processor, not your legal advisor: we give you an auditable per-file record of what was removed and how, so your counsel can make the determination. See our guide on video anonymization and privacy law.
Do you anonymize the audio too?: Optionally, yes. Names, addresses, numbers, and other spoken identifiers are muted on the waveform and removed from any transcript we deliver, aligned to the video timeline. If you only need the picture redacted, we leave the audio untouched.
How is this different from just blurring faces?: Face blurring covers faces. Full video anonymization also covers licence plates, legible screens and documents, badges, and identifying speech — anything that re-identifies an un-consented person. If faces are genuinely the only exposure in your footage, the face-blurring service is the right, cheaper fit.
Is the redaction reversible or auditable?: Irreversible, and auditable. Each region is blurred into the delivered pixels with no reversible mask, and every file carries a record of the classes redacted, detector versions, reviewer sign-off, and measured recall — so a batch can be checked against its own certificate.
Can you process our existing archive?: Yes. Send a sample first; we anonymize it, you confirm the classes and recall meet your bar, and then we run the archive to the agreed spec with a delivery date. Ongoing feeds run as a standing pipeline.

Send a sample for video anonymization.

We anonymize a sample, you confirm the classes and recall meet your bar, and then we run the rest to spec with a delivery date. Standing feeds run continuously.

Request anonymization →All services