General orientation, not legal advice. Requirements vary by jurisdiction and context, so verify locally for anything consequential.
When It's Typically Required or Expected
- Data protection regimes. Under the GDPR and similar laws, an identifiable face is personal data. Publishing it usually needs a lawful basis — consent, legitimate interest, or a journalistic exemption. Where none applies, anonymization is the standard remedy.
- Bystanders in commercial content. Marketing material featuring identifiable people generally requires releases; blurring uninvolved people is the practical alternative.
- Children, in almost every context beyond private family use.
- Sensitive settings — medical, legal, protest, religious, addiction and recovery contexts — where identification carries real risk.
- Institutional policy — schools, hospitals, employers and many events have their own rules that go beyond legal minimums.
- Platform requirements — some services require blurring of faces and plates in user-submitted imagery.
Also note: licence plates, house numbers, name badges and screens identify people too, and are often overlooked.
Why Common Methods Fail
- Mosaic / pixelation is not secure for text, and can be partially reversible for faces in some circumstances. Research has repeatedly demonstrated recovering pixelated content by matching candidates against the pattern.
- Light Gaussian blur leaves enough structure for both humans and matching systems in some cases.
- Emoji or sticker overlays in an editor may be saved as a separate layer that can be removed if you export a layered file.
- Blurring only the face ignores gait, clothing, tattoos, distinctive hair, context and companions.
Doing It Properly
- Use a solid, opaque shape — a black box, a filled silhouette — for anything that must genuinely not be recoverable. This is the only method with no recovery risk.
- If you use blur, make it heavy. Blur radius should be large relative to the face — enough that no facial structure remains, not a light smudge.
- Cover the whole head, not just the eyes. Eye bars are a stylistic convention, not anonymization.
- Flatten and re-export, then reopen the exported file and verify. Never publish a layered file.
- Check every frame in a video — one unblurred frame defeats the entire effort.
- Blur other identifiers in the same pass: plates, badges, documents, screens, house numbers.
- Remove metadata as well — location data can identify people the blurring was meant to protect.
At Scale
For large volumes, automated face detection plus blurring is practical, but:
- Detection misses faces — profiles, partial faces, faces in reflections, small background faces. Always review output.
- Set the blur strength conservatively and expand the detected region beyond the detected box.
- Keep an unblurred master in secure storage if you may need the original for legitimate purposes, and control access to it.
The Judgement Call
Legality is the floor, not the standard. Ask: could publishing this identifiable image cause harm to this person — professional, personal, physical? If yes, blur or don't publish, regardless of whether you're technically permitted. Conversely, over-blurring documentary material can strip it of meaning; the goal is proportionate protection, not maximum obscurity.
When in doubt on anything consequential — journalism, employment, litigation, safety — get advice rather than guessing.