Glossary

• Personal data / personal information — any information relating to an identified or identifiable person, including a recognizable face, voice, or license plate in visual content.

• Biometric data — physiological, biological, or behavioral characteristics (facial geometry, iris/retina patterns, fingerprints, voiceprints) used to identify a specific individual.

• Special category data (GDPR Art. 9) — a heightened class of personal data — including biometric data used for identification — that requires a stronger legal basis, usually explicit consent.

• Sensitive personal information (CCPA/CPRA) — California's equivalent heightened category, which explicitly includes biometric information such as facial, iris, and voice data used for identification.

• Anonymization — processing data so thoroughly that no one can be identified from it, even indirectly — true anonymization generally falls outside privacy-law scope.

• Pseudonymization — replacing identifying details with a substitute so the data can't be linked to a person without additional information kept separately — still considered personal data under most laws.

• Data subject / consumer — GDPR and CCPA's respective terms for the individual whose data is being collected or processed.

• Model release — a signed document in which an identifiable person consents to how footage or photos of them may be used.

• Redaction — permanently obscuring a region of an image or video with an opaque mask.

• Pixelation — obscuring detail by replacing it with visible blocks of averaged color.

• Digital Rights Management (DRM) — the policies, processes, and technologies used to control who can view, copy, modify, or distribute digital content.

• Metadata (EXIF/XMP/IPTC) — information embedded inside an image or video file itself — such as GPS location, timestamp, or copyright notice — that travels with the file.

• Data controller / data processor — GDPR terms distinguishing the organization that decides why and how data is processed (controller) from one that processes it on the controller's behalf (processor).

 Frequently Asked Questions

1. Do I need consent to film people in public?
   It depends on jurisdiction and purpose. Many places allow incidental filming in public spaces for editorial or personal use without individual consent, but commercial use — advertising, marketing, or monetized content that features an identifiable person — generally raises the bar and often requires a release. When in doubt, blur bystanders you can't get a release from rather than assuming public-space filming covers every use case.

2. Is blurring a face enough to make a photo "anonymous" under GDPR?
   Not automatically. Regulators and courts look at whether the blur is strong and consistent enough that the person genuinely cannot be re-identified — a light or partial blur may not meet that bar. For anything you need to treat as truly anonymized, pixelation or full redaction is a safer choice than a light blur.

3. What's the practical difference between GDPR and CCPA for my content?
   GDPR applies based on whose data you're processing (anyone in the EU/EEA) regardless of where you're located, and it requires a specific legal basis before you process personal data at all. CCPA/CPRA applies based on your business meeting certain thresholds and processing California residents' data, and it leans more on notice-and-opt-out rights than on requiring a legal basis up front. If your footage could reach either audience, it's worth designing your redaction workflow to satisfy the stricter of the two.

4. Can I rely on AI to auto-blur faces, or do I need to check every frame manually?
   AI-based detection (like BlurMe's) is accurate enough for most practical workflows and is far more consistent across thousands of frames than manual review, but no automated system is claimed to be 100% perfect. For high-stakes footage, do a quick manual spot-check of the output, especially in low-light or fast-motion scenes, before publishing.

5. Do I need to blur license plates too?
   License plates are treated as personal data in many jurisdictions because they can be traced back to a registered owner. If your footage clearly shows a plate and wasn't captured for a legitimate purpose like law enforcement or an authorized security function, it's generally safer to blur or redact it before publishing.

6. What if someone asks me to take down footage after I've already published it?
   Under GDPR, individuals generally have the right to request erasure or restriction of their personal data, and organizations are expected to respond within about a month. Under CCPA/CPRA, California residents have a similar right to request deletion. Regardless of which law technically applies to you, it's good practice to have a clear process for handling these requests — including editing published footage to blur or remove the person if a full takedown isn't practical.

7. Is a redaction tool like BlurMe a complete legal-compliance solution on its own?
   No — no software tool can determine your legal basis for processing, decide whether you needed consent, or file the paperwork a regulator might ask for. Tools like BlurMe handle the technical step of removing identifiers from footage efficiently and consistently; the legal judgment about when and why that's required still belongs to you or your legal counsel.

Further Reading

• Official GDPR text — eur-lex.europa.eu (Regulation (EU) 2016/679)

• California Privacy Protection Agency — cppa.ca.gov

• Illinois Biometric Information Privacy Act (BIPA) overview — for the strictest U.S. biometric-specific standard