Are Dashcams Legal Under GDPR? Rules, Bases, and Anonymization
When is dashcam footage legal in the EU and UK under GDPR? Covers legitimate interest, household exemption, country bans, and when to blur.
Millions of drivers in Europe use dashcams for evidence and security — but recording public roads captures the faces and licence plates of people who never consented. Whether that makes your dashcam legal under GDPR depends on which country you are in, how you store footage, and crucially, what you do with it before sharing.
This guide sets out the legal framework under GDPR, explains the household exemption and legitimate interest basis, maps country-specific restrictions, and explains exactly when — and how — anonymization is required to keep you on the right side of the law.
Disclaimer: This content is for general informational purposes only and does not constitute legal advice. Laws and regulatory positions vary by jurisdiction and change over time. Consult a qualified legal professional before making compliance decisions.
TL;DR
- Dashcams are not banned across the EU, but GDPR always applies to footage of public roads: the household exemption (Art. 2(2)(c)) does not cover filming beyond your own property.
- Legitimate interest (Art. 6(1)(f)) is the main lawful basis, but it requires a genuine, proportionate justification and must be balanced against third parties' rights — it is not automatic.
- Austria and Luxembourg effectively prohibit routine private dashcam use; most other EU/UK jurisdictions allow it with responsible handling.
- Blur faces and licence plates before sharing any footage publicly or with parties other than law enforcement — you can anonymize dashcam footage automatically in seconds.
Why dashcams trigger GDPR
GDPR applies whenever you process "personal data" — any information relating to an identifiable natural person (Article 4(1)). A dashcam recording a public road captures:
- Faces of pedestrians, cyclists, and other drivers
- Vehicle licence plates, which are linked to registered owners in national databases
- Voice if the microphone is active inside the cabin
Each of these is personal data. That makes the driver operating the dashcam a data controller with obligations under GDPR, regardless of whether they intend to use the footage for anything.
The household exemption does not apply
Many drivers assume that personal, private recording is exempt. Article 2(2)(c) of GDPR does exclude "purely personal or household activities." However, the Court of Justice of the EU ruled in Ryneš v. Úřad pro ochranu osobních údajů (C-212/13) that recording a public street falls outside that exemption because it captures data of people beyond one's own household. The same logic applies to dashcam footage of public roads — full GDPR obligations follow.
The lawful basis: legitimate interest
Without consent (impractical from moving vehicles) and without being a law-enforcement body, private drivers most often rely on legitimate interest under Article 6(1)(f). Three conditions must all be met:
| Step | Requirement | Dashcam scenario |
|---|---|---|
| 1. Genuine interest | A real, specific, articulated interest | Evidence in the event of a collision or road crime |
| 2. Necessity | No less-intrusive means achieves the same goal | A dashcam is the only practical continuous record |
| 3. Balancing test | Interest must not override data subjects' rights | Continuous public footage of strangers raises real concerns |
Several national data protection authorities (DPAs) — including the German DSK, Polish UODO, and Czech ÚOOÚ — have found that evidence-gathering for insurance or police purposes can pass this test, provided footage is retained only as long as necessary and not shared beyond what is required. The UK ICO takes a broadly similar position post-Brexit under the UK GDPR.
Legitimate interest is not a blank cheque. If you use footage for any purpose beyond the specific one you balanced (for example, uploading a compilation to a YouTube channel), a new basis is needed for that further processing.
Country-by-country risk map
| Country | DPA position | Effective status for private drivers |
|---|---|---|
| Austria | DSB: legitimate interest does not outweigh individuals' rights in public spaces | Routine use effectively prohibited |
| Luxembourg | CNPD: similar strict position | Routine use effectively prohibited |
| Germany | DSK: permitted for evidence purposes with data minimization | Permitted with conditions |
| Poland | UODO: legitimate interest accepted for collision evidence | Permitted with conditions |
| Czech Republic | ÚOOÚ: permitted; case law supports use in court | Permitted with conditions |
| France | CNIL: use in court accepted; no explicit ban | Permitted with conditions |
| Spain | AEPD: evidence use accepted; must minimize retention | Permitted with conditions |
| UK (post-Brexit) | ICO: UK GDPR applies; legitimate interest generally available | Permitted with conditions |
Positions evolve. Always verify with your national DPA or legal counsel before relying on dashcam footage in formal proceedings.
When anonymization is legally required
Owning a dashcam and keeping footage securely is one thing. Sharing footage publicly is another. The moment identifiable faces or licence plates leave your private possession and reach a wider audience, you are disclosing personal data without a basis — unless you anonymize first.
Scenarios that require anonymization
- Posting a clip to social media (TikTok, YouTube, Twitter/X, Facebook)
- Sharing footage with a journalist or news outlet
- Uploading to a road-safety forum or dashcam community
- Handing footage to a repair shop, insurer, or other non-police third party
- Using footage in civil litigation where it will be seen by opposing counsel and disclosed in court documents
Scenarios that may not require anonymization
- Submitting original footage to police following an incident (they operate under their own legal gateway)
- Sharing with your own insurer under a contract (they have their own data processing basis)
- Viewing footage privately on your own device and then deleting it
Even in exempt scenarios, data minimization (Article 5(1)(c)) and storage limitation (Article 5(1)(e)) apply: retain only the relevant clip, for no longer than necessary.
What to anonymize and how
For footage that will be shared, two categories of personal data require removal:
| Identifier | Why it is personal data | How to remove |
|---|---|---|
| Faces | Directly identify individuals | AI face detection + irreversible blur or pixelation |
| Licence plates | Linked to registered keeper via DVLA/KBA/etc. | AI text/plate detection + irreversible redaction |
| Voices (internal mic) | Voice prints + spoken names | Audio PII detection + redaction |
The word irreversible matters legally. A blurred face where the original pixel data is retained in metadata is not anonymized under GDPR's Recital 26 standard — the original must be unrecoverable. Medianonymizer's pipeline uses AI to locate faces and plates and then applies deterministic removal that destroys the underlying data, producing an audit record of what was removed. You can process dashcam clips at /use-cases/anonymize-dashcam-footage without installing software.
Data minimization and retention: the overlooked obligations
Even when you never share footage, GDPR's core principles apply to your storage:
- Configure your dashcam to overwrite loops automatically (24–72 hours is defensible for routine driving)
- Save and tag relevant incident clips immediately; delete surrounding footage
- Do not retain footage of third parties longer than the purpose requires (typically 30 days maximum for non-incident footage)
- Store footage on encrypted storage — not exposed cloud accounts
- Keep a simple record of why you retained any clip beyond the overwrite cycle
If your dashcam syncs to a manufacturer's cloud service, check whether that service processes data inside the EU/UK or transfers it internationally, triggering Chapter V GDPR obligations.
Practical compliance checklist
Use this before you mount a dashcam or share footage:
- Confirm dashcam use is not effectively prohibited in your country (check Austria/Luxembourg above)
- Articulate your legitimate interest in writing — even a brief note is better than nothing
- Configure automatic overwrite to minimize retention
- Never share identifiable footage publicly without first blurring faces and licence plates
- If submitting to police, provide the original unedited clip via their official channel
- Anonymize any clip before civil proceedings, insurance disputes, or media sharing
- Delete footage you no longer need
Start anonymizing dashcam footage
If you need to share dashcam footage — for an insurance claim, a road-safety report, or online — the fastest compliant path is irreversible anonymization before disclosure. Medianonymizer's AI pipeline detects faces, licence plates, and other PII across video formats and removes them permanently, with a timestamped audit record.
Frequently asked questions
- Are dashcams legal in the EU under GDPR?
- In most EU member states, dashcams are not explicitly banned, but using one in a public place means you are processing personal data (faces, licence plates) of third parties, which triggers GDPR. You generally need a lawful basis — most commonly legitimate interest under Article 6(1)(f) — and you must handle footage responsibly. A small number of countries, notably Austria and Luxembourg, have taken a stricter position that makes routine dashcam use effectively impermissible for private individuals.
- Does the GDPR household exemption cover dashcam footage?
- Article 2(2)(c) of the GDPR exempts processing carried out by a natural person in the course of a 'purely personal or household activity.' The European Court of Justice (Ryneš, C-212/13) has interpreted this narrowly: recording a public street, pavement, or other persons' property extends beyond the purely personal sphere and is NOT covered by the exemption. Dashcam footage of public roads therefore falls under full GDPR obligations in most scenarios.
- What is the lawful basis for dashcam use under GDPR?
- Legitimate interest (Article 6(1)(f)) is the most cited basis for private individuals. A three-part balancing test applies: (1) you must have a genuine, specific interest (e.g. evidence in a road collision); (2) processing must be necessary to achieve it; (3) your interest must not be overridden by the rights and freedoms of those filmed. Courts and data protection authorities in several countries have accepted evidence-gathering as a legitimate interest, but this is not automatic — the balance must tilt in your favour.
- When must I blur faces and licence plates in dashcam footage?
- Any time footage is shared beyond a strictly limited circle — uploading to social media, submitting to a news outlet, publishing as a viral video, or handing to a third party who is not a law-enforcement authority — you must anonymize recognizable faces and legible licence plates before disclosure. Sharing identifiable footage publicly without a basis amounts to an unauthorized disclosure of personal data under GDPR. For legitimate evidence submission to police, check with your national authority; many forces accept unredacted footage under their own legal gateway.
- Which EU countries have the strictest dashcam rules?
- Austria's data protection authority (DSB) has consistently held that dashcam use by private individuals in public spaces violates GDPR because legitimate interest does not outweigh individuals' rights in the Austrian context — making routine use effectively prohibited. Luxembourg's CNPD has taken a similar position. In contrast, Germany, Poland, the Czech Republic, and Spain have allowed dashcam evidence in court proceedings, with national DPAs generally accepting legitimate interest with caveats. Rules continue to evolve; consult a local legal professional before relying on footage in proceedings.
- Does GDPR apply to dashcam footage used only for personal evidence?
- If footage is kept strictly on your device, never shared, and only produced to the police or insurer after an incident, the data minimization and storage limitation principles still apply: retain only what you need, for as long as you need it. Many dashcams overwrite loops automatically after 24-72 hours, which supports a data-minimization argument. If an incident occurs, save the relevant clip promptly and delete unrelated footage.