Millions of drivers in Europe use dashcams for evidence and security, but recording public roads captures the faces and licence plates of people who never consented. Whether that makes your dashcam legal under GDPR depends on which country you are in, how you store footage, and crucially, what you do with it before sharing.
This guide sets out the legal framework under GDPR, explains the household exemption and legitimate interest basis, maps country-specific restrictions, and explains exactly when (and how) anonymization is required to keep you on the right side of the law.
Disclaimer: This content is for general informational purposes only and does not constitute legal advice. Laws and regulatory positions vary by jurisdiction and change over time. Consult a qualified legal professional before making compliance decisions.
TL;DR
- Dashcams are not banned across the EU, but GDPR always applies to footage of public roads: the household exemption (Art. 2(2)(c)) does not cover filming beyond your own property.
- Legitimate interest (Art. 6(1)(f)) is the main lawful basis, but it requires a genuine, proportionate justification and must be balanced against third parties' rights; it is not automatic.
- Austria and Luxembourg effectively prohibit routine private dashcam use; most other EU/UK jurisdictions allow it with responsible handling.
- Blur faces and licence plates before sharing any footage publicly or with parties other than law enforcement. You can anonymize dashcam footage automatically in seconds.
Why dashcams trigger GDPR
GDPR applies whenever you process "personal data": any information relating to an identifiable natural person (Article 4(1)). A dashcam recording a public road captures:
- Faces of pedestrians, cyclists, and other drivers
- Vehicle licence plates, which are linked to registered owners in national databases
- Voice if the microphone is active inside the cabin
Each of these is personal data. That makes the driver operating the dashcam a data controller with obligations under GDPR, regardless of whether they intend to use the footage for anything.
The household exemption does not apply
Many drivers assume that personal, private recording is exempt. Article 2(2)(c) of GDPR does exclude "purely personal or household activities." However, the Court of Justice of the EU ruled in Ryneš v. Úřad pro ochranu osobních údajů (C-212/13) that recording a public street falls outside that exemption because it captures data of people beyond one's own household. The same logic applies to dashcam footage of public roads: full GDPR obligations follow.
The lawful basis: legitimate interest
Without consent (impractical from moving vehicles) and without being a law-enforcement body, private drivers most often rely on legitimate interest under Article 6(1)(f). Three conditions must all be met:
| Step | Requirement | Dashcam scenario |
|---|---|---|
| 1. Genuine interest | A real, specific, articulated interest | Evidence in the event of a collision or road crime |
| 2. Necessity | No less-intrusive means achieves the same goal | A dashcam is the only practical continuous record |
| 3. Balancing test | Interest must not override data subjects' rights | Continuous public footage of strangers raises real concerns |
Several national data protection authorities (DPAs), including the German DSK, Polish UODO, and Czech ÚOOÚ, have found that evidence-gathering for insurance or police purposes can pass this test, provided footage is retained only as long as necessary and not shared beyond what is required. The UK ICO takes a broadly similar position post-Brexit under the UK GDPR.
Legitimate interest is not a blank cheque. If you use footage for any purpose beyond the specific one you balanced (for example, uploading a compilation to a YouTube channel), a new basis is needed for that further processing.
Country-by-country risk map
| Country | DPA position | Effective status for private drivers |
|---|---|---|
| Austria | DSB: legitimate interest does not outweigh individuals' rights in public spaces | Routine use effectively prohibited |
| Luxembourg | CNPD: similar strict position | Routine use effectively prohibited |
| Germany | DSK: permitted for evidence purposes with data minimization | Permitted with conditions |
| Poland | UODO: legitimate interest accepted for collision evidence | Permitted with conditions |
| Czech Republic | ÚOOÚ: permitted; case law supports use in court | Permitted with conditions |
| France | CNIL: use in court accepted; no explicit ban | Permitted with conditions |
| Spain | AEPD: evidence use accepted; must minimize retention | Permitted with conditions |
| UK (post-Brexit) | ICO: UK GDPR applies; legitimate interest generally available | Permitted with conditions |
Positions evolve. Always verify with your national DPA or legal counsel before relying on dashcam footage in formal proceedings.
When anonymization is legally required
Owning a dashcam and keeping footage securely is one thing. Sharing footage publicly is another. The moment identifiable faces or licence plates leave your private possession and reach a wider audience, you are disclosing personal data without a basis, unless you anonymize first.
Scenarios that require anonymization
- Posting a clip to social media (TikTok, YouTube, Twitter/X, Facebook)
- Sharing footage with a journalist or news outlet
- Uploading to a road-safety forum or dashcam community
- Handing footage to a repair shop, insurer, or other non-police third party
- Using footage in civil litigation where it will be seen by opposing counsel and disclosed in court documents
Scenarios that may not require anonymization
- Submitting original footage to police following an incident (they operate under their own legal gateway)
- Sharing with your own insurer under a contract (they have their own data processing basis)
- Viewing footage privately on your own device and then deleting it
Even in exempt scenarios, data minimization (Article 5(1)(c)) and storage limitation (Article 5(1)(e)) apply: retain only the relevant clip, for no longer than necessary.
What to anonymize and how
For footage that will be shared, two categories of personal data require removal:
| Identifier | Why it is personal data | How to remove |
|---|---|---|
| Faces | Directly identify individuals | AI face detection + irreversible blur or pixelation |
| Licence plates | Linked to registered keeper via DVLA/KBA/etc. | AI text/plate detection + irreversible redaction |
| Voices (internal mic) | Voice prints + spoken names | Audio PII detection + redaction |
The word irreversible matters legally. A blurred face where the original pixel data is retained in metadata is not anonymized under GDPR's Recital 26 standard: the original must be unrecoverable. Medianonymizer's pipeline uses AI to locate faces and plates and then applies deterministic removal that destroys the underlying data, producing an audit record of what was removed. You can process dashcam clips at /anonymize/anonymize-dashcam-footage without installing software.
Data minimization and retention: the overlooked obligations
Even when you never share footage, GDPR's core principles apply to your storage:
- Configure your dashcam to overwrite loops automatically (24–72 hours is defensible for routine driving)
- Save and tag relevant incident clips immediately; delete surrounding footage
- Do not retain footage of third parties longer than the purpose requires (typically 30 days maximum for non-incident footage)
- Store footage on encrypted storage, not exposed cloud accounts
- Keep a simple record of why you retained any clip beyond the overwrite cycle
If your dashcam syncs to a manufacturer's cloud service, check whether that service processes data inside the EU/UK or transfers it internationally, triggering Chapter V GDPR obligations.
Practical compliance checklist
Use this before you mount a dashcam or share footage:
- Confirm dashcam use is not effectively prohibited in your country (check Austria/Luxembourg above)
- Articulate your legitimate interest in writing; even a brief note is better than nothing
- Configure automatic overwrite to minimize retention
- Never share identifiable footage publicly without first blurring faces and licence plates
- If submitting to police, provide the original unedited clip via their official channel
- Anonymize any clip before civil proceedings, insurance disputes, or media sharing
- Delete footage you no longer need
Start anonymizing dashcam footage
If you need to share dashcam footage (for an insurance claim, a road-safety report, or online), the fastest compliant path is irreversible anonymization before disclosure. Medianonymizer's AI pipeline detects faces, licence plates, and other PII across video formats and removes them permanently, with a timestamped audit record.
Frequently asked questions
In most EU member states, dashcams are not explicitly banned, but using one in a public place means you are processing personal data (faces, licence plates) of third parties, which triggers GDPR. You generally need a lawful basis, most commonly legitimate interest under Article 6(1)(f), and you must handle footage responsibly. A small number of countries, notably Austria and Luxembourg, have taken a stricter position that makes routine dashcam use effectively impermissible for private individuals.
