01
Ingest
Your footage lands in an EU bucket or in your own cloud account.
Synthetic scene, masked by the anonymization model
Share camera data without sharing faces.
Faces and license plates, masked in every frame of your vehicle and robot footage. Inside the EU, as a service.
Faces and plates, masked in every frame. Processed inside the EU.
From raw footage to a masked delivery.
Runs in the Marsstein EU cloud, in your own cloud account or on your own GPU servers.
02Mask
Faces and plates are detected and covered with irreversible pixelation, frame by frame. Nothing else in the picture changes.
Synthetic scene, masked by the anonymization model
03Verify and deliver
An automated check tries to read plates and find faces in the output. Its result ships with the delivery.
Synthetic scene, masked by the anonymization model
What gets masked, and what stays.
Faces
Detected and covered with irreversible pixelation, frame by frame.
License plates
Masked in every frame. An automated check then tries to read them in the output.
Street scenes
Everything else stays
Resolution, frame rate, timestamps and channels such as CAN, GPS and lidar pass through untouched.
Processed in the EU
Runs in the Marsstein EU cloud, in your own cloud account or on your own GPU servers.
Synthetic scenes, masked by the anonymization model
Proof.
100+ TB
of camera data processed, per Marsstein delivery records.
Where camera data and compliance meet.
Get test-fleet footage to your engineers in China.
The anonymization model masks faces and license plates inside the EU before the data leaves, and Marsstein Compliance documents the assessment and the transfer.
From recording to R&D abroad in three steps. The order matters: nothing leaves the EU before the second step is done.
- 01Anonymize in the EUThe anonymization model masks faces and license plates in vehicle camera footage on EU infrastructure, before any copy leaves the EU.
- 02Assess the datasetBlurring alone is not the test. GPS traces, lidar, timestamps and vehicle IDs are checked against singling out, linkability and inference, dataset by dataset.
- 03Transfer with evidenceMarsstein Compliance records what was masked, the assessment result and, where data stays personal, the Chapter V transfer mechanism and its supporting documents.
Robot camera footage for training physical AI.
Market entry for robotics manufacturers: guidance on CE marking and the EU Machinery Regulation, GDPR and EU AI Act compliance, and anonymization of robot camera data.
Raw data stays on the device or in EU-based cloud instances by default. Faces and license plates are masked with the anonymization model before export or cross-border replication. Whether the result is anonymous is assessed per dataset against singling out, linkability and inference (WP29 Opinion 05/2014).
CE marking and market entry for robotsWhat physical AI anonymization is
Logistics: warehouse surveillance and tracking
GPS fleet tracking, warehouse cameras and delivery scanning all process personal data, often without adequate privacy notices or a documented legal basis.
The anonymization model masks faces and plates in camera footage. Marsstein Compliance drafts the DPAs, processing records and cross-border transfer assessments you need, and updates them as your operations and vendors change.
Explore ComplianceHealthcare: clinical trial data protection
Research involving patient data requires pseudonymization, DPIAs and specific consent mechanisms that differ from standard clinical operations.
Marsstein Compliance drafts DPIAs for health data processing, records of processing and GDPR consent workflows, and keeps the audit trail regulators expect.
Explore Compliance
Masking is not automatically anonymization.
Whether a delivered dataset is anonymous is assessed per dataset: can a person still be singled out, linked or inferred? Channels such as GPS or CAN can still point to someone.
Marsstein does
Mask faces and license plates in vehicle camera data with the anonymization model inside the EU, and record the per-dataset anonymity assessment and the transfer documentation in Marsstein Compliance.
Marsstein does not
Decide on its own that a dataset is anonymous, certify it, or replace legal advice. Your counsel or data protection officer signs off the assessment.
Blurred is not the same as anonymous.
Anonymous data is outside the GDPR (Recital 26), and therefore outside the Chapter V rules on transfers to third countries such as China. That makes anonymizing before transfer the cleanest path, when it works.
It works only if the result is actually anonymous. Masking faces and license plates covers the obvious identifiers, but a GPS track, a precise timestamp or a vehicle ID can still point to one person. The Article 29 Working Party (Opinion 05/2014) sets three tests: can a person be singled out, can records be linked to them, can something about them be inferred.
The EDPB guidelines on connected vehicles (01/2020) point the same way: process data locally where possible, and consider anonymizing it before it is transmitted outside the vehicle.
Where data stays personal, Chapter V applies in full. China has no EU adequacy decision, so transfers need safeguards such as standard contractual clauses under Article 46. Regulators enforce this: in May 2025 the Irish DPC fined TikTok EUR 530 million in total, of which EUR 485 million for infringing Article 46(1) GDPR in its transfers of EEA user data to China.
The model
01Is the pixelation reversible?
No. The pixelation destroys the underlying pixels; nothing is recoverable from the output. Raw footage is processed in the EU and deleted per retention agreement.
02Does it damage my training data?
No. Only detected face and plate regions change. Resolution, frame rate, container structure, timestamps and channels such as CAN, GPS and lidar pass through untouched. Those channels can still point to a person, so whether the delivered dataset is anonymous is assessed per dataset, against singling out, linkability and inference.
03How do you prove coverage?
Every batch runs an automated audit that tries to read plates and match faces on the output. The measured leak rate ships with the delivery report.
04How does cross-border delivery work?
Masked output is replicated server side between cloud regions, to Hong Kong, mainland China, the US or wherever your team sits, checksum-verified after transfer.
05Where does the masking run?
In the Marsstein EU cloud, in your own cloud account or on your own GPU servers. Your footage lands in an EU bucket or in your own cloud account.
Driving footage and transfers
06Can we transfer vehicle camera data from the EU to China?
Yes, if the data is anonymous and therefore outside the GDPR, or if the transfer is covered by a Chapter V mechanism. China has no EU adequacy decision, so personal data needs safeguards such as standard contractual clauses under Article 46 (GDPR Articles 44-49).
07Is blurred video still personal data under the GDPR?
It can be. Blurring faces and plates covers direct identifiers, but GPS, lidar, timestamps and vehicle IDs can still single out a person, so each dataset is assessed against singling out, linkability and inference (WP29 Opinion 05/2014).
08Is anonymized data subject to the GDPR transfer rules?
No, anonymous data is outside the GDPR (Recital 26) and therefore outside Chapter V, but only if the dataset is actually anonymous after assessment. For pseudonymized data, the CJEU held in C-413/23 P (September 2025) that it may not be personal data for a recipient who cannot reasonably re-identify the people in it.
09Are faces and license plates important data in China?
Yes, for automobile data collected in China: the CAC Several Provisions on Automotive Data Security (in force 1 October 2021) list video and image data outside the vehicle containing faces and license plates as important data. Data collected in Europe and sent to China for processing is a different case, addressed by Article 4 of the 2024 cross-border data provisions.
10What does Marsstein do in this process?
The anonymization model anonymizes faces and license plates in the camera data inside the EU, and Marsstein Compliance documents the assessment and the transfer. Marsstein does not certify that a dataset is anonymous and does not replace legal advice; your counsel or DPO signs off.
Primary sources
Every legal statement on this page rests on one of these documents.
- GDPR Recital 26Anonymous data is outside the GDPR.
- GDPR Chapter V, Articles 44-49Rules for transfers of personal data to third countries.
- Article 29 Working Party, Opinion 05/2014Singling out, linkability and inference as the tests for anonymization.
- EDPB Guidelines 01/2020 on connected vehiclesLocal processing; anonymization before data is transmitted outside the vehicle.
- CJEU C-413/23 P, EDPS v SRB (4 September 2025)Pseudonymized data from the recipient's perspective.
- European Commission, adequacy decisionsCountries with an EU adequacy decision; China is not among them.
- Irish DPC, TikTok decision (2 May 2025)EUR 485 million for Article 46(1) GDPR transfers to China.
- CAC, Several Provisions on Automotive Data Security (2021)Exterior video with faces and plates listed as important data.
- CAC, Provisions on Promoting and Regulating Cross-Border Data Flows (2024)Articles 3 and 4: exemptions for data export.
Also from Marsstein
Model training
We train our own models for anonymization and ISA validation.
Learn moreData center
Runs in the Marsstein EU cloud: your footage lands in an EU bucket and is masked inside the EU.
Learn moreOn-premise
Marsstein on your own servers: in your own cloud account or on your own GPU servers.
Learn moreCompliance
AI agents find your GDPR gaps and draft the documentation for your approval. ISO 27001 and the EU AI Act in preparation.
Learn more