GDPR for Real Estate Photography
What property photographers and agencies must blur on listing photos under GDPR — with practical examples, regulator decisions, and the fastest way to stay compliant.
The short answer
Under GDPR, any identifiable person, license plate, or uniquely identifying detail in a publicly distributed listing photo is personal data. Unless you have a documented lawful basis (which you usually don't for bystanders), you must blur it before publication. The same rules apply to video walkthroughs.
What must be redacted
- Faces of bystanders, neighbors, and anyone visible in adjacent windows
- License plates of vehicles in the driveway or on the public street
- Screens, documents, and mail visible inside the property
- Family photos, certificates, and personal items on walls
- Anything capable of identifying a specific non-owner resident
What is usually safe
- Exteriors without people present (check windows carefully)
- Empty rooms after the owner has removed personal items
- Generic street views where no individual is identifiable
Who is liable
The agency is typically the data controller; the photographer is the processor. Both can be fined. A written Data Processing Agreement (AVV in Germany, DPA elsewhere) should clarify responsibilities. In practice, blur before delivery — it's faster than arguing about liability after a complaint.
Real regulator decisions
German data protection authorities (LfDI Baden-Württemberg, BayLDA) have issued multiple administrative fines against real estate agencies for publishing listings with identifiable neighbors in windows or bystanders on the street. French CNIL and Spanish AEPD have issued parallel decisions. Fines have ranged from warnings to €20,000 per case, with repeat offenders seeing higher penalties.
The practical workflow
- Shoot normally — don't worry about bystanders in-frame.
- Upload the full listing to an AI redaction tool.
- Apply a saved prompt template: "blur all faces, plates, and neighbor windows."
- Preview, fix any missed regions manually, export at full resolution.
- Deliver the redacted set to the agency or publish directly.
Total added time per listing: under 2 minutes with AI, versus 8–20 minutes with Photoshop. Documentation of the redaction step is also useful evidence of compliance if a complaint is ever filed.
Frequently asked questions
Is a face in a listing photo really personal data under GDPR?
Yes. Any photo in which a person is identifiable — by face, tattoo, distinctive clothing, or context — is personal data under GDPR Article 4(1). Publication on a listing portal constitutes processing and requires a lawful basis under Article 6. For incidental bystanders, consent is impractical, so the working solution is redaction.
Who is liable — the photographer or the agency?
Both can be. The photographer is typically a data processor; the agency is usually the data controller. Liability depends on contract (Data Processing Agreement / Auftragsverarbeitungsvertrag). In practice, regulators have fined both parties. The safe default: blur before delivery to the agency.
What about license plates?
License plates are personal data in the EU (they can be linked to a registered keeper). GDPR applies the same way as faces. Blur any plate visible in publicly distributed photos, including cars parked on the street in front of the property.
Are there real fines for this?
Yes. Multiple €2k–€20k administrative fines have been issued across Germany, France, Spain, and Italy since 2022 against agencies publishing listing photos with identifiable bystanders or neighbor windows. The maximum theoretical fine under GDPR is €20M or 4% of global annual turnover.
Does this apply outside the EU?
UK GDPR (post-Brexit) has effectively the same rules. CCPA (California) is narrower but still covers biometric identifiers. Switzerland, Norway, and most EEA countries align with GDPR. If you publish to any EU-facing portal (ImmoScout24, Rightmove EU, SeLoger, Idealista), you are in scope regardless of where the photographer is based.
How do I redact efficiently at scale?
Manual Photoshop blurring takes 8–20 minutes per listing. AI redaction tools like Guardiavision reduce that to under 2 minutes per listing by detecting faces, plates, and custom objects automatically. For high-volume agencies, this is the only realistic compliance path.
Stay compliant without the Photoshop hours
Redact your next listing in under 2 minutes. 5 free credits, no card.
Start FreeGuardiavision is hosted in the EU. DPA available on request. This page is informational and not legal advice — consult your DPO for specific compliance questions.
