EU and GDPR: webcams and livestreams

Europe has thousands of public webcams on beaches, ski slopes, harbors and town squares. They are lawful because their operators follow a few clear principles from the General Data Protection Regulation (GDPR) and the European Data Protection Board’s Guidelines 3/2019 on processing of personal data through video devices. This page explains those principles in plain language for anyone who runs, or wants to run, a public webcam in the EU, the EEA (Norway, Iceland, Liechtenstein) or, with very similar rules, the UK.

Does the GDPR apply to my webcam?

Is a webcam image “personal data”?

Under the GDPR, personal data is any information relating to a person who can be identified, directly or indirectly. A face, a distinctive jacket seen every morning at the same spot, a car with a readable number plate or a voice can all identify someone. The EDPB gives two helpful examples: recordings taken from a high altitude only fall under the GDPR if the data can be related to a specific person, and a car camera that does not collect any information relating to a person (such as plates or passers-by) is outside it.

So the first design choice is the most powerful one: a camera that shows the sea, the slope or the sky, where people are tiny and unrecognizable, may not process personal data at all. A camera at a café terrace almost certainly does.

The household exemption and the Ryneš case

The GDPR does not apply to “purely personal or household” activities (Article 2(2)(c)). That exemption is narrow. In Lindqvist (C-101/01, 2003) the Court of Justice said that publishing personal data on the internet so that it is accessible to an indefinite number of people is not a private activity. In Ryneš (C-212/13, 11 December 2014) a man installed a camera on his house after repeated attacks; it filmed his entrance, the public footpath and the entrance of the house opposite. The Court held that a camera system which covers, even partially, a public space and is directed outwards from the private setting is not a purely household activity.

The EDPB applies this to video: a person who films their own fenced garden, used only by family, may be inside the exemption, provided the camera does not extend even partially to a public space or neighboring property. A public webcam is the opposite case: it is meant to be seen by everyone.

Your legal basis: legitimate interest (with a balancing test)

Every processing needs a legal basis under Article 6. For a webcam filming passers-by, consent is not practical: you cannot ask everyone on a beach. Private operators (hotels, ski areas, tourism boards that are companies) usually rely on legitimate interest (Article 6(1)(f)): showing the weather, snow or sea conditions and promoting a destination are real interests. Public authorities generally cannot use legitimate interest for their public tasks and rely on a task in the public interest set out in law (Article 6(1)(e)).

Legitimate interest only works if your interest is not overridden by the rights of the people filmed. The EDPB says the balancing is mandatory and must be done case by case, looking at how much the monitoring affects people and what they can reasonably expect in that place. Write your balancing test down (Article 5(2), accountability). Wide framing, no audio, no zoom and no recording all tip the balance in your favor. The EDPB also notes that publishing footage online is a separate purpose that needs its own legal basis: a security camera’s recordings cannot simply be put online “for amusement”.

Signs: the “first layer” and the “second layer”

People must be told about the camera before they enter the area it films (Articles 12 and 13). The EDPB recommends a layered approach:

An important detail from the guidelines: if the sign does not mention recording or transmission to others, people are entitled to assume that the camera only shows live pictures. For a public webcam, the sign must therefore say clearly that the picture is streamed on the internet.

Data minimization: frame, resolution, zoom and audio

Article 5(1)(c) says process only what you need, and Article 25 requires data protection by design and by default. The EDPB applies this directly to cameras: choose privacy-friendly technology such as masking areas that are not relevant, and do not use functions that are not necessary, such as unlimited camera movement, zoom, radio transmission, analysis and audio recording; functions that are provided but not needed must be switched off. For a public webcam, that means:

• Frame the landscape, not the entrance or terrace.
• Mask windows, balconies, private doors and anything outside your purpose.
• Stream at a resolution that shows the conditions but not faces (see privacy by design).
• Lock PTZ cameras to fixed wide presets; no remote zoom for viewers.
• Switch the microphone off.

Storage and retention

A pure live stream that you do not record keeps the processing small, though remember that the streaming platform may keep an archive (YouTube, for example, keeps streams shorter than 12 hours as videos unless you change that). If you record, the EDPB’s guidance for video surveillance is that data should in most cases be erased, ideally automatically, after a few days, and the longer you keep it (especially beyond 72 hours) the more you must justify it. For timelapses and “best of” clips, pick moments with no identifiable people or blur them.

A DPIA for large-scale public cameras

Article 35(3)(c) requires a data protection impact assessment (DPIA) for “systematic monitoring of a publicly accessible area on a large scale”. A single wide beach webcam may not reach that level, but a network of cameras across a town, or cameras on busy squares, likely does. National authorities publish lists of processing that always needs a DPIA; check yours.

People’s rights, takedowns and streaming

People filmed have the right to information, access, erasure and to object (Articles 15 to 21). For a live stream, the right to object is the practical one: if someone complains, re-aim, mask, pause or blur. If footage was made public (for example by streaming online), the EDPB says the controller must take reasonable steps to inform other controllers that process it, such as sites that embed the stream, about an erasure request (Article 17(2)). LiveLocation does its part: when a camera owner or someone filmed reports a privacy problem, we hide the camera at once and pass the report to the owner.

GDPR duties at a glance

National extras: image rights and local rules

The GDPR is the same everywhere in the EU, but member states add to it. France, Germany and Spain have strong rights over one’s own image (France: Civil Code article 9; Germany: Art Copyright Act, sections 22 and 23, which allow publishing people who appear only as incidental figures next to a landscape or as part of gatherings; Spain: Organic Law 1/1982). Some countries have specific rules for cameras in publicly accessible spaces, and many data-protection authorities publish their own video guides. A wide landscape view stays the safest choice in all of them. For the global picture, see livestreaming public places.

The UK after Brexit

The UK keeps the GDPR’s rules as the UK GDPR and the Data Protection Act 2018, and the Information Commissioner’s Office (ICO) is the regulator. The ICO says that if a home camera captures images beyond the owner’s boundary, such as a neighbor’s property, a public street or a communal space, data-protection law applies, and owners should be able to explain why, tell people, delete footage regularly and respond to requests. The ICO notes its guidance is under review following the Data (Use and Access) Act, so check for updates.

Do these next

1. Frame, mask and mute your camera.
2. Write your notice: a first-layer sign and a full privacy page.
3. Submit your camera to LiveLocation, or see our rules.

Last reviewed October 7, 2026 by the LiveLocation team. General information, not legal or electrical advice.