Blurring faces in photos: what automatic detection can and cannot do

Automatic face detection is a starting point, not a guarantee. How it works, the faces it reliably misses, and why padding and effect choice matter more than most tools admit.

Published 2 August 2026

Publishing a photograph taken in public usually means publishing strangers. Blurring their faces is the ordinary courtesy, and increasingly the expectation. The tooling makes it look solved: point software at a photo, faces get found, faces get blurred.

It isn’t quite solved. The gap between “the tool found faces” and “nobody in this photograph can be identified” is where the real work sits.

How automatic face detection works

Modern browser-based detectors use a small convolutional neural network, usually BlazeFace, trained to predict bounding boxes for face-shaped regions. It runs in a few tens of milliseconds on an ordinary laptop, which is what makes doing it locally instead of on a server practical at all.

Two properties matter for how you use it.

It detects, it doesn’t recognise. The model returns rectangles and confidence scores. It has no notion of who anyone is, no template to compare against, and no memory between images. Face detection and face recognition are different tasks with very different privacy implications, and a blurring tool only needs the first.

Its confidence threshold is a trade-off. Set it high and you get few false positives while missing real faces. Set it low and you catch more faces plus the occasional door handle. For an anonymisation tool the asymmetry is stark: a false positive costs you one click, while a missed face can be a person exposed. A good default is a low threshold with weak detections flagged for human review instead of quietly discarded.

The faces detectors reliably miss

The pattern is predictable enough to list:

Small background faces. Someone forty metres away occupies a handful of pixels. Testing a full-range model against a crowd photograph, we saw it return three faces from a scene that contained many more.
Sharp angles. Profiles, faces looking down, faces turned away. Detection falls off quickly past roughly 45 degrees.
Partial occlusion. Hair across the face, a raised hand, a mask, a helmet, sunglasses, a scarf.
Poor light and motion blur. Backlit subjects, and anything moving.
Faces in reflections, whether in a mirror, a window or a screen. Perfectly visible to a reader, invisible to a detector looking at the primary subject plane.
Non-face identifiers, which no face detector will ever catch: name badges, licence plates, house numbers, tattoos, a distinctive jacket, a visible screen.

Which is why the review step isn’t decoration. A tool that blurs automatically and gives you no way to add a region is a tool that will eventually publish someone.

Padding: the mistake almost every tool makes

A detector’s bounding box is tight. It brackets the eyes, nose and mouth, the features the model was trained on, and stops there.

Blur exactly that box and you’ve left the forehead, hairline, ears, jaw and usually the chin perfectly sharp. That’s frequently enough for anyone who knows the person to recognise them, and it’s enough for automated matching too, since that uses head shape and hairline alongside the interior features.

The padding also has to be proportional. A fixed twenty pixels is generous around a face in a phone selfie and meaningless around the same face in a 40-megapixel photograph. Padding expressed as a fraction of the detected face’s own dimensions behaves identically at every scale, which is how it ought to be expressed and often isn’t.

A reasonable default lands around 30–40% of the face box on each side.

Blur, pixelate or cover?

These aren’t three flavours of the same thing.

Solid cover replaces the pixels with a constant. The output doesn’t depend on the input, so there’s nothing to recover. It’s the only one of the three that removes information instead of transforming it.

Pixelation replaces blocks with their average colour, and that average is derived from the original pixels, so information survives. Where the space of possibilities is small, as with text, a licence plate or a number, the transformation can be inverted by rendering candidates, pixelating them identically and comparing. Hill and colleagues demonstrated this systematically against redacted documents in 2016.

Blur is a convolution, and deconvolution is a well-studied problem. Noise and clipping make exact inversion hard in practice, but partial recovery is often plenty, and a weak blur is barely more than a suggestion.

For faces the picture is friendlier than for text, because the candidate space is every person alive instead of a few thousand strings, so a strong blur really does degrade identification. Note the word strong, though. A light blur that leaves head shape, skin tone, hair and posture intact, in a photograph whose location and date are known, may narrow things a long way.

Where the consequence of identification is serious, a protest, a clinic, a shelter, a child, use solid cover.

Local processing isn’t a detail

Face blurring gets applied to exactly the photographs people are least willing to hand over: protests, medical settings, children, private events. Uploading those to a stranger’s server to have the faces removed is a strange trade.

Browser-based detection removes the trade completely. The model is a file, the runtime is WebAssembly, and both can be served as ordinary static assets from the same site that serves the page. Nothing about the image needs to leave the device. Not the pixels, not the filename, not the dimensions, not the number of faces found.

Two questions to ask of any tool claiming this. Where does the model come from? If it’s fetched from a third-party CDN at runtime, that CDN learns you’re using a face tool and roughly where you are. Self-hosted assets don’t leak that. And does anything leave when you process? Open the network panel and watch. Silence is the answer you want.

Metadata, while you’re here

Blurring faces and then publishing the original file often defeats the point. A JPEG from a phone typically carries GPS coordinates to within a few metres, a timestamp, the device model, and sometimes an embedded thumbnail which, in older software, could still show the unblurred original.

Re-encoding the image is what gets rid of all that. Any tool that draws the result onto a canvas and encodes fresh output does it as a side effect. A tool that patches the original file may not.

A workable procedure

Detect automatically, and treat what comes back as a first pass.
Zoom in and sweep the whole frame. Backgrounds, reflections, edges.
Add regions for whatever got missed. Expect to add some.
Push the padding up until foreheads and jaws are covered.
Prefer solid cover wherever the stakes are real.
Export a re-encoded file so the metadata goes with it.
Open the exported file and look at it before sharing. Not the preview, the file you’re about to publish.

The tools do the tedious part well. Whether a photograph is safe to publish isn’t a judgement any detector can offer, and a tool that implies otherwise is selling you something.

Sources and further reading

Last reviewed 2 August 2026.