Is it illegal to make online videos of someone without their consent? The law on covert filming
Imagine a stranger starts chatting with you on a train platform or in a shop. The exchange feels ordinary. Later, it appears online, edited as “dating advice” and framed to invite sexualised commentary. Your face, and an interaction you didn’t know was being recorded, is pushed into feeds where strangers can identify, contact and harass you.
This is a reality for many people, though the most shocking examples are mainly affecting women. A BBC investigation recently found that men based outside of the UK have been profiting from covertly filming women on nights out in London and Manchester and posting the videos on social media.
In the UK, filming someone in public – even covertly – is not automatically unlawful. Sometimes, it is socially valuable (think of people recording violence or police misconduct).
But once a person is identifiable and the clip is uploaded for views or profit, it can become unlawful under data protection law and, in more intrusive cases, privacy or harassment law. The problem here is what the filming is for, how it is done and what the platforms do with it.
UK law is cautious about a general claim to “privacy in public”. There is a key distinction in case law between being seen in a public place and being recorded for redistribution.
Courts have accepted that privacy can apply even in public, depending on circumstances. In the case of Campbell v MGN (2004), the House of Lords ruled that the Daily Mirror had breached model Naomi Campbell’s privacy by publishing photos that, while taken in public, exposed her private medical information.
The rise of smartphones and now wearable cameras has made covert capture cheaper, more discreet and more accessible. With smart glasses, recording can look like eye contact.
Capture is frictionless: the file is ready to upload before the person filmed even knows it exists. And manufacturer safeguards such as recording lights are already reportedly being bypassed by users.
Once it’s been uploaded, modern social media platforms allow this content to become easily scalable, searchable and profitable.
Context is what shifts the stakes. Covert filming, an intrusive focus on the body and publication at scale can turn an everyday moment into exposure that invites harassment.
Privacy in public
Public life has always involved being seen. The harm is being made findable and targetable, at scale. This is why the most practical legal tool is data protection. Under the UK General Data Protection Regulation (GDPR), when people are identifiable in a video, recording and uploading it is considered processing of personal data.
The uploader and platform must therefore comply with GDPR rules, which in this case would (usually) mean not posting identifiable footage of a stranger in the first place or, removing the details that identify them and taking the clip down quickly if the person objects.
UK GDPR does not apply to purely personal or household activity, with no professional or commercial connection. This is a narrow exemption – “pickup artist” channels and monetised social media posts are unlikely to fall within it.
Harassment law may apply where the filming and posting is followed by repeated contact, threats or encouraging others to target the person filmed, which causes them alarm or distress.
Lagging enforcement
Harm spreads faster than the law can respond. A clip can be uploaded, shared and monetised within seconds. Enforcement of privacy and data protection law is split between the Information Commissioner’s Office, Ofcom, police and courts.
Victims are left to rely on platform reporting tools, and duplicates often continue to spread even after posts are taken down. Arguably, prevention would be more effective than after-the-fact removal.
The temptation is to call for a new offence of “filming in public”. In my view, this risks being either too broad (chilling legitimate recording) or too narrow (missing the combination of factors – covert filming, identifiability, platform amplification and monetisation that make this a problem).
A better approach would be twofold. First, treating wearable recording devices as higher-risk consumer tech, and requiring safeguards that work in practice. For example: conspicuous, genuinely tamper-resistant recording indicators; privacy-by-default settings; and audit logs so misuse is traceable. The law could build in clear public-interest exemptions (journalism, documenting wrongdoing) so rules do not become a backdoor ban on recording.
There are precedents for regulating consumer tech in this way. For example, the UK has strict security requirements for connectable devices like smart TVs to prevent cyberattacks.
Second, platforms need a clear requirement to reduce the harm caused by covert filming. In practice, that means spotting and obscuring identifiers such as phone numbers and workplace details, warning users when a stranger is identifiable, fast-tracking complaints from the person filmed, blocking re-uploads, and removing monetisation from this content.
The Online Safety Act provides a framework for addressing this problem, but it is not a neat checklist for prevention. Where it clearly applies is when the content itself, or the response it triggers, amounts to illegal harassment or stalking. Those are priority offences in the act, so platforms are expected to assess and mitigate those risks.
The awkward truth is that some covert, degrading clips may be harmful without being obviously illegal at the point of upload, until threats, doxxing or stalking follow.
Privacy in public will not be protected by slogans or a tiny recording light. It will be protected when existing legal principles are applied robustly. And when enforcement is designed for the speed, incentives and business models that shape what people see and share online.
Subhajit Basu does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.