Design Street View Blurring

The ask

A mapping service photographs streets from cars that drive past homes and people.

Faces and licence plates must be hidden before any photo is published.

Privacy blurring is that hiding, done by a model that finds and covers each face and plate.

A person can also ask for a whole house or a whole car to be covered.

Estimate the scale

10,000,000,000 street images are already stored.

10,000,000 new images arrive a day.

10,000,000 ÷ 86,400 = 116 new images per second, rounded to the nearest whole number.

Reprocessing the stored set runs at 10,000 images per second.

10,000,000,000 ÷ 10,000 = 1,000,000 seconds for the whole set.

1,000,000 ÷ 86,400 = 11.6 days, rounded to one decimal place.

Data and features

Object detection finds objects in an image and marks where each one sits. Its face and plate boxes drive the covering.

Labels mark every face and plate in training photos, even small or partly hidden ones.

A feature is one measured fact from the photo, such as an edge or a shape. The patterns of letters and numbers on a plate are features too.

Training photos cover many countries, plate designs, lights and weather kinds.

Faces on posters and screens are labelled too, so the model learns the awkward cases.

People check samples of covered photos by hand to find what training missed.

High-level design

New photos land in blob storage, still unpublished.

A queue hands each photo to a worker.

The worker runs detection, covers each box, and writes the covered photo to public storage.

Covering grows each box slightly, so hair, ears and plate edges stay hidden.

A photo with too many doubtful boxes waits for a person to check it.

Only the covered photo gets a public link, and the original stays in locked storage.

Training the model

The detection model trains on labelled street photos from many places.

A missed face costs far more than a covered sign, so missed faces drive the training score.

New plate designs and new camera kinds add fresh training photos each round.

Each new model is tested on a held-back set rich in small and hidden faces.

A model ships only when its miss rate beats the current model's rate, on faces and plates alike.

Serving predictions

Serving is a background pipeline, because no viewer waits on a single photo.

A new photo can wait a short while before it appears in public.

Workers process new photos as they arrive, and the queue absorbs busy hours.

Extra workers join during reprocessing runs, when the archive flows through too.

A failed worker hands its photo back to the queue, so no photo skips covering.

Requests from people, such as covering a house, join the same queue with a higher priority.

Deep dive: reprocessing the archive

A better model is wasted if old photos keep their old covering.

A law change can also force a fresh pass over every stored photo.

At 10,000 images per second, the full archive takes 1,000,000 seconds. That is about 11.6 days of steady running.

The pass runs in slices, with the newest and busiest streets first.

10,000 × 86,400 = 864,000,000 images a day at the full reprocessing rate. Daily arrivals use only a small part of that rate.

Version records show which photos still carry old covering, so the pass can resume after a failure.

Evaluation and trade-offs

The key measure is the miss rate on faces and plates in checked samples.

People review random samples plus every photo the model found doubtful.

Over-covering is the safer error, since a covered sign harms nobody.

Too much covering still hurts, because street photos must stay useful for directions.

Speed trades against care, and the archive pass shows the cost in days.

The design chooses care over speed. A missed face, once public, cannot be pulled back from every copy.

Street view at a glance