The feature we refused to build

The goal

Politikkradar publishes what happens in municipal council meetings: who spoke, what they said, how votes fell. The source material is long meeting videos. Turning video into a usable public record means solving who-said-what: aligning a transcript with the person actually speaking at each moment.

The tempting shortcut

Council members are public figures with published photos. Matching faces in the video against those photos would identify speakers with high confidence and little engineering effort, and most of the surrounding pipeline existed already. It is the kind of feature that ships in a weekend and feels obviously fine, because everything involved is already public.

Why we refused

GDPR Article 9 treats biometric data processed for the purpose of uniquely identifying a person as a special category, prohibited unless a narrow exception applies. Face recognition against a reference gallery is exactly that processing, and none of the exceptions comfortably fit a private company enriching public video for a commercial product. That the people involved are elected officials does not remove the protection: a public role does not make biometric processing proportionate. There is also a plainer objection. A monitoring product that normalizes running face recognition over public officials is building exactly the kind of infrastructure a healthy public sphere should be wary of.

What shipped instead

The compliant pipeline separates two questions that face recognition collapses into one: is a visible person speaking right now, and who is that person. Active-speaker detection answers the first question from face and lip movement without ever matching identity. The second question is answered by the meeting's own written record: the agenda, the protocol, and the speaker order the council itself publishes. Aligning the transcript timeline with that record attributes speech without processing biometrics for identification, and attribution quality is measured against a hand-labeled gold set before any published page is allowed to rely on it.

The cost, honestly

The compliant design was slower to build, has more moving parts, and required its own evaluation work. That is the real shape of privacy by design: sometimes the answer is a different architecture, not a consent banner. The alternative was a feature we would have had to defend to users, to a regulator, and to ourselves.

This note describes one lab's reasoning. It is not legal advice.