When redacting your ID won't work
The checks that legally need the whole document — and the far longer list that doesn't.
Short answer
- Four situations need the full document: AML/KYC, guest registration, statutory right-to-work checks, and government procedures.
- In all four, a black bar is a failed check, not a protection — you will be asked again, and you have lost nothing but time.
- Everything else is the redaction case: marketplaces, private landlords, hosts, clients, platform support, group chats.
- The test is one question: is a law telling them to capture the document, or is this someone asking because it is convenient?
Most advice about redacting ID documents is written as if it always helps. It does not, and knowing exactly where the line falls is more useful than any redaction technique.
The four cases where it does not work
1. Banks and anything else under anti-money-laundering rules. Opening or keeping an account, a payment institution, a crypto exchange, an insurer, a notary. The obligation to capture the complete document sits on the institution; Germany writes it out explicitly in § 8 of the Geldwäschegesetz. See you cannot redact your ID for a bank.
2. Guest registration at a hotel. In Spain, Italy, Portugal, Greece and much of Europe the property must file your document number and date of birth with the authorities. Those are precisely the fields the usual advice tells you to cover. See hotel wants a passport copy.
3. Statutory right-to-work and payroll checks. A UK manual right-to-work check requires a copy showing exactly what the employer saw, including the date of birth, expiry and signature. A Spanish employer needs your DNI or NIE number to register you with Social Security. See new employer wants your ID.
4. Government procedures. Visas, residence permits, tax registration, licensing. The authority is the issuer of the identity system; there is nothing to hide from it.
In all four, a black bar is not a privacy setting. It is a missing field, the check is rejected, and you send the full document a week later anyway.
The much longer list where it does work
Everything with no regulator behind it — which is most of what actually lands in your inbox:
- A marketplace buyer who wants “verification” before paying.
- A private landlord or letting agent doing informal referencing.
- A short-term rental host messaging you outside the platform.
- A client or agency onboarding a freelancer.
- A platform’s support desk recovering an account.
- A gym, club, coworking space, storage unit or delivery point.
- Anyone at all in a WhatsApp, Telegram or Discord conversation.
In every one of these the person asking has no legal claim to your document number, no obligation to capture it, and usually no retention policy for it either. Covering the number, the machine-readable zone, your date of birth and your signature costs them nothing they were entitled to.
The one question that sorts any request
Is a law telling them to capture this document — or is this someone asking because it is convenient?
| Law obliges the recipient | Someone is just asking | |
|---|---|---|
| Examples | Bank KYC, hotel register, right-to-work | Marketplace, host, client, landlord, support desk |
| Redact? | No — the check fails | Yes |
| Watermark? | No — can read as tampering | Yes, name the recipient and date |
| What protects you | Using the official channel you started | Covering the fields and limiting reuse |
| How common? | A handful of times in your life | Several times a year |
And when the answer is “no law, but they insist”
That is not a redaction problem, it is a negotiation. Ask what they need to verify, offer the redacted copy, and note that a refusal to accept one from a party with no obligation is itself informative — see can a company legally keep a copy of your ID for the GDPR footing, and is it safe to send your ID over WhatsApp or email? for the channel.
When you are on the right side of the line, Anonymize my ID covers the fields and adds the watermark in about a minute, entirely on your phone.
Frequently asked questions
How do I know whether redaction will work for a request?
Ask who is obliged. If a law obliges the recipient to capture the complete document — anti-money-laundering rules, guest registration, statutory employment checks — the answer is no. If they are asking because it is convenient, reassuring or habitual, which covers the large majority of requests, the answer is yes.
Why does a black bar break a regulated check?
Because the check is a data capture, not a glance. The system reads the fields and often matches the photograph to a live image of your face, and the obligation is usually written as retaining a complete copy of what was seen. A covered field is a missing field, so the capture is rejected.
Does a watermark cause the same problem?
It can. A watermark laid across the data page can obstruct the field reads, and some capture systems score an overlay as a tampering signal. In a regulated flow, send the document through the official app as it is; save watermarking for the copies that leave your control.
If redaction fails in those cases, what protects me there?
The channel. Regulated checks run inside the institution's own app or portal in a session you started. The overwhelming majority of ID theft from these requests comes not from the real check but from a convincing imitation of it arriving by email, SMS or phone.
Isn't it safer to redact everything, just in case?
No, and this is worth saying plainly: sending a redacted document into a regulated check does not fail safe, it fails slowly. You get asked again, sometimes with the account frozen in between, and you end up sending the full document anyway — from a more pressured position.