Enforcing Hijab Through Others: How Data and Technology Help the Islamic Republic Pressure Women

The Islamic Republic does not always need to identify a woman’s face to punish her for refusing compulsory hijab. A vehicle’s licence plate can be enough to send its owner a warning or set impoundment proceedings in motion. Businesses that serve women without compulsory hijab risk closure or restrictions on their services. A woman’s refusal to comply can therefore carry consequences for the people around her.

Evidence gathered by the UN’s independent fact-finding mission on Iran and Amnesty International, alongside records of police applications and surveillance suppliers, reveals how this works. Authorities connect reports to administrative records, then threaten assets, livelihoods and access to services. Those threats give relatives, employers and service providers a reason to restrict women’s choices themselves.

A Licence Plate Can Provide a Target for Enforcement

The UN fact-finding mission documented how vetted users of the Nazer reporting application can submit a vehicle’s licence plate, location, date and time. A report flags the vehicle in the system and generates a text message to its registered owner. Amnesty International also documented the use of Nazer to report vehicles carrying women who refuse compulsory hijab.

Identifying the vehicle’s owner does not establish the identity of the woman inside it. It does, however, give authorities someone they can reach and penalise. The link between a licence plate and a registration record allows enforcement to proceed without necessarily identifying the woman herself.

The same connection appears in the “Police Man” application. In March 2024, a senior traffic-police official announced that vehicle owners could check hijab-related complaints associated with their licence plates. Access required verification through the owner’s account and a SIM card registered in their name.

The report becomes attached to the vehicle’s record and its owner’s identity. Authorities do not have to identify everyone in an image if they can act against the person whose name appears on the registration.

Telephone Access Becomes a Means of Coercion

Control over communications services creates another route for pressure. In an investigation for the technology publication Zoomit, journalist Negin Bagheri described how Instagram businesses whose telephone lines had been blocked were required to remove posts and sign undertakings concerning dress and advertising before service could be restored.

In October 2026, Bagheri announced that her own SIM card had been disconnected, linking the action to her reporting. The International Federation of Journalists reported the restrictions against her.

In these cases, restoring an essential service becomes conditional on compliance. Businesses must accept restrictions to regain access, while the journalist documenting the practice reports facing a similar penalty herself.

Research on Iran’s surveillance architecture examines how identity databases, telecommunications networks and monitoring systems support digital repression. It identifies the National Information Network as a central component of a system that links activity to individuals and makes access to services a means of control. Establishing which agency or system carried out a particular disconnection still requires evidence specific to that case.

Families and Employees Face the Consequences

The pressure extends beyond the woman being reported. Amnesty International reviewed threatening messages sent to women and their male relatives. Its published testimonies include a woman whose boyfriend received a warning and another whose husband was stopped and their vehicle impounded.

One woman described being denied banking services because staff said they would face reprimands for serving women without compulsory hijab. She also recalled airport employees warning that issuing her a boarding pass could expose them to disciplinary action. Amnesty International published these accounts in its collection of testimonies.

The UN fact-finding mission also documented continued business closures for failure to enforce compulsory hijab. Together, these accounts show how authorities shift the burden of enforcement onto others. A vehicle owner risks losing access to a car. A business owner risks losing income. An employee risks disciplinary action. Those threats can encourage relatives, drivers and workers to restrict women’s choices. Compulsory hijab enforcement becomes embedded in family relationships, workplaces and everyday services.

European Equipment in Iran’s Surveillance Network

Camera-based reporting depends on equipment: cameras that capture images, servers that manage video and systems that deliver warnings. Investigations into that infrastructure show that European companies supplied part of it.

The 2022 breach of Tehran’s municipal surveillance network exposed footage and information associated with more than 5,100 cameras and their monitoring centres. The material included Bosch and Axis cameras, along with repeated instances of Milestone video-management software. Bosch and Milestone interfaces were also visible on monitoring-centre screens. Surveillance industry publication IPVM examined this evidence.

A 2023 investigation by German broadcaster ARD reported that Bosch supplied around 8,000 cameras to Iranian distributors between 2016 and 2018. It also identified a Bosch employee’s participation in a 2017 training event in Tehran hosted by the company’s Iranian distribution partner, Karatis.

Bosch has stated that its cameras cannot run facial recognition and that it has had no revenue in Iran since 2019. Milestone confirmed selling software to Iran until 2019. Axis sold cameras through a distributor covering Iran until 2020.

These responses address different parts of the accountability question. A camera does not need to perform facial recognition to produce an image that later supports a report and a penalty. At the same time, the presence of a company’s equipment in a surveillance network does not, by itself, establish current support or knowing participation in a particular act of repression.

The questions that require investigation are concrete: what was sold, to whom, through which intermediaries, and whether maintenance, updates or other support continue.

Chinese Suppliers Also Have a European Presence

Chinese companies supplying Iran’s surveillance infrastructure also operate in Europe. Hikvision cameras and interfaces appeared in the material exposed by the Tehran surveillance breach. The company has its European headquarters in the Netherlands and branches in several European countries.

Tiandy, whose supply of equipment to the Islamic Revolutionary Guard Corps has been documented, lists European partners and projects on its website. In 2023, the European Union sanctioned its Iranian representative, Radi Vira Tejarat. That designation concerned the Iranian representative rather than Tiandy itself.

ARTICLE 19 has examined the activities of ZTE, Huawei, Tiandy and Hikvision in Iran, including their use of intermediaries and front companies. These suppliers’ European operations provide a practical avenue for scrutiny. Examining European vendors, subsidiaries and commercial partners could help establish how equipment is sold, transferred and supported.

Pressure Follows Women Abroad

Coercion through personal relationships also extends beyond Iran. The UN fact-finding mission documented threats against relatives inside the country intended to pressure activists and journalists overseas.

The case of journalist Masih Alinejad illustrates how personal information can support physical targeting abroad. According to the US Department of Justice’s account of trial evidence, the assassination operation used her home address, photographs, videos and surveillance updates exchanged between intermediaries. Two participants received 25-year prison sentences in October 2025.

The case does not establish a connection between the assassination operation and domestic hijab-enforcement databases. It demonstrates the danger posed by information about a woman’s home, movements and relationships when it reaches people planning violence against her.

Accountability Must Follow the Route to a Penalty

Identifying a camera or a software vendor is only one part of investigating this system. The next questions concern how a report enters the system, which agency connects it to identity records, who can access the information and who authorises a warning, impoundment or service restriction.

Supply-chain investigations must also cover resellers, intermediaries, system integrators and maintenance providers. Procurement records and operational documents can help distinguish demonstrated capabilities from marketing claims and establish each actor’s role.

Technology companies should account for their customers, the uses of their products, the risk of onward transfer and evidence of abuse. Human-rights assessments must continue throughout a contract, particularly when equipment remains in a network that turns information about citizens into penalties. Measures targeting suppliers should also preserve civilian access to the internet and secure communications.

Support for those affected needs to account for lost transport, income and services alongside direct threats against women. Abroad, digital protection must be coordinated with physical safety, evidence preservation and accessible ways to report threats.

This system works because authorities can turn information into consequences. A licence plate, an image or an account tied to a SIM card can lead them to someone they have the power to penalise, even when the woman herself remains unidentified. Threatening that person’s property, job or access to services brings state coercion into women’s everyday relationships. Effective accountability must trace the connection between the data collected, the authority to impose penalties and the companies supplying the infrastructure.