0

I have a web site that lets users upload a profile picture that is then visible to other users of the site.

What steps should the site take to protect user privacy?

For example, some Jpeg files may have a geotag in the metadata. It seems to be standard practice to strip this. But, what else should be stripped?

2

To answer this question, it is necessary to know what information is stored in the photo. Different cameras and phones collect various metadata fields. These fields are collectively known as "EXIF" data.

There are quite a few tools that are capable of reading and parsing EXIF data. An incomplete list is available here: http://www.forensicswiki.org/wiki/Document_Metadata_Extraction

In general, any personally identifiable information is a good idea to strip from the photo.

Once you have a list of fields you want to strip, you can select an EXIF editor from the following list and remove the desired fields: http://en.wikipedia.org/wiki/Comparison_of_metadata_editors

  • 1
    Thanks... do you know if it's ok to strip all EXIF, or will that result in problems? Also, what about image formats other than Jpeg? – paj28 Oct 25 '14 at 16:50
  • Stripping all EXIF data will not result in the image being corrupted, it just will not carry any metadata information. Other image formats will also contain EXIF information, and you should be able to strip the data just like a .jpeg picture. – Maumee River Oct 27 '14 at 11:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.