0

I have a web site that lets users upload a profile picture that is then visible to other users of the site.

What steps should the site take to protect user privacy?

For example, some Jpeg files may have a geotag in the metadata. It seems to be standard practice to strip this. But, what else should be stripped?

Improve this question

1 Answer 1

Reset to default
2

To answer this question, it is necessary to know what information is stored in the photo. Different cameras and phones collect various metadata fields. These fields are collectively known as "EXIF" data.

There are quite a few tools that are capable of reading and parsing EXIF data. An incomplete list is available here: http://www.forensicswiki.org/wiki/Document_Metadata_Extraction

In general, any personally identifiable information is a good idea to strip from the photo.

Once you have a list of fields you want to strip, you can select an EXIF editor from the following list and remove the desired fields: http://en.wikipedia.org/wiki/Comparison_of_metadata_editors

Improve this answer
2
  • 1
    Thanks... do you know if it's ok to strip all EXIF, or will that result in problems? Also, what about image formats other than Jpeg?
    – paj28
    Oct 25, 2014 at 16:50
  • Stripping all EXIF data will not result in the image being corrupted, it just will not carry any metadata information. Other image formats will also contain EXIF information, and you should be able to strip the data just like a .jpeg picture.
    – Maumee River
    Oct 27, 2014 at 11:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .