I have a web site that lets users upload a profile picture that is then visible to other users of the site.
What steps should the site take to protect user privacy?
For example, some Jpeg files may have a geotag in the metadata. It seems to be standard practice to strip this. But, what else should be stripped?