How to Redact Faces and Remove Photo Metadata: A Worked Example

To prepare a photograph for sharing, cover the identifying areas, remove metadata you do not want to disclose, and inspect the exported file. A face detector can help locate faces, but it does not decide whether a person is still recognizable from the rest of the photograph.

Below is an actual export from Medianonymizer's image worker, recorded on 26 September 2026. We used an AI-generated portrait so the downloadable example contains no customer photograph. We also added fictional camera details, a capture date, GPS coordinates of 0° N, 0° E, and an embedded thumbnail to test their removal.

We make Medianonymizer. This example documents our own local worker, with its limitations; it does not compare competing products.

1. Inspect the original image

Start with a copy. Look for faces, reflections, badges, addresses, plates and readable screens. Decide which details matter for the people who will receive the image. A uniform or a distinctive tattoo may identify someone even after their face has been covered.

Here is the input we processed. It is an 800 × 800 pixel synthetic portrait with deliberately fictional EXIF metadata.

Download the actual input JPEG. The metadata belongs to the test fixture; it is not a record of where or when a photograph was taken.

2. Detect faces and check the coverage

For this run, we enabled face detection and chose an opaque black box. OCR and plate detection were off. The worker used the YuNet face detector; OpenCV documents its output as face coordinates, landmarks and a score. A detection score is not proof that the image is anonymous.

The worker returned one face region, expanded to include a margin: x = 133, y = 7, width = 513, height = 720 pixels. It then encoded the result as a JPEG. The image below is that export, without retouching or a manually drawn replacement box.

Download the actual output JPEG. Open it at full size and compare it with the input. The box covers the face in this case, while the shoulders and background remain visible.

When using your own image, inspect every intended face, including profiles, small faces and reflections. Correct a missed region before sharing. Medianonymizer's image worker does not currently provide automatic license-plate detection; do not assume a photo's plate is covered because faces were selected. Use a suitable manual editor for any unsupported region and inspect its saved result.

3. Check metadata separately

Metadata removal is a separate check from visual redaction. In this run, the worker decoded the image into pixels and encoded a new JPEG. We requested metadata stripping and did not supply a selection that preserves EXIF categories.

We read both JPEGs with piexif after processing:

This check covered the EXIF data we deliberately added. It did not test every possible metadata format, including XMP or IPTC. For a real file, inspect the exported file with a metadata viewer that supports its format. Confirm which categories you chose to remove; a workflow that preserves selected metadata needs different checks.

What we measured across six images

We ran the same settings on six existing AI-generated portraits, all 800 × 800 pixels. Each run used the real local worker in a fresh process, with the model already downloaded. Each returned one YuNet face box, and all six exported files had no remaining EXIF tags or embedded thumbnail in our check. We also checked that the interior of each reported rectangle contained near-black pixels, allowing for JPEG compression.

The machine was an Apple M5 Pro running macOS 27.0, Python 3.12.13 and OpenCV 5.0.0.93. The first process took 4.665 seconds overall; the other five took 0.241–0.247 seconds. The first run had a much larger initialization cost. These single-run measurements include local process startup and exclude upload, queueing, payment and download. They are not a speed promise for the website.

Download the measurements and file checksums to check the input and output files against this run.

The portraits were already selected as detectable fixtures. Six successful outputs therefore do not establish a detection-accuracy rate for real photos. We did not test crowded scenes, profiles, occlusion, OCR, plates, video, audio or the hosted application's full workflow in this demonstration. The source portraits were generated with AI; the redacted outputs came from the worker's actual processing, without generative editing.

4. Review the file you will share

Open the downloaded file in a separate viewer. Inspect the face boundaries, remaining identifiers and metadata. Confirm you are attaching the edited copy rather than the original or a preview. Keep the source only where your retention policy allows it.

An opaque box replaces pixels inside its rectangle, but someone may still recognize the subject from clothing or context. This example establishes a specific processing result, not a legal conclusion or a guarantee of anonymity.

To try the hosted workflow, start with a photo, review the available selections and the price shown for your export, then inspect the downloaded result using the checks above.