Page MenuHomePhabricator

Explore possibilities for users to remove/exclude geo data from EXIF on images
Open, Needs TriagePublicFeature

Description

User story: As an uploader of images, I want to remove geolcation data from my images, so that I can hide sensitive information like my home address or protected wildlife areas.

We have this:

There's currently no way for users to handle the geolocation data themselves. For existing images already on Commons, the removal of such data has to be done manually by an admin.

We want this:
Users should be able to control the removal of geolocation data from their images by themselves.

Acceptance Criteria:

  • For files that a user has contributed themselves, there should be a file page functionality/button that initiates the deletion of geolocation data from WMF databases (not the image itself)
  • On UploadWizard and Special:Upload, there should be a clear option for users to strip all location data out of files about to uploaded so they are never on Commons with that data in the first place
  • 3rd party upload tools should have the ability to indicate to WMF systems that files being uploaded from the tool in a specific session should have their geolocation data removed before being stored on WMF servers

Event Timeline

Q:

For files that a user has contributed themselves, there should be a file page functionality/button that initiates the deletion of geolocation data from WMF databases (not the image itself)

When you click the button, will it just delete the stuff right away? I'm pretty sure if you just do that (without... like... admin approval) some Commons people will bark at this.

Still to be determined. The button could kick off an admin review/deletion process. But we may have to explore whether the changing international legal landscape and trends toward user control of personal data will make more direct options necessary.

Q:

For files that a user has contributed themselves, there should be a file page functionality/button that initiates the deletion of geolocation data from WMF databases (not the image itself)

When you click the button, will it just delete the stuff right away? I'm pretty sure if you just do that (without... like... admin approval) some Commons people will bark at this.

So this task is both about the preventive and corrective workflows outlined in T218057?

We should probably split off a specific ticket for "Mechanism to remove geo data from EXIF of pre-existing images" as that workflow will be slightly different than removing it during upload (and possibly contentious).

The original author of this ticket is no longer at the Foundation, but we're looking into scoping this. It seems the original acceptance criteria is still relevant.

Just to also be explicit: any retroactive deletion is not in scope, this ticket will focus on uploads going forward.

Change #1298344 had a related patch set uploaded (by Amdrel; author: Amdrel):

[mediawiki/extensions/UploadWizard@master] [WIP] Add support for removing geolocation data from uploads

https://gerrit.wikimedia.org/r/1298344

Change #1298344 abandoned by Amdrel:

[mediawiki/extensions/UploadWizard@master] [WIP] Add support for removing geolocation data from uploads

Reason:

There are some aspects I can rework and simplify. Abandoning so I can keep this as a reference.

https://gerrit.wikimedia.org/r/1298344

We at Wiki Med have built a tool to remove GPS location data from your own images https://commons.wikimedia.org/wiki/Commons:RemoveGPS We would love to work on improvements to the upload Wizard aswell.

@Doc_James thank you for sharing this! I wasn't aware of this tool to remove GPS location data from images until now and had only bookmarked this Phab ticket, so I thought there weren't any ongoing attempts.
Have you managed to get in touch with a potential reviewer at WMF to make changes to the upload wizard? By chance I recently connected with Amanda, who pointed out to me that you and others have started this.

@Amdrel suggested that in core the proper way to do may be to use Shellbox instead to call out to something like exiftool.

@mikez-WMF Here is the review of our code for the upload wizard

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/UploadWizard/+/1239395

@Yaron_Koren might be best to comment on were things are at.

We would like to make our tool for existing Commons images into a Gadget and hopefully can find support for that at Wikimania.

Thanks for the solution proposal! While this should solve the problem, from UX perspective having a button with such long text is not advisable. It could cause several problems in terms of displaying the text in certain languages that are longer than English, showing it on smaller screen and in general being visually heavy and verbose. I propose we keep the current button text and add the option to remove location information through a checkbox. Some proposed designs are attached below. I have taken a pass on simplifying the text so both technical and non-technical users understand it.

Screenshot 2026-07-14 at 17.27.00.png (794×790 px, 99 KB)
Screenshot 2026-07-14 at 17.26.37.png (1,374×696 px, 57 KB)
Screenshot 2026-07-14 at 17.26.47.png (1,364×436 px, 52 KB)
Entry point from edit articleEntry point from Commons upload pageEntry point if user selects Flickr

As always, feedback, edge cases, error cases are welcome.

Thank you @JSengupta-WMF and @Doc_James for the feedback and proposals!
I've pinged the domain experts' manager at the Foundation to chime in, and if others here have feedback on the UX proposal, please feel free to comment here in order for us to iterate as needed.

At this step it would be nice if it at least clearly indicated if the image contains EXIF location data or not... and what that location data is.

image.png (1,308×373 px, 41 KB)

@Doc_James that's a good point - I also thought that while recently uploading a picture in Commons.
Given that home address is the most egregious example, that could be explicitly listed in the string and I wouldn't be against making this warning box more attention-grabbing given the sensitivity. @JSengupta-WMF - could we propose something more in line with other similar compelling type messages that we wouldn't want users to ignore?

(Anecdote: the first time I saw this warning about personal info in my uploaded media, I almost ignored it.)

But one should only list the warning if the warning is actually applicable. The best way to get warnings ignored is to shout them when they do not apply.

So we would need something to check to see if GPS location is present. We would be happy to support building this if needed.

The other issue is this step:

image.png (1,833×2,092 px, 576 KB)

Here we see the long and latitude. If I blank it, it is NOT actually removing anything. Only pretending to remove it. This is the step that fooled me for years.