Short answer: strip private image metadata at ingest, keep a validated photographer attribution record separately, and document the privacy tradeoffs in an auditable policy.
A metadata audit should make one decision explicit: remove fields that can identify a person or location before media enters search and moderation, while copying attribution into a controlled record when the license requires it. In an edtech library, that means stripping EXIF GPS and device details at ingest, preserving creator and license data in a separate table, and emitting an audit event for every transformation.
The least complex policy is a deny-by-default metadata allowlist. Keep the original object quarantined only when legal or editorial review needs it; serve derivatives to learners and search workers.
The page fired after the index changed
The alert an on-call engineer sees is usually a moderation coverage alert: the percentage of library images with a usable creator label drops below threshold after a deploy. Search still works, so the symptom looks harmless. The missing labels surface later in rights review, when replaying ingest would create duplicate rows.
Work backward from that page. Earlier signals should include metadata_stripped_total, attribution_preserved_total, and metadata_parse_errors_total, tagged with a policy version. Compare accepted source objects with audit records. A mismatch means incomplete work even when decoding succeeds.
This is a moderation-coverage problem. A creator field can help resolve a takedown; a GPS coordinate can expose a child’s home. The policy must state which outcome wins for each field class.
Write it down.
Should I strip image metadata while keeping photographer attribution?
EXIF fields have different consequences: GPS, serial numbers, software names, timestamps, and thumbnails are not interchangeable. IPTC and XMP carry creator, credit, copyright, and usage terms, but may also contain captions or contact details. PNG and JPEG use different conventions, and conversion can discard fields without making loss visible. The tradeoff is deliberate: a strip-all rule maximizes privacy but can erase the photographer credit a moderation reviewer needs.
Use a versioned allowlist for creator, credit, copyright, and license_url after validating syntax and length. Normalize them into a separate attribution record. Keep hashes of source and transformed bytes so an auditor can prove which object was reviewed.
package main
import "log"
type Audit struct { ObjectID, Policy string; Removed []string; Attribution bool }
func applyPolicy(id, policy string, fields map[string]string) Audit {
removed := []string{}
for _, key := range []string{"gps", "camera_serial", "software", "timestamp"} {
if _, ok := fields[key]; ok { delete(fields, key); removed = append(removed, key) }
}
_, attribution := fields["creator"]
return Audit{id, policy, removed, attribution}
}
func main() { log.Printf("%+v", applyPolicy("asset-1842", "media-metadata-v3", map[string]string{"gps":"redacted", "creator":"A. Chen"})) }
Idempotency matters. Running the worker twice should produce the same derivative and one attribution record keyed by source hash and policy version. Deduplicate event writes before acknowledging the queue message.
What does a useful threshold look like?
Set alerts against the review workflow. If 98% of accepted assets must retain valid attribution when supplied, alert on a rolling ingest window and page only after two failing windows. The percentage is governance; the measurement is engineering. Track false positives separately so a parser regression does not consume the response needed for a privacy failure.
Fixtures should include JPEG and PNG, empty fields, oversized values, malformed UTF-8, and watermarked images with no textual attribution. Property tests can assert forbidden keys never reach derivatives; contract tests verify retry stability.
Expose derivative URLs to search and classroom clients. Keep source objects and audit details behind a rights-team role with access logs. On deletion, remove derivative and attribution record, then publish a tombstone downstream. Reconcile object storage, audit events, and indexes periodically.
Remove sensitive metadata at the boundary, preserve attribution as governed data, and alert on the gap between those actions.
This boundary is unsuitable for archives that must reproduce the untouched camera file; those teams should retain a restricted original and apply the allowlist only to public derivatives.
