NearScrub

2026-09-29

AI training datasets already scraped public photos — researchers found some still carry exact GPS coordinates and names

Most of the risk this blog covers has a shape you can picture: a file goes to one platform, one recipient, one server, and something in it — a GPS tag, a hidden Author field — gets read by someone on the other end. A paper published in 2025 by researchers at the University of Washington, Carnegie Mellon, and Georgetown describes a different shape entirely: photos that were never sent to anyone in particular, just posted publicly somewhere on the web, and picked up years later by an automated crawler building a dataset to train AI models — GPS tag, timestamp, and all.

What the researchers actually audited

The paper, "A Common Pool of Privacy Problems" (Hong, Hutson, Agnew, Huda, Kohno, and Morgenstern), examined DataComp's CommonPool — a public, 12.8-billion-sample pool of images and captions scraped from the open web and built specifically for training vision-language AI models. Auditing all 12.8 billion samples wasn't feasible, so the researchers worked from a 0.1% subset — about 12.8 million samples — and used that to estimate what the full pool likely contains. As MIT Technology Review reported on July 18, 2025, that subset alone turned up thousands of identity documents — passports, credit cards, driver's licenses, birth certificates — and over 800 validated job-application documents tied to real people, some disclosing disability status or background-check results.

The part that didn't need cracking: EXIF tags were just sitting there

Identity documents and resumes are what got the headlines, but the paper's own metadata section covers a narrower, more mechanical finding: what was already embedded in the image files themselves, no OCR or face recognition required. The researchers write that they found "non-empty Exif tags relating to timestamps, geolocation, and individuals, which upon inspection many... disclose full names." Looking specifically at images whose EXIF happened to include a GPSInfo tag, they found that 28.6% of those tags pointed to precise geolocation — not a rounded city-level estimate, an exact coordinate — and that 6.1% of that group also carried a full name elsewhere in the same file's metadata. None of that required defeating any protection. The dataset's pipeline pulled in whatever the source image already had attached, and for a meaningful share of photos, that included exactly the fields a camera or phone writes by default.

A public photo, months or years before a crawler ever touches it Photo posted publicly — no platform, no recipient, just a public URL on the open web A dataset crawler fetches the file later — no notice, no request, nothing to opt out of Metadata was still attached GPS tag, timestamp, and any name field ride along into the dataset with the pixels. Metadata was removed first The image content is still fetchable, but there's no GPS tag or name field left to take.
Whether metadata was attached at the moment a photo went public is the one variable the person who posted it actually controlled — everything after that point, including whether and when a crawler shows up, wasn't.

Why this isn't a breach you can ask anyone to undo

Every other incident on this blog has a company or a platform on the other end — one you can, at least in principle, send a deletion request to, or that regulators can fine. A training dataset built by crawling the open web doesn't work that way. The paper's co-author William Agnew put the underlying dynamic plainly to MIT Technology Review: "Anything you put online can [be] and probably has been scraped." There's no single party who "has" your photo the way a platform does — the image may already sit inside dozens of dataset snapshots and, downstream, inside model weights nobody can cleanly extract a single photo's contribution back out of. The researchers' own recommendation, aimed at the machine-learning field rather than at individual users, was to reconsider indiscriminate scraping and examine where it violates existing privacy law — not a claim that any existing photo can be pulled back out once it's in.

What scrubbing metadata before you post actually changes here — and what it can't

NearScrub has nothing to offer a photo that's already public with its metadata intact; there's no retroactive fix once a file has been posted, let alone crawled. What clearing EXIF/GPS/timestamp data in the browser before you post something changes is narrower and entirely forward-looking: if the copy that eventually sits at a public URL never had a GPS tag or a name field attached in the first place, there's nothing in that specific channel for a future crawl to collect, whether that crawl happens next week or in five years. It does nothing about the other channel the paper's broader findings are actually about — a visible face, a readable name on a badge or resume in frame, a street sign in the background — because none of that is metadata, and no metadata tool reaches it. The paper's finding isn't that scrubbing tools are inadequate; it's that a meaningful share of the public web's photos were never scrubbed before someone else's crawler arrived.