CAS-003 · Question #422
Developers are working on anew feature to add to a social media platform. Thew new feature involves users uploading pictures of what they are currently doing. The data privacy officer (DPO) is…
The correct answer is C. Removing all metadata in the uploaded photo file. Removing EXIF metadata from uploaded photos eliminates embedded GPS coordinates and other location data, directly preventing physical location tracking of users.
Question
Developers are working on anew feature to add to a social media platform. Thew new feature involves users uploading pictures of what they are currently doing. The data privacy officer (DPO) is concerned about various types of abuse that might occur due to this new feature. The DPO state the new feature cannot be released without addressing the physical safety concerns of the platform's users. Which of the following controls would BEST address the DPO's concerns?
Options
- AIncreasing blocking options available to the uploader
- BAdding a one-hour delay of all uploaded photos
- CRemoving all metadata in the uploaded photo file
- DNot displaying to the public who uploaded the photo
- EForcing TLS for all connections on the platform
How the community answered
(36 responses)- A3% (1)
- B11% (4)
- C78% (28)
- D3% (1)
- E6% (2)
Why each option
Removing EXIF metadata from uploaded photos eliminates embedded GPS coordinates and other location data, directly preventing physical location tracking of users.
Increasing blocking options empowers users to restrict who can see their content but does not prevent GPS metadata from being extracted from photos that are already visible.
A one-hour upload delay slightly reduces real-time location tracking but does not remove GPS metadata, which can still be used to identify the photo location after the delay.
Smartphones embed EXIF metadata in photos that can include precise GPS coordinates, timestamps, and device identifiers. If this metadata is not stripped before the image is stored or displayed, malicious actors can extract location data to determine exactly where and when a photo was taken, enabling physical tracking or stalking of users. Removing all metadata at upload time eliminates this risk entirely and directly addresses the DPO's stated physical safety concern.
Hiding the uploader's identity prevents attribution but does not address the GPS coordinates embedded in the photo file itself, which can still reveal physical location.
TLS encrypts data in transit but does not affect the contents of the photo file, including any embedded location metadata accessible after delivery.
Concept tested: EXIF metadata removal to prevent user physical location disclosure
Source: https://www.nist.gov/privacy-framework/privacy-framework
Topics
Community Discussion
No community discussion yet for this question.