Recently conversations on Twitter and various blogs and news sites have reported on Facebook’s use of IPTC embedded photo metadata fields to “track users”. (Reddit.com: “Facebook is embedding tracking data inside the photos you download”, The Australian: “Facebook pics tracking you”, Forbes: “Facebook Embeds ‘Hidden Codes’ To Track Who Sees And Shares Your Photos”, Financial Express: “Beware! Facebook embeds tracking data inside photos you download”).

As the creators and maintainers of the IPTC Photo Metadata Standard, we want to clarify a few points and share our own analysis of the situation.

In Spring 2019, IPTC’s Photo Metadata Working Group conducted our latest round of tests regarding how various social media platforms deal with metadata embedded in uploaded and shared images. The 2019 test results show how Facebook treats image metadata: in IIM and EXIF formats, a few fields are retained related to claiming rights while all others are removed, and in the XMP format all fields are removed.

While this was a small improvement compared to the previous IPTC test in 2016 when all Exif fields were removed, we did not rate Facebook with a “green dot” showing compliance with IPTC standards, as removing metadata embedded by the owner of an image contradicts IPTC’s strong support for keeping metadata persistent.

In addition, in both the 2016 and 2019 tests the Working Group found that two fields in the IIM format do indeed appear to be given values populated by Facebook.

IPTC looks at the facts

IPTC provides a reference image for each version of its Photo Metadata Standard which contains a test value for every specified metadata field. This makes it easy to test which fields are removed or modified.

The reference image of the 2017.1 version of the standard was uploaded to Facebook by the Working Group member David Riecks and it can still be seen here. Next the group used the IPTC’s  Get IPTC Photo Metadata website tool for retrieving embedded metadata of most of the images shown on the web. Anyone can use this tool: simply fill the URL of the image into the site’s form and click to see all the metadata embedded in the image.

This test was performed using the URL of the IPTC reference image uploaded to Facebook and the result was shown instantly:

• Embedded metadata fields in the IIM format related to rights were retained: Creator, Creator Job Title, Copyright Notice, Credit Line, Source and Description Writer.
• All embedded metadata using the XMP format were removed by Facebook.
• The Creator and the Copyright Notice in the Exif format were also retained.
• The Instructions field and the Job Id field in IIM show values significantly different from what had been uploaded. The IPTC Working Group assumes these values were inserted by Facebook:
  • The value of the Instructions field starts with FBMD. The IPTC Working Group retrieved this image using “Save As…” and another Facebook user uploaded it to his account. Result: the value was not changed during the second upload to Facebook. These results were shown for the re-uploaded image.
  • The value of the Job Id fields looks like a unique identifier. If an uploaded image is downloaded using the Save As function and then uploaded by another Facebook user this field contains a different value.
  • The IPTC Working Group searched for any documentation of these inserted values but found no specification or statement from Facebook. There have been, however, many guesses and assumptions by users and developers.

Using the Get IPTC Photo Metadata site anybody can check what Facebook values were applied to her or his photo. As a user, you can find Facebook image URLs by clicking on the image on the Facebook site and using the “Copy image address” or the “Inspect” or “Inspect Element” function of your web browser, you should then see the URL.

IPTC’s summary

IPTC tests showed when a Facebook member uploads an image to the Facebook system it removes a lot of fields, keeps only a few related to rights and replaces or adds values to the Job Id and the Instructions fields. The role of these values is not publicly documented by Facebook, so they are currently the subject of significant speculation.

IPTC makes no assumptions about what the metadata values are used for, but Facebook appears to keep the value of the Instructions field constant even when the image is re-uploaded by another user. The Job ID field on the other hand changes with each separate upload.

Our recommendations are that all embedded metadata values should be retained by platforms and that no platform should be overwriting user metadata.

IPTC’s 2019 Social Media Platforms survey also looked at the metadata usage of other major social media platforms. Interested parties can find more information at Social Media Sites Photo Metadata Test Results 2019.

 

Technical notes

The example metadata values embedded into the 2017.1 reference image can be checked by going to https://getpmd.iptc.org and clicking on the green button in Option A labeled Get Photo Metadata of Web Image. No image URL is required, as by default the metadata of this reference image is retrieved and displayed.

For those interested in the technical details of embedded photo metadata, the technical formats IIM and XMP are introduced in the IPTC Photo Metadata User Guide, including a look under the hood of image files.