Does removing metadata delete your AI training opt-out?

The audience for this page is different from the usual one. Most privacy advice here is for someone sharing a photo of their life and wanting to share less. This is for someone publishing their own work and wanting to assert more: a photographer, an illustrator, a small studio, anyone whose images go onto a public page where crawlers will find them. For that person, the question is not how do I empty the header. It is which parts of the header am I removing and which parts am I throwing away by accident.

Two signals that share one container

It helps to separate them explicitly, because the word "metadata" flattens the distinction.

Exposure metadata describes you. Coordinates, timestamps, a body serial number, the name of the phone, the editing software, sometimes a person's name in a face tag. This is the material the rest of the site exists to remove. Its value to you after publication is usually zero and its risk is not.

Rights metadata describes your terms. A creator identifier, a copyright notice, a licence URL — and, more recently, a structured statement about automated use. This material is only useful if it stays attached. It is the one part of the block whose whole purpose is to be read by someone else later. The cost of deleting it is covered in general terms on what you lose when you strip photo metadata, which walks through chronology, colour fidelity and your credit line. The data mining declaration is a newer and sharper case, because unlike a credit line it is not merely nice to have — it is the entire mechanism by which an opt-out is expressed at the file level.

Both live in the same physical place. In a JPEG, both the GPS block and the XMP packet are application segments near the front of the file. A tool that empties the header does not consult your intentions.

What a do-not-mine declaration actually is

Two routes exist, they are independent of one another, and they fail in different ways.

A single XMP property. The IPTC Photo Metadata Standard carries a property called Data Mining at section 11.11, defined simply as "Data mining prohibition or permission, optionally with constraints." Its implementation note records it as "a PLUS version 2.0.1 property included in the IPTC Extension schema," with the requirement that "the value must be one of the URIs listed in the Controlled Vocabulary section of the PLUS specification." Its history note says it was added by IPTC version 2023.1 — which is why you will not find it in older guidance. In XMP it appears as plus:DataMining, with a cardinality of 0..1, meaning one value per asset.

The PLUS specification publishes the permitted values, and reading the list is the fastest way to understand what the field can and cannot say:

• Unspecified — no prohibition defined. This is the documented default, which means an image with no declaration is not making a quiet objection.
• Allowed.
• Prohibited for AI/ML training.
• Prohibited for Generative AI/ML training — a narrower value than the one above, for someone who objects to generative use specifically.
• Prohibited except for search engine indexing.
• Prohibited.
• Prohibited, see Other Constraints property — pointing at a human-readable note.
• Prohibited, see Embedded Encoded Rights Expression property and Prohibited, see Linked Encoded Rights Expression property — pointing at a structured expression. IPTC's note is explicit about which of these is which: "The PLUS Other Constraints property is human readable. The IPTC properties Embedded Encoded Rights Expression and Linked Encoded Rights Expression are machine readable."

The carve-out value is worth quoting in full, because it is routinely misread as a general permission for large technology companies. IPTC states that the prohibition "Prohibited except for search engine indexing" "only permits data mining by search engines available to the public to identify the URL for an asset and its associated data (for the purpose of assisting the public in navigating to the URL for the asset), and prohibits all other uses, such as AI/ML training."

An assertion inside a provenance manifest. The second route is not a tag at all. It lives in a signed C2PA manifest, the structure described on what C2PA Content Credentials are and whether removing metadata strips them too. The declaration itself is specified by the Creator Assertions Working Group, whose training and data mining specification states that the assertion "SHALL have a label of cawg.training-mining" and expresses its content "through a map of one or more training-mining-entries," where "each entry describes whether its use is allowed, notAllowed, or constrained."

There are four predefined entries, and the granularity is the interesting part:

• cawg.data_mining — whether text or data content may be extracted from the asset to determine "patterns, trends, and correlations." The specification notes this "would include images containing text, where the text could be extracted via OCR."
• cawg.ai_inference — whether the asset may be used as input to an already-trained model to infer a result.
• cawg.ai_generative_training — whether it may be training data for a model that could generate assets.
• cawg.ai_training — whether it may train non-generative models, "such as those used for classification, object detection, etc."

The specification explains why the last two are separate: "generative AI training enables new assets to be created from training assets, while other types, such as object detection, do not." It also sets a default reading for the middle value that catches people out: "In the absence of additional information, constrained shall be treated as equivalent to notAllowed." If you mark something constrained, the optional constraint_info string is where the nuance has to go, or a consumer is entitled to treat you as having said no.

One piece of recent history matters if you set this up a while ago. The change log of the C2PA technical specification version 2.1 lists, among its removals, "Removed the 'Training & Data Mining' assertion" — the declaration moved out of the core specification. CAWG's own document explains the consequence: the earlier version of the assertion "used labels with the prefix c2pa. for the assertion itself and for the pre-defined training-mining-map entries," and "this specification is not a product of the C2PA itself, so it can not use the c2pa. prefix." A file written by older software may therefore carry the old labels, and a checker expecting one naming scheme may report nothing while the other is present.

Why a browser rebuild takes all of it

Being precise about this tool matters more here than usual, because the whole point of the page is that a good strip can destroy something you wanted.

Read the script and the mechanism is plain. It accepts JPEG and PNG only, one file at a time. It decodes your image into a bitmap, creates a canvas at that bitmap's own width and height, draws the pixels onto it, and asks the browser to encode a new JPEG at quality 0.92 or a new PNG. Every byte of the output was produced by your browser's encoder from a pixel buffer. Nothing from the original container is copied forward.

That is a strong guarantee in the usual direction: there is no code path by which an XMP packet survives, which is why the tool is reliable for exposure. It is also the reason it cannot be selective. An XMP packet is not parsed, examined or filtered — it simply is not present in a file assembled from pixels. A plus:DataMining property and a cawg.training-mining assertion are destroyed by the same indifference that destroys the GPS block. There is no preference to tick.

The built-in check will not warn you either, and its exact shape explains why. For a JPEG it scans roughly the first quarter-megabyte for an application segment beginning with the characters Exif, and separately tests that same opening stretch for the letters GPS. For a PNG it walks the chunk list looking for eXIf and for text and profile chunks. Its entire vocabulary is "possible EXIF metadata," "possible GPS/location metadata," "PNG metadata chunks" and "no obvious metadata detected." None of those names a rights declaration. A declaration in a PNG might at best register as a generic text chunk; in a JPEG it would usually not register at all. So the reassuring empty panel on your cleaned copy is silent about whether your opt-out is still there, and the answer is that it is not.

A workflow that keeps both

1. Decide which copy you are making before you touch anything. The private copy you send to a friend and the public copy you publish have opposite requirements. Trying to satisfy both with one file is the actual mistake underneath most of this confusion. Make two.
2. Keep personal fields out at capture rather than deleting them later. A field that was never written needs no removal and no later rebuild, which means the declaration you add at the end is the only thing that had to be written at all.
3. Use a rebuild for the private copy. Decoding to pixels and re-encoding is the simplest reliable way to be sure nothing from the original header rode along. That is what the tool on this page does, and for a photo you are sending rather than publishing it is the right answer.
4. Use a field-editing utility for the public copy. If you need the file to keep a declaration, you need a tool that edits the container instead of rebuilding it — a command-line utility that can clear specific groups and then write specific properties. The PLUS properties are documented as their own tag family in ExifTool's tag listings, which is what makes plus:DataMining both writable and checkable.
5. Write the declaration last. Whatever touches the file last decides what the file contains. A resize, a format conversion or an export can discard or rewrite the packet you just set, so put the strip and the resize first and the declaration at the end.
6. Verify by reading the file, not by trusting the report. Ask a reader to print the PLUS group and the manifest, and confirm the value is the URI you intended rather than a blank or a default.
7. Put the same position somewhere outside the image. This is the step that survives re-encoding, because it is not in the image at all. The W3C Text and Data Mining Reservation Protocol defines a tdm-reservation value with an optional tdm-policy, and specifies "a JSON file named tdmrep.json, which MUST be hosted in the /.well-known repository of a Web server," alongside expressions in HTML content and in EPUB files. Notably it defines no embedded-in-the-image form — which is precisely why stripping an image cannot erase it.
8. Archive the untouched original offline. If a declaration turns out to have been dropped three steps ago, the original is the only place the evidence of your intent still exists.

Common mistakes and misconceptions

"Stripping metadata protects my work from being trained on." This has it backwards. Training consumes pixels; the header is not what a model learns from. Stripping removes the record of who made the image and, if you had set one, the statement that you object. An emptied file is a more anonymous file, not a more protected one.

"I never gave permission, so no declaration is needed." Legally that may be your position, but as a signal it is not a position at all. PLUS documents the default value as "Unspecified — no prohibition defined," and IPTC states that "the absence of a prohibition does not indicate that the asset owner grants permission for data mining or any other use of an asset." Both halves matter: silence is not consent, and silence is also not a machine-readable objection anyone can act on.

"Content Credentials include a do-not-train flag, so adding them covers it." Not automatically. The declaration was removed from the core C2PA technical specification at version 2.1 and is now defined as a separate CAWG assertion that happens to ride in a C2PA manifest. Whether any particular application writes it, and under which label, is a property of that application rather than of Content Credentials as such — so check the output instead of assuming.

"Digital Source Type is my opt-out." Different field, different job. Digital Source Type describes how an asset came to exist; the Data Mining property describes what you permit. Setting one says nothing about the other.

"'Constrained' is the safe middle setting." It is stricter than it sounds. CAWG states that in the absence of additional information, constrained "shall be treated as equivalent to notAllowed," and a consumer that wishes to use the asset "may wish to contact the actor which is the rights holder, author, or signer." If you want a conditional answer rather than a refusal, you have to supply the condition.

"A declaration in the file is enough on its own." It is the most fragile place to put it. Platforms re-encode images, exporters rewrite packets, and this tool deletes them outright. That is the argument for the web-level signal as well as the embedded one, not instead of it.

"The field makes it enforceable." No file can prevent a program from reading it, and the standard says as much — IPTC's note warns that regional laws "may prohibit, constrain, or allow data mining for certain purposes (such as search indexing or research), and may overrule the value selected for this property." What the field gives you is clarity and a record, in a form an automated consumer can parse. What happens next is a question about law and about the operator, and this page is not in a position to tell you how either will behave in your jurisdiction.

Where this site's tool fits, and where it does not

Honestly stated: this tool is built for the exposure half of the problem and has no feature for the rights half. It takes JPEG and PNG, one at a time, and returns a browser-generated copy with nothing carried over. If your goal is to hand someone a photo that says as little about you as possible, that is exactly what you want. If your goal is to publish an image carrying a structured statement about automated use, run the strip here if you like — then add the declaration afterwards with a utility that writes fields, and verify the result by reading the finished file.

Related guides

See also:

• What is C2PA Content Credentials, and does removing metadata strip it too?
• What you lose when you strip photo metadata