PDF Privacy Best Practices

PDFs are the universal document format for business, legal, medical, and academic work. We email them, upload them to portals, share them via cloud links, and store them in archives. Every PDF carries hidden data — metadata, PII, embedded scripts, editing history — that can de-anonymize, embarrass, or compromise you when shared.

Documented failures: anonymous peer reviewers identified by PDF author metadata, whistleblowers identified by embedded software fingerprints, lawyers whose PDF timestamps contradicted stated execution dates, companies whose PDF metadata revealed internal network structure. These aren't hypothetical — they happen regularly.

The 12 rules below are practical, tested, and ordered roughly by impact. Follow all 12 for sensitive documents; the first 6 cover 80% of real-world leaks.

PDF metadata (Author, Creator, Producer, Title, Subject, Keywords, CreationDate, ModDate) is auto-populated by your editing software and reveals more than you'd expect. The Author field often contains your real name (from your OS account). The Creator field reveals your software toolchain. Timestamps reveal your timezone and work schedule. Original file paths can leak your Windows username or corporate network structure.

Strip metadata before sharing any PDF externally. Use a browser-based tool like PrivacyScanPDF (/?mode=remove-metadata) — it removes all info dictionary fields AND the XMP XML metadata block. Server-based tools (iLovePDF, Adobe Online) upload your file before stripping, defeating the purpose for sensitive documents.

Verification: after stripping, drop the PDF back into the scanner. All metadata fields should show '(empty)' or be absent. You can also open the PDF in a text editor and search for '/Author' or '/Creator' — they should be gone.

Metadata is one leak; the visible text is another. PDFs often contain PII you didn't realize was there: email addresses in CC'd correspondence, phone numbers in signature blocks, Social Security Numbers in tax forms, credit card numbers in receipts, API keys in technical documentation.

Run the PDF Privacy Scanner (privacyscanpdf.com) before sharing. It detects 50+ categories of PII with context-aware validation (credit cards must pass Luhn, SSNs must be in valid format, etc.). The scanner produces a 0-100 risk score and lists every finding with its location.

For PDFs going to external audiences (clients, opposing counsel, public repositories), aim for a risk score under 20. For internal sharing, anything under 50 is usually acceptable. For anonymous sharing (whistleblowing, anonymous job applications), the score should be 0.

Drawing a black rectangle over sensitive text in a PDF does NOT redact it. The text underneath is still in the PDF's content stream and can be copied, searched, or extracted by anyone. Multiple law firms, government agencies, and Fortune 500 companies have been embarrassed when their 'redacted' PDFs were copy-pasted by journalists.

Permanent redaction removes the text from the PDF's content stream entirely AND draws a black rectangle as a visual marker. After permanent redaction, no copy-paste, search, or text-extraction tool can recover the redacted content. Use PrivacyScanPDF's redact tool (/?mode=redact-pdf) or Adobe Acrobat Pro's redaction feature.

Always verify redaction worked: select-all (Ctrl+A), copy, paste into a text editor. The redacted text should not appear. Search the PDF (Ctrl+F) for a distinctive word from the redacted content — it should not be found. Open the PDF in a different reader than the one you used to redact — redaction should hold across all readers.

Every server-based PDF tool (iLovePDF, Smallpdf, Adobe Online, Sejda, PDF24 web) uploads your full PDF to their server before processing. Their Terms of Service promise deletion after a few hours, but you can't audit the deletion. Multiple major PDF services have been caught retaining files for 'service improvement' (training ML models), and several have suffered data breaches exposing uploaded documents.

For sensitive PDFs (anything with PII, financial data, legal content, medical records, trade secrets), use browser-based tools only. Browser-based tools like PrivacyScanPDF run all processing as JavaScript in your browser tab — there's no upload endpoint, no server storage, no breach surface.

Verify: open DevTools (F12 → Network tab) before using any online PDF tool. If you see POST requests with file payloads going to the tool's domain during processing, it's uploading. If you only see static asset requests (CSS, JS, images), it's processing locally. PrivacyScanPDF shows zero upload requests during any operation.

PDFs over 25 MB can't be emailed (Gmail/Outlook limit). The default solution — upload to Google Drive/Dropbox and share a public link — has two problems: the link lives forever in your sent-mail folder, and anyone with the link can download the file forever.

Better: use expiring links with view-only permission. Google Drive: set 'Anyone with the link can view' AND set an expiry date (Google Workspace accounts only). OneDrive: same. Dropbox: use a shared link with an expiry. For maximum control, use a service like Send (send.vis.ee) that auto-deletes the file after download or after a set time.

For highly sensitive PDFs (M&A materials, board reports, unpublished research), avoid cloud links entirely. Use encrypted email (ProtonMail, Tutanota) or end-to-end encrypted file transfer (Keybase, Magic Wormhole). The recipient gets a one-time download link that can't be forwarded.

PDF encryption (RC4 128-bit or AES 256-bit) prevents anyone from opening the PDF without the password. For sensitive documents shared via email or cloud link, password protection adds a layer of defense: even if the file is intercepted or the link is leaked, the content can't be read without the password.

Share the password through a separate channel — call the recipient on the phone, send via Signal, or use a one-time secret service like onetimesecret.com. Never email the password in the same message as the PDF. Never reuse passwords across documents.

Limitation: pdf-lib (the library PrivacyScanPDF uses) doesn't currently support encryption. For now, use Adobe Acrobat Pro, Preview (macOS, File → Export → Encrypt), or qpdf (command line, free). We're working on adding browser-based encryption support.

Rule 7: Sanitize PDFs before uploading to public servers. Court filing systems, grant portals, and FOIA repositories publish PDFs publicly. Any metadata in your filing is visible to anyone who downloads it. Strip everything before upload.

Rule 8: Check for embedded JavaScript. PDFs can contain JavaScript that executes on file open — used for tracking (some document-tracking services embed it) or malware. Run the Privacy Scanner to detect it; remove it with redaction if found.

Rule 9: Be careful with PDFs from untrusted sources. PDFs can carry malware (embedded files, JavaScript, exploits for PDF reader vulnerabilities). Open PDFs from untrusted sources in a sandboxed viewer (most browser-based PDF viewers are sandboxed). Don't open PDFs from unknown email senders.

Rule 10: Strip EXIF from embedded images. PDFs containing photographs (signatures, evidence, location shots) can carry EXIF metadata on those images: GPS coordinates, camera serial numbers, timestamps. Run the scanner to detect; remove embedded images if EXIF is sensitive.

Rule 11: Don't trust 'Save As' to remove metadata. 'Save As' preserves original metadata by default. Some PDF editors let you selectively clear fields via File → Properties, but this is manual and easy to forget. Use a metadata stripper for reliable removal.

Rule 12: Verify with a second tool. After stripping/redacting/sanitizing, verify the result with a different tool than the one you used to modify the PDF. If PrivacyScanPDF stripped the metadata, verify by opening in Adobe Reader (File → Properties) or another PDF metadata viewer. Different tools catch different leaks.