Metadata Cleaning, Redaction, or Regeneration? A Privacy Comparison

You're about to send a sensitive document out. You heard the advice "clean the metadata" and you did it. But is that enough? The answer depends entirely on what's stored in the document, and most of the time it isn't enough on its own. This article compares three different cleanup methods for PDF privacy and clarifies which one solves what.

Where information can hide in a PDF

Before the comparison, let's map the territory. Information in a PDF can live in six different places:

1. Visibly in the page content — the text you read, the images you see.
2. Hidden in the page content — text with a box drawn over it, area outside the crop box.
3. In the metadata — author, title, dates, producing application.
4. In form fields — the values that were filled in.
5. In embedded files — attached Excel sheets, source files.
6. In version history — earlier states accumulated through incremental updates.

Each cleanup method targets different rows of that list. To make the right decision you first need to know which rows are populated in your document.

What each method covers

| Information location | Metadata cleaning | Redaction | Flattening | Rewriting | Print+scan | |---|---|---|---|---|---| | Visible page text | No | Yes | No | No | No | | Hidden page text | No | Yes | No | No | Yes | | Metadata | Yes | No | No | Partly | Yes | | Form field data | No | No | Yes | No | Yes | | Embedded files | No | No | No | Sometimes | Yes | | Version history | No | No | No | Yes | Yes |

Two conclusions come out of the table: no single method covers everything, and printing and scanning covers everything but is the most expensive method.

Scenario 1: Publishing a technical manual

There's no sensitive information on the pages, just technical content. It'll be published on a website.

What's needed: metadata editing (not deletion).

The privacy risk in this scenario is low. What you need to do isn't clean the metadata but fill it in correctly: a real title in the title field, the organization's name in the author field. That way it looks right in the browser tab and in search results.

One thing to watch: if your personal name or username is in the author field, replace it with the organization's name. That prevents sharing personal information and keeps things consistent.

Scenario 2: Sending a contract to a third party

The contract has the parties' names (which are needed), but some additional clauses and pricing information have to come out.

What's needed: redaction plus metadata cleaning.

Redaction comes first because it's the real work: actually deleting the parts that have to come out. Putting a black box over them isn't enough — the text under that box stays in the file and surfaces through text selection, copying, or text extraction tools. That's a mistake that has led to real corporate disclosures.

Metadata cleaning comes second: information about which template the document came from, who prepared it and when it was changed may not serve you well in a negotiation.

Scenario 3: A filled-in application form

You entered your personal information into a form and you're sending it to an institution.

What's needed: flattening plus metadata cleaning.

The goal here isn't to hide information — the form data is supposed to go. The goal is for the information to be delivered accurately and unchangeably.

Flattening turns field values into page content. That way it looks the same in every viewer and on every printer, and the recipient can't change it.

Metadata cleaning prevents unnecessary information from going along: which computer you filled it in on and which program you used aren't things the institution needs to know.

Scenario 4: Sharing part of an internal report

You're going to give out 5 pages of a 100-page confidential report.

What's needed: page extraction plus redaction plus metadata cleaning plus rewriting.

This is the scenario that demands the most care, because several risks apply at once:

Page extraction is the first step — separate out only the pages you're giving. But be careful: extraction carries the document metadata into the new file, and the original report's title may be sitting there.

Redaction clears the details that must stay confidential on the remaining 5 pages.

Rewriting (compression or a similar operation that fully regenerates the file) clears version history. If the original report was prepared through incremental updates, earlier draft states may remain on the extracted pages.

Metadata cleaning goes last, because the earlier operations can regenerate metadata.

Scenario 5: Sending anonymous feedback

Your identity must not be discoverable in any way.

What's needed: regeneration plus metadata cleaning — or a different format.

The safest advice in this scenario: don't use PDF. A plain text file carries no hidden layers. If the format is mandatory, produce the document from scratch with a minimal tool and clean the metadata.

Trying to "anonymize" an existing PDF is risky because you can't fully know what ended up where. Producing a new file is far more controlled.

Metadata cleaning is still needed after regeneration — because the new file picks up your program's and operating system's information. The assumption "I regenerated it, so it's clean" is wrong.

The real cost of print-and-scan

This method looks tempting because it solves everything. Let's spell out its cost:

File size. A 500 KB document becomes 10-30 MB once scanned. It hits email limits and archive costs go up.

Loss of text. The document is now an image. It can't be searched, copied or processed automatically. The recipient has to retype the information by hand.

Quality. Scan noise, skew, color shift. The document looks amateurish.

Accessibility. Someone using a screen reader can't read the document at all. In corporate and public documents that's a serious problem.

New metadata. The scanner software adds its own metadata — device model, scan date, username. So the metadata problem doesn't disappear entirely, it just changes.

Time. The physical work takes minutes.

The conclusion: print-and-scan delivers the protection that redaction and metadata cleaning provide at a much higher cost. It only makes sense if you have no access to the other tools or if the document is already moving through paper anyway.

The right order

If you're doing several operations, the order matters:

1. Page selection. Extract only the pages you need. Fewer pages, less risk.

2. Redaction. Remove sensitive information from page content. This is the most critical step.

3. Flattening. If there's form data, lock it down.

4. Rewriting / compression. Clears version history and leftover objects.

5. Metadata cleaning. Last. Because the earlier steps can regenerate metadata.

6. Verification. Open the result and check it: try selecting text (nothing should be selectable in redacted areas), look at the document properties, open the file in a text editor and search for sensitive words.

Don't skip that last step. There are plenty of corporate disclosure incidents where someone believed they had cleaned a document and never verified it.

Decision summary

• If there's no sensitive information on the pages → metadata editing is enough.
• If there's information on the pages to hide → redaction is essential, metadata cleaning on top.
• If you filled in a form → flattening plus metadata.
• If you're sharing part of a confidential document → extraction plus redaction plus rewriting plus metadata.
• If anonymity is critical → plain text instead of PDF, or regeneration from scratch.
• If you have no access to the other tools → print-and-scan does the job, but know what it costs.

And in every case: verify after cleaning. Try selecting text, check the properties, search the file.