What should you check in image metadata before publishing a product asset?

Separate public content from internal records

Decide what the public file should communicate: the product, approved artwork and any necessary attribution. Keep account details, internal project names and private reference notes in a separate restricted record. Do not place private source information into an image merely to make it easier for the team to trace.

For an illustrative campaign, an editor may export from a file named after an internal customer project. Inspect both the visible content and file properties before release. A clean crop does not prove the export contains no private information.

Use a release checklist

Do not erase rights information indiscriminately. Determine what attribution or usage notice must remain and keep an authorized record of any metadata changes.

For generative-AI images submitted to Google Merchant Center, the image-link rules require AI-origin metadata and say not to remove embedded DigitalSourceType tags. Keep that destination requirement distinct from removing an unrelated private location or internal project field. A clean image is not permission to erase provenance that should remain.

Inspect the final file, not an earlier source

Download the approved CartVisual result and finish any editing externally. Use a suitable file inspector for the actual delivered export. This inspection covers the exact file you deliver. Do not treat a generated result, an editor preset or a clean preview as a completed metadata audit.

Shopify’s product-media documentation cautions against uploading confidential material to public storefront files. That applies to the destination decision: use a restricted support channel for private evidence rather than attaching it to a product listing.

Recheck after another export

If an editor resizes, converts or re-saves the image, inspect the new file again. The previous review covered a different artifact. Keep an identifier for the approved export so the publishing team can distinguish it from the working master.

Use private evidence guidance and public-media handoff. The release record should state which exported file was inspected without exposing the private metadata you removed.

Fictional export E1 contains a private project label and a location field, plus approved attribution and an applicable AI-source tag. The team makes a public derivative E2 with an authorized tool. This is a teaching record; no private file or actual coordinates were inspected.

Retain the restricted original and a record of which public derivative was approved. Inspect visible pixels too: metadata removal does not remove a private screen shown in the image. If privacy needs and required provenance cannot be reconciled, hold publication and obtain an appropriate public source rather than stripping everything blindly.