The Problem Nobody Mentions
You need to compress an image. You google "image compressor", pick one of the top results, drag your file in, and download the result. Fast, free, done.
What you probably didn't notice: the moment you dragged that file in, it was uploaded over the internet to a server you know nothing about. It sat on that server while it was processed. It may still be sitting there now.
For most casual use — compressing a holiday photo or a meme — this genuinely doesn't matter. But for a growing number of people, it matters enormously: designers working on unreleased products, healthcare professionals handling patient records, businesses processing client photos, developers optimising screenshots of internal systems. For all of these, a standard online image compressor is a real risk.
What Actually Happens When You Upload an Image
The typical server-based compression workflow goes like this:
- Your image is transmitted over the internet to the service's servers — often in the US or an unspecified location
- The server processes the image, creating at least one temporary copy on its storage systems
- You download the compressed version
- The service claims to delete your original file — usually "within a few hours"
The phrase "within a few hours" is doing a lot of work. You have no visibility into whether that deletion actually happens, whether the file has entered a CDN cache and been replicated to multiple servers, or whether metadata about the request — filenames, IP address, access timestamps — has been logged. Most services' privacy policies are vague on all of this.
Many image compression services use content delivery networks to serve compressed files quickly. When your image enters a CDN, it can be replicated to dozens of edge servers worldwide. Even if the primary server deletes the file on schedule, cached copies may persist independently across infrastructure you've never heard of.
The GDPR Dimension
Under GDPR, an image constitutes personal data whenever an individual can be identified from it. This includes:
- Photographs of people's faces
- Images containing EXIF metadata with GPS coordinates (most smartphone photos)
- Photos of ID documents, medical records, or other personally identifiable information
- Images linking to an identifiable person through context (a photo of someone's home, car, or workplace)
If you upload any of these to an online compressor, you are engaged in data processing under GDPR. You become the data controller. The compression service becomes your data processor. That relationship carries specific legal obligations:
- You must have a lawful basis for the processing (Article 6)
- You must ensure the processor provides adequate protection (Article 28) — typically through a Data Processing Agreement
- If the server is outside the EU/EEA, cross-border transfer rules apply (Articles 44–49)
Most casual online image compressors have no Data Processing Agreement to offer. Many are hosted on US servers with no EU adequacy decision or Standard Contractual Clauses in place. Using them with personal data is a textbook GDPR violation — one that could result in fines of up to 4% of global annual turnover for businesses.
Beyond GDPR: NDAs, IP, and Corporate Policy
Legal risk doesn't stop at GDPR. Consider:
Non-Disclosure Agreements
If you're under an NDA covering client work, unreleased product designs, or confidential business assets, uploading those images to a third-party server may constitute a breach — regardless of whether GDPR applies. The NDA doesn't care about privacy law; it cares about disclosure.
Intellectual Property
Unreleased product photography, brand assets, or creative work uploaded before a public launch constitutes disclosure to a third party. Some services' terms of service include clauses allowing use of uploaded content for service improvement — which may mean your images are used to train compression algorithms.
Corporate IT Policy
Many organisations explicitly prohibit uploading company data to unapproved third-party services. Using a personal free tool to compress a work image could breach your employer's acceptable use policy, with potential disciplinary consequences.
Healthcare and HIPAA
Medical images, patient photographs, or any imagery that could identify a patient falls under HIPAA in the US (and equivalent frameworks elsewhere). Uploading these to a random online tool is a reportable breach — not a technicality.
How to Tell if a Tool Uploads Your Files
The simplest test: open your browser's developer tools (F12 in Chrome), go to the Network tab, then use the compressor. If you see outgoing requests to an external server when you load or drop your image, the tool is uploading your file. A genuinely client-side tool will show no such network activity — the compression happens entirely in memory on your device.
The other tell is the tool's own claims. Look for specific language like "processed locally in your browser" or "never leaves your device" rather than vague reassurances like "your files are secure." The former is a technical claim; the latter is marketing.
A browser-based image compressor uses your device's own CPU and memory to process the image. The JavaScript running in your browser tab performs the compression using HTML5 Canvas or WebAssembly — the same APIs your browser uses to render graphics. The file never leaves your device because there's literally nothing to upload to: the processing happens where you are.
The Safe Alternative
Browser-based compression tools process your images entirely locally. Private Image Compressor is built on this model — your images are compressed using your browser's native Canvas API, nothing is transmitted to any server, and the result is saved directly to your device.
This means:
- No GDPR data processing relationship is created
- No risk of NDA breach through third-party disclosure
- No corporate IT policy concern
- Works completely offline once the page has loaded
- Compression is faster than server-based tools because there's no upload/download latency
Frequently Asked Questions
Are online image compressors GDPR compliant?
Most popular server-based tools are not suitable for processing personal data under GDPR — they lack Data Processing Agreements and are often hosted outside the EU. Browser-based tools that process images locally don't create a data processing relationship at all, making them the GDPR-safe choice.
Do online image compressors keep your files?
Most claim to delete files within a few hours, but you cannot verify this. Files may enter CDN caches across multiple servers and persist longer than stated. Only a browser-based tool — where your file never leaves your device — provides a genuine guarantee.
What images are "personal data" under GDPR?
Any image from which a living individual can be identified: photographs of faces, images with EXIF GPS data, photos of ID documents, and contextual images linking to a specific person. If in doubt, treat the image as personal data.
Is TinyPNG safe to use for confidential images?
TinyPNG uploads images to its servers for processing. It's a well-run service, but for confidential, NDA-covered, or personal data-containing images, it's not appropriate. Use a client-side tool for those cases.