- From: Stephen Chenney via GitHub <noreply@w3.org>
- Date: Thu, 11 Jun 2026 21:36:55 +0000
- To: public-svg-issues@w3.org
The privacy concern is that if you can toggle the orientation of cross-origin content via a property or attribute, like CSS image-orientation, a site could learn at least one EXIF property of the image that typically depends on the device used to capture the image. That's an extra bit of information for fingerprinting the image, which can be combined with other bits to build a profile. I believe this is the original spec discussion: https://github.com/w3c/csswg-drafts/issues/5165 There are a host of proposals to expose or control the image orientation in HTML rather than CSS but little traction on any of them: https://github.com/whatwg/html/issues?q=is%3Aissue%20EXIF%20orientation. The canvas API changes in particular should probably happen. I think applying the orientation in the filter depending on the element it is applied to (option b above) is a bad idea from a web developer perspective. Browsers currently always orient cross-origin filter images (as of this week) to prevent a discrepancy between SVG/filters and `<img>` from revealing the information. So I think the discussion right now is aimed at getting the SVG WG's point of view on the various HTML proposals so that they can be aligned, even if that means "just leave it as is for now". -- GitHub Notification of comment by schenney-chromium Please view or discuss this issue at https://github.com/w3c/svgwg/issues/819#issuecomment-4685326024 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Thursday, 11 June 2026 21:36:56 UTC