Redact sensitive data from images

You can use the Cloud Data Loss Prevention API to detect sensitive text and objects within an image and then get a redacted version of that image. In the returned image, the detected sensitive data elements are obscured by an opaque rectangle. You use infoType detectors to specify the types of information that you want to detect and redact.

By default, Sensitive Data Protection uses black rectangles to obscure the redacted content, but you can specify a color for each infoType in your image redaction configuration.

Text redaction

Sensitive Data Protection uses object character recognition (OCR) to detect text in images. You can redact the following in an image:

• Text that matches any of the default infoTypes
• Text that matches any of the infoTypes that you list in your image redaction configuration
• All detected text

For example, consider the following images. The original image is a picture of a document that contains contact information. In this example, Sensitive Data Protection was configured to redact any text that matches the PERSON_NAME, EMAIL_ADDRESS, and PHONE_NUMBER infoTypes. The resulting image has black rectangles covering the detected sensitive text.

Object redaction

You can configure Sensitive Data Protection to redact objects that typically contain sensitive information.

For example, consider the following images. The original image is an AI-generated picture that contains a barcode, a license plate, and a whiteboard. In this example, Sensitive Data Protection was configured to redact objects that match the OBJECT_TYPE/BARCODE, OBJECT_TYPE/LICENSE_PLATE, and OBJECT_TYPE/WHITEBOARD infoTypes. The resulting image has colored rectangles covering the detected sensitive objects. One color is assigned to each infoType.

For a complete list of object infoType detectors that are available, see Objects in images.

Limitations and considerations

Consider the following points when redacting content from images.

Supported file types

Sensitive Data Protection can redact sensitive data from many image types, including JPEG, BMP, and PNG. For more information, see Supported file types.

Content redaction is not supported for SVG, PDF, XLSX, PPTX, or DOCX files.

Inspection configuration limits

When you redact data from images, you can't include limits in your inspection configuration. Limits can cause unexpected or potentially inconsistent results where only some data is redacted. If you set the limits field in your request, Sensitive Data Protection generates an error.

Before you begin

Before you begin the tasks on this page, set up authentication and obtain the required IAM permissions. You can use your Google Cloud user account or a service account. In either case, make sure the account you use has a role with the serviceusage.services.use permission, such as DLP Administrator (roles/dlp.admin), DLP User (roles/dlp.user), or a custom role.

1. Select the tab for how you plan to use the samples on this page:

   C#

   To use the .NET samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

   1. Install the Google Cloud CLI.

   2. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

   3. If you're using a local shell, then create local authentication credentials for your user account:

      gcloud auth application-default login

      You don't need to do this if you're using Cloud Shell.

      If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity.

   For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

   Go

   To use the Go samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

   1. Install the Google Cloud CLI.

   2. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

   3. If you're using a local shell, then create local authentication credentials for your user account:

      gcloud auth application-default login

      You don't need to do this if you're using Cloud Shell.

      If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity.

   For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

   Java

   To use the Java samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

   1. Install the Google Cloud CLI.

   2. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

   3. If you're using a local shell, then create local authentication credentials for your user account:

      gcloud auth application-default login

      You don't need to do this if you're using Cloud Shell.

      If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity.

   For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

   Node.js

   To use the Node.js samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

   1. Install the Google Cloud CLI.

   2. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

   3. If you're using a local shell, then create local authentication credentials for your user account:

      gcloud auth application-default login

      You don't need to do this if you're using Cloud Shell.

      If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity.

   For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

   PHP

   To use the PHP samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

   1. Install the Google Cloud CLI.

   2. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

   3. If you're using a local shell, then create local authentication credentials for your user account:

      gcloud auth application-default login

      You don't need to do this if you're using Cloud Shell.

      If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity.

   For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

   Python

   To use the Python samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

   1. Install the Google Cloud CLI.

   2. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

   3. If you're using a local shell, then create local authentication credentials for your user account:

      gcloud auth application-default login

      You don't need to do this if you're using Cloud Shell.

      If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity.

   For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

   REST

   To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI.

   Install the Google Cloud CLI.

   If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

   For more information, see Authenticate for using REST in the Google Cloud authentication documentation.

   The image.redact method also supports API keys. If you want to use API keys for authentication, you do not need to set up a local Application Default Credentials file. For more information, see Create an API key in the Google Cloud authentication documentation.

   For information about setting up authentication for a production environment, see Set up Application Default Credentials for code running on Google Cloud in the Google Cloud authentication documentation.

2. To get the permissions that you need to inspect, redact, and de-identify content, ask your administrator to grant you the DLP User (roles/dlp.user) IAM role on your project. For more information about granting roles, see Manage access to projects, folders, and organizations.

   You might also be able to get the required permissions through custom roles or other predefined roles.

Redact all default infoTypes from an image

To redact sensitive data from an image, submit the image to the DLP API's image.redact method. Unless you specify specific information types (infoTypes) to search for, Sensitive Data Protection searches for the most common infoTypes.

Default infoTypes don't include objects in images.

To redact default infoTypes from an image, do the following:

1. Encode the image as a base64 string.

   If you plan to use one of the Sensitive Data Protection client libraries to perform this task, skip this step.

2. Submit a request to the image.redact method.

   If you want to redact default infoTypes, the request requires only the base64-encoded image.

For example, consider the following image of a document.

To redact the default infoTypes from this image, send the following request to the DLP API's image.redact method:

using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
using Google.Protobuf;
using System;
using System.IO;

public class RedactSensitiveDataFromImageUsingDefaultInfoTypes
{
    public static RedactImageResponse RedactImage(
        string projectId,
        string originalImagePath,
        string redactedImagePath)
    {
        // Instantiate the dlp client.
        var dlp = DlpServiceClient.Create();

        // Construct the content item.
        var byteContentItem = new ByteContentItem
        {
            Type = ByteContentItem.Types.BytesType.ImagePng,
            Data = ByteString.FromStream(new FileStream(originalImagePath, FileMode.Open))
        };

        // Construct the Redact request to be sent by the client. Do not specify the type of info to redact.
        var request = new RedactImageRequest
        {
            ParentAsLocationName = new LocationName(projectId, "global"),
            ByteItem = byteContentItem
        };

        // Call the API.
        var response = dlp.RedactImage(request);

        // Inspect the response.
        Console.WriteLine($"Redacted image written to: {redactedImagePath}");

        // Writes redacted image into file
        response.RedactedImage.WriteTo(new FileStream(redactedImagePath, FileMode.Create, FileAccess.Write));

        return response;
    }
}

import (