🌐 Also available in: Deutsch · Français · Español
Up front: this is a field report, not legal advice. I am an admin, not a lawyer. If in doubt, ask someone who does this for a living.
A private tech blog in Germany is not a legal no man’s land. Imprint, privacy, copyright on images – each of them carries the risk of a formal warning letter, and the longer a blog runs, the more piles up. So in October I went through my blog systematically: where might I step on someone’s toes, where do I reveal more than necessary, and where am I open to attack? This post sums up what I found and changed.
🖼️ Images that aren’t mine
Images were the biggest chunk. Over the years, things had accumulated that I had not made myself:
- Manufacturer product photos: two device photos and a comparison graphic with other companies’ app logos. Replaced by my own illustrations.
- Official logos: several logo files of software projects sat in the media library without being used anywhere. Deleted.
- AI images with third-party characters: a few featured images showed recognisable characters and motifs from films and games. Even when AI-generated, they remain other people’s brands and characters. Blurred, with a short note below.
- Screenshots with people: an old login screenshot contained sample photos of real people, a child among them. Blurred as well.
- A book cover: first given a source credit, later removed from the post altogether.
On top of that came two embeds from foreign servers: an image loaded directly from GitHub and a video player from another platform. Both fetch data from third parties when the page loads – and send the visitor’s IP address along. The image now lives on my own server; the player was replaced by a preview image with a link.
The takeaway: “it’s only a featured image” protects nobody. Whatever is not self-made, explicitly freely licensed or clearly quoted does not belong on the site – not even in the media library if it is no longer used anywhere.
📷 What photos give away
Photos from a phone carry metadata: device model, capture time, a unique image ID, often the GPS position. A check of all roughly 1,200 images still found such data in some photos; luckily the GPS fields were empty. I removed the metadata losslessly – the image itself stayed identical, pixel for pixel.
File names give things away too: two images still had the names the AI tool had given them. They got descriptive names.
Since October a small plugin converts every new image on upload: WebP, at most 1,536 pixels wide, under 280 KB. The reason for that limit was a side finding – WhatsApp showed the wrong preview image for shared links because it simply ignores preview images above roughly 300 KB. 128 of 468 posts were affected.
The takeaway: an image is more than its pixels. Check metadata and file names before uploading – or have them cleaned automatically on upload.
📜 A privacy policy that matches reality
My privacy policy originally came from a generator. It described a contact form that never existed and a behaviour analysis that never ran – and said nothing about what actually happens.
So I rewrote the part about operations:
- Server logs: which fields a request leaves in the log and how long they are kept.
- Protection against attacks: that fail2ban temporarily blocks addresses after repeated failed attempts.
- Visitor statistics: that I count visitors without a tracker and without cookies, aggregated from the logs only.
- What does not exist: no external fonts, no third-party scripts, no cookies for advertising or analytics.
The takeaway: a privacy policy made of boilerplate is wrong when it matters. It has to describe what your own server really does – and only the person running it knows that.
🤖 The AI notice – and quotes that never existed
Many of my texts and images are made with AI assistance; a dedicated notice on the blog says so. One thing in it was not quite honest, though: it claimed screenshots were unedited – many are redacted. That is corrected now.
A finding in an older post weighed more: three sentences presented as a quote from a well-known person, who never said them that way. A language model had “completed” them plausibly. The post now contains a single verifiable quote with its source; my own interpretation is marked as such.
The takeaway: AI writes convincing quotes. Every quote needs a source you have read yourself – otherwise it is not a quote.
🏷️ The imprint: mandatory, but please not on Google
A German website needs an imprint (§ 5 DDG), plus the name of whoever is responsible for the content. It has to be easy to reach – but it does not have to appear in every search engine. My imprint contains my postal address, and I do not want that as a search result for my name.
So the imprint and the privacy policy carry noindex in all four languages: search engines leave them out, but visitors reach them through the link in the footer of every page. Recently the footer also got a disclaimer line – in the visitor’s language and linked to the matching section of the imprint: everything is my personal view, none of it is legal, professional or security advice, and anyone adopting something should test it first.
And then there was the imprint in dark mode. It originally came as a ready-made HTML block from a light template, with hard-coded colours – dark grey text, a light grey box around the PGP fingerprint. On the blog’s dark background it was barely readable. The fix was simple: remove the fixed colours and let the theme’s colours apply.
The takeaway: mandatory information has to be reachable, not findable. And copied HTML brings its design along – including where it does not fit.
A second pass. After writing this post I checked the whole blog against it once more, and it was worth it. The translation plugin set a language cookie for one year that my privacy policy did not mention; it is switched off now. A few screenshots still showed public IP addresses, a family member’s first name and a server serial number, and one log still contained an IP address. All of that is blacked out or replaced. Eight unused images left the media library, including that book cover, and weak image descriptions were rewritten.
🎯 The lessons
- Only own or properly licensed images – AI images can infringe other people’s rights, too.
- Check metadata and file names – ideally automatically on upload.
- Host third-party content yourself or link to it – every embed sends visitor data to someone else.
- Align privacy policy and AI notice with reality – boilerplate and polished notices are vulnerable.
- Verify every quote yourself – a language model invents them convincingly.
