What Survived the Filters: The CommonPool Audit
This chapter examines what a large web-scraped training dataset can still contain after collection, filtering, and release. The focus is the audit of DataComp CommonPool: what the researchers measured, what kinds of personal information they found, and how the design of the study limits the conclusions. The practical value is a disciplined way to treat evidence of presence as strong evidence of risk without turning one sampled dataset into a claim about every dataset or every person.
The question is not whether a filter produced a clean-looking summary. It is whether the evidence supports the stronger statement that personal information is absent, controlled, or no longer capable of affecting anyone. Those are different claims. A web-scale audit has to examine several linked components—text, images, URLs, and metadata—because removing one visible identifier may leave another route to the same person.
How the audit turns a billion-scale problem into evidence
DataComp CommonPool contains 12.8 billion image-text samples. No research team could inspect every item in that collection one by one, so the authors downloaded a small-scale version in April 2025. It contained 12.8 million randomly selected samples, approximately 0.1 percent of the full dataset. The sample was still large enough to support estimates for some categories, but it was not a census and it could not reveal every kind of privacy concern.
The distinction between a random sample and a complete inventory is essential. If a phenomenon appears in a carefully inspected random subset, it can establish that the phenomenon exists in the larger collection and may support an estimate with a confidence interval. It does not show that every item has the same property. Conversely, failing to find a category does not prove that the category is absent, especially when the detection method is narrow, the text is not in English, or the relevant information is visual rather than textual.
The audit combined automated and human methods. Optical character recognition, or OCR, converted visible words in images into searchable text. A personally identifiable information detector flagged possible names, account details, government identifiers, and other patterns in captions and OCR output. URL analysis helped identify the kinds of sites associated with samples and the history or availability of linked images. The researchers then manually inspected flagged items and counted only cases that met the relevant criteria. They also used keyword searches and visual examination for categories that automated recognition could miss.
That combination is not a minor methodological detail. Automated tools are useful for narrowing a search across millions of samples, but their output is a set of candidates, not ground truth. A sequence of numbers can look like an account number without being one. A name can refer to a brand or fictional character. OCR can misread text, and a detector can miss a disclosure that does not match its patterns. Manual review improves the specificity of the reported cases, while limiting the number of samples that can be examined in depth.
The audit’s evidence can therefore be separated into three layers. The first is an observation: a reviewed sample visibly contains a face, a resume, an identity document, a name, or a location. The second is an estimate: the observed rate in a random subset is projected to the full dataset under stated sampling assumptions. The third is an interpretation: the presence and distribution of those items create legal, ethical, or technical concerns for people who curate or use the dataset. The third layer should not be smuggled into the first two. A picture that contains a face is an observation; whether it is personal data, biometric data, or lawfully processed information depends on the relevant law and circumstances.
The linked structure explains why the audit did not stop at captions. A sample can have a harmless-looking description but an image of a document. An image can have a blurred face but an Exif field containing a name or precise location. A failed image request can leave a caption and URL accessible. A face detector can create a bounding box that makes a face easier to locate even when the default download path blurs it. The components are not independent records; they are different views of one retrieval path.
The authors also report limitations that change how the results should be used. Their text analysis focused on English. The random subset may not represent duplicate-heavy or rare “tail” content in the same way as the whole dataset. Some images were no longer available, and download failures could reflect a broken site, a permission response, or a server or connection issue. Automated tools created false positives and false negatives. These are not ritual disclaimers. They tell the reader which conclusions are stable and which would require new evidence—for example, multilingual audits, a different sample design, or direct examination of currently unavailable assets.
What the audit found—and what it does not prove
The findings are easier to understand when grouped by the component that carries the information.
Text can link identity to characteristics. The audit found captions and OCR-extracted text that connected full names with descriptions of sexual orientation, religion, race, or ethnicity. Some examples came from news articles or other contexts where the person may have disclosed information for the purpose of that article. That context is relevant, but it does not establish that the person agreed to have the material collected into a general-purpose training dataset. The observation is narrower and more defensible: identifying language and potentially sensitive descriptions co-occurred in samples that entered the dataset.
The paper also found many celebrity names. This category is useful as a contrast, not because a celebrity name automatically creates the same privacy concern as a private person’s identity document. It shows that captions and extracted text can identify people even when no face is being analysed. It also demonstrates why the legal meaning of “personal information” cannot be inferred from a detector’s label alone. A famous person’s name, an ordinary person’s name, and a name attached to a sensitive characteristic may have different contexts and consequences.
Images can carry documents that ordinary text filters cannot safely remove. The audit found pictures of credit cards, driver’s licences, Social Security numbers, passports, and birth certificates. It also found resume documents linked to people who had a public online presence. The researchers estimated that at least 136,000 images in the full CommonPool collection depicted resumes associated with such individuals.
A resume is not just one identifier. It can combine a name, contact details, education, employment history, address, photograph, date or place of birth, and information about other people such as references or family members. The audit reports that some validated resumes also contained government identifiers and sociodemographic information. This makes the document a useful example of aggregation: the privacy significance comes not only from a single field but from the dossier created when several fields travel together.
The fact that some resumes may have been uploaded in a job-seeking context does not settle their later use. A person may reasonably expect a professional profile to be seen by potential employers while not expecting the same image to be copied into a massive multimodal dataset. The audit cannot determine the original uploader’s intent in every case. It does establish that a collection system designed to gather image-text pairs captured documents whose contents could matter to identifiable people.
URLs reveal both people and changing access conditions. The researchers searched for content associated with children’s websites and found examples involving children’s names, faces, birth certificates, passports, and health status. The number of examples in a search category should not be read as the prevalence of children’s information across the entire dataset: the search covered particular sites and a limited subset. Its importance is evidentiary. A system that collects from the web can encounter information about children even when the collection was not expressly aimed at children.
The availability analysis adds a different finding. In the April 2025 download, 21.4 percent of sampled image URLs failed to download. Of those failed links, 19.0 percent were attributed to a lack of access permissions. The most common causes also included broken or dead links. Some resources that returned a crawler “Forbidden” response could still be rendered manually, suggesting that a server may have recognised the download script or applied a different rule to automated access.
This does not prove that every failed request represents a historical rejection of the original collection. A site may have changed its rules after an earlier snapshot, or a connection problem may have produced the failure. It does show that current reachability is an unstable measure. More importantly, the failed image did not take the rest of the record with it: captions, URLs, and accompanying annotations remained in the released artifact. The inability to fetch an asset today is not evidence that no personal information remains accessible.
Metadata can be personal information even when the visible image looks safe. Image Exif tags can record information added by a camera or software. The audit found non-empty fields relating to timestamps, locations, and individuals; some name-related fields contained full names. In a random re-examination of geolocation tags, 28.6 percent contained precise latitude and longitude information, and a smaller portion also had tags containing full names. These figures describe the authors’ sampled metadata analysis, not every image in CommonPool.
Metadata matters because it is easy to overlook in a privacy review focused on pixels. A face may be blurred while a camera-owner field identifies the photographer. A stock image may appear anonymous while a location tag places it at a precise point. A dataset consumer may not have intended to collect those fields, but if the downloader extracts and stores them, they become part of the processing surface. The EDPB’s emphasis on mapping, minimisation, and deletion applies to these attached fields as well as to the main image.
Face annotations reduce one exposure while leaving a measurable gap. CommonPool provides face-detection annotations so that its downloader can blur detected faces by default. In the audit, the researchers applied another face detector to 100,000 randomly selected samples and manually examined cases in which the original annotations did not identify a face. Their estimate was that between 100 million and 119 million images in the full dataset contained human faces not covered by the default annotations, with at least 100 million as the lower estimate.
The estimate should be read with its denominator and method attached. It is based on a sampled comparison between detection systems and manual review. It does not mean that every missed face is recognisable, nor does it prove that every image without a bounding box contains a person. It does mean that “the downloader blurs faces by default” is not enough to support the claim that human faces are absent or reliably protected.
The researchers also found names and locations alongside some human faces missed by the default detector. This is the more important mechanism than the headline number. Identification can be distributed across components. A face detector may miss the image; OCR may capture a name; Exif may disclose a location; and the URL may connect the item to a page that supplies more context. A successful control in one modality cannot establish safety for the whole sample.
The resulting interpretation is carefully bounded. The audit provides direct evidence that personal information remained in CommonPool despite filtering and that several types of information survived in different components. It provides estimates for selected categories under a random-sampling design. It does not prove the exact contents of all 12.8 billion samples, the legal status of every item, or the identities of all downstream models trained with the dataset. Nor does it show that a different curation pipeline would have the same miss rate.
Those limits do not make the findings weak. They tell us what the findings are good for. They are strong evidence against treating a large, automatically curated dataset as demonstrably free of personal information merely because it has toxicity filters, face annotations, or a URL-only release. They are weaker evidence for any claim about overall prevalence outside the audited categories, languages, dates, and tools. New evidence could change the size of an estimate; it would not erase the reviewed examples that establish presence.
The audit also changes the next legal question. It is no longer persuasive to discuss privacy as if the dataset contained only anonymous visual features or generic web text. The evidence shows a mixture of personal information, potentially sensitive content, changing access conditions, and residual metadata. Whether a particular item is personal data or a special category under a specific law still requires legal analysis. But that analysis must begin from what the pipeline actually retained, not from what its designers hoped the filters would remove.
That is the boundary between evidence and judgment. The audit tells us that personal information survived and that the controls were not complete. The GDPR analysis must now ask whether the processing had a lawful basis, whether the collection was necessary and proportionate, what people could reasonably expect, and what safeguards can still reduce the impact.