When Cleanup Fails, Responsibility Keeps Moving

For web scraping used in generative-AI training, the difficult problem is not only collecting too much; it is proving that cleanup worked and responding when it did not. This chapter diagnoses the failure modes exposed by the CommonPool audit, then follows an objection or sensitive-data finding through the dataset, the model, and the output. The reader will be able to match a problem to the stage where it arose and avoid promising that one filter, deletion request, or retraining step fixes every copy.

A clean-looking dataset is not the same as an anonymous dataset. “Anonymous” is a conclusion about identifiability in context, not a label earned by running one tool. If a face is blurred but a caption gives a name, or if an image is removed while its URL and metadata remain, the processing surface has changed without disappearing. Diagnosis must therefore separate the visible symptom from the cause, the conditions that let the cause persist, and the consequences that follow.

Why the clean result is misleading

The most visible mitigation in CommonPool is face blurring. The released artifact included bounding-box annotations produced by the SCRFD face-detection algorithm so that a downloader could blur detected faces by default. That is a useful control: it can reduce direct visual exposure without requiring every user to build their own detector. But it is a detection-dependent control, and detection is not the same as identification or complete coverage.

The paper compared face-detection results and then examined a random 100,000-sample set for cases where another detector found faces that SCRFD did not. It found roughly 3,000 such samples. The authors manually reviewed 1,445 SCRFD-negative samples and found that 59.1 percent depicted human faces; the remainder included false positives or drawings and cartoons. Projecting the observed miss rate to the full collection, they estimated that between 100 million and 119 million images contained human faces not covered by the default annotations, with at least 100 million as the lower estimate.

The important point is not that one detector is uniquely bad. The study’s numbers depend on the sampled tools, thresholds, and manual annotations, and they do not show that every missed face is recognisable. The diagnostic point is that a detector can have a modest-looking failure rate and still leave a very large residual at web scale. A control that is useful for reducing exposure cannot be described as proof that the relevant category is absent.

There are several distinct causes behind that symptom. A face may be too small, poorly lit, partly obscured, or represented in a form the detector handles poorly. The paper reports that the faces missed by SCRFD tended, in the examined samples, to have smaller bounding boxes and lower pixel brightness; the authors also discuss the limitations and biases of automated face recognition. These observations help explain the miss pattern, but they do not establish why every individual image was missed. A responsible diagnosis keeps the mechanism and the uncertainty together.

A second cause is that privacy information is distributed across linked components. The audit found names, locations, Exif fields, and text associated with some human faces that the default detector did not cover. A face blur can reduce the recognisability of pixels while leaving the caption intact. OCR can extract a name or an identity number from a document. Exif metadata can retain a full name or precise geolocation. A URL can lead to a page with more identifying context. A released face box can create a separate route for a user to locate or extract the face, and the downloader allowed the default blurring to be overridden.

This is why “the face is hidden” is an incomplete symptom description.