Sensitive Data Protection can redact sensitive text from an image. Using infoType detectors and Cloud Vision, Sensitive Data Protection inspects an image for text, detects sensitive data within the text, and then returns an image with any matching sensitive data obscured by an opaque rectangle.
For example, consider the following "before" and "after" images. The original image is an example of a typical image file generated from a scan of a paper document. In this example, Sensitive Data Protection has been configured to redact US Social Security numbers, email addresses, and telephone numbers using rectangles of different colors, depending on the content.
![Before and after redacted image.](/https/cloud.google.com/static/sensitive-data-protection/docs/images/redacting-sensitive-data-images-beforeafter.png)
- Scanned image before image redaction
- Scanned image after image redaction
Limitations and considerations
Consider the following points when redacting content from images.
Supported file types
Sensitive Data Protection can redact sensitive data from many image types, including JPEG, BMP, and PNG. For more information, see Supported file types.
Content redaction is not supported for SVG, PDF, XLSX, PPTX, or DOCX files.
Finding limits
When redacting data from images, finding limits don't apply. They can
cause unexpected or potentially inconsistent results, where only some data is
redacted. If you include FindingLimits
in your request, Sensitive Data Protection
generates an error.
Before you begin
- Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
-
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
-
Make sure that billing is enabled for your Google Cloud project.
-
Enable the DLP API.
-
Create a service account:
-
In the Google Cloud console, go to the Create service account page.
Go to Create service account - Select your project.
-
In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.
In the Service account description field, enter a description. For example,
Service account for quickstart
. - Click Create and continue.
-
Grant the Project > Owner role to the service account.
To grant the role, find the Select a role list, then select Project > Owner.
- Click Continue.
-
Click Done to finish creating the service account.
Do not close your browser window. You will use it in the next step.
-
-
Create a service account key:
- In the Google Cloud console, click the email address for the service account that you created.
- Click Keys.
- Click Add key, and then click Create new key.
- Click Create. A JSON key file is downloaded to your computer.
- Click Close.
-
Set the environment variable
GOOGLE_APPLICATION_CREDENTIALS
to the path of the JSON file that contains your credentials. This variable applies only to your current shell session, so if you open a new session, set the variable again. - Install the Google Cloud CLI.
-
To initialize the gcloud CLI, run the following command:
gcloud init
-
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
-
Make sure that billing is enabled for your Google Cloud project.
-
Enable the DLP API.
-
Create a service account:
-
In the Google Cloud console, go to the Create service account page.
Go to Create service account - Select your project.
-
In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.
In the Service account description field, enter a description. For example,
Service account for quickstart
. - Click Create and continue.
-
Grant the Project > Owner role to the service account.
To grant the role, find the Select a role list, then select Project > Owner.
- Click Continue.
-
Click Done to finish creating the service account.
Do not close your browser window. You will use it in the next step.
-
-
Create a service account key:
- In the Google Cloud console, click the email address for the service account that you created.
- Click Keys.
- Click Add key, and then click Create new key.
- Click Create. A JSON key file is downloaded to your computer.
- Click Close.
-
Set the environment variable
GOOGLE_APPLICATION_CREDENTIALS
to the path of the JSON file that contains your credentials. This variable applies only to your current shell session, so if you open a new session, set the variable again. - Install the Google Cloud CLI.
-
To initialize the gcloud CLI, run the following command:
gcloud init
Redacting all default infoTypes from an image
To redact sensitive data from an image, submit the image to the
DLP API's
image.redact
method.
Unless you specify specific information types (infoTypes)
to search for, Sensitive Data Protection searches for the most common infoTypes.
To redact default infoTypes from an image, do the following:
Encode the image as a base64 string.
If you plan to use one of the Sensitive Data Protection client libraries to perform this task, skip this step.
Submit a request to the
image.redact
method.If you want to redact default infoTypes, the request requires only the base64-encoded image.
For example, consider the following image. This is an example of a typical image file generated from a scan of a paper document.
![Original unredacted image.](/https/cloud.google.com/static/sensitive-data-protection/docs/images/redacting-sensitive-data-images-dlpbefore.jpg)
To redact the default infoTypes from this image, send the following request to
the DLP API's
image.redact
method:
C#
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Go
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Java
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Node.js
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
PHP
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Python
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
REST
{ "byteItem": { "data": "[BASE64-ENCODED-IMAGE]", "type": "IMAGE_JPEG" } }
Sensitive Data Protection returns the following:
{ "redactedImage": "[BASE64-ENCODED-IMAGE]" }
Decode the base64-encoded image.
The resulting image appears as follows:
![Redacted image, all infoTypes.](/https/cloud.google.com/static/sensitive-data-protection/docs/images/redacting-sensitive-data-images-dlpafter1.jpg)
Note that in addition to masking the handwritten Social Security number, the email address, and the phone number, Sensitive Data Protection also redacted the year. The next section demonstrates how to redact only certain infoTypes.
Redacting specific infoTypes from an image
If you want to redact only certain sensitive data from an image, specify their corresponding built-in infoTypes.
To redact specific infoTypes from an image, submit a request to the
DLP API's image.redact
method. The request must include the
following:
- The image.
- One or more infoType detectors.
Consider the original image from the previous section. To redact only
US Social Security numbers, email addresses, and telephone numbers, send the
following JSON to the DLP API's
image.redact
method:
C#
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Go
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Java
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Node.js
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
PHP
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Python
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
REST
{ "byteItem": { "data": "[BASE64-ENCODED-IMAGE]", "type": "IMAGE_JPEG" }, "imageRedactionConfigs": [ { "infoType": { "name": "US_SOCIAL_SECURITY_NUMBER" } }, { "infoType": { "name": "EMAIL_ADDRESS" } }, { "infoType": { "name": "PHONE_NUMBER" } } ] }
Sensitive Data Protection returns the following:
{ "redactedImage": "[BASE64-ENCODED-IMAGE]" }
Decode the base64-encoded image.
The resulting image appears as follows:
![Redacted image, three infoTypes.](/https/cloud.google.com/static/sensitive-data-protection/docs/images/redacting-sensitive-data-images-dlpafter2.jpg)
You can color code redacted information by infoType when you want to tell at a glance what's been redacted. See the following section for more information.
Redacting infoTypes from an image with color coding
To color code redacted information by infoType, you pair infoType detectors with RGB color space values.
To color-code infoTypes redacted from an image, submit a request to the
DLP API's image.redact
method. The request must include the
following:
- The image.
- One or more infoType detectors, each of which is assigned a color using RGB color space values.
Consider the original image from the first section. To redact
US Social Security numbers with a purple box, email addresses with a green box,
and telephone numbers with an orange box, send the following JSON to the
DLP API's
image.redact
method:
C#
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Go
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Java
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Node.js
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
PHP
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Python
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
REST
{ "byteItem": { "data": "[BASE64-ENCODED-IMAGE]", "type": "IMAGE_JPEG" }, "imageRedactionConfigs": [ { "infoType": { "name": "US_SOCIAL_SECURITY_NUMBER" }, "redactionColor": { "red": 0.3, "green": 0.1, "blue": 0.6 } }, { "infoType": { "name": "EMAIL_ADDRESS" }, "redactionColor": { "red": 0.5, "blue": 0.5, "green": 1 } }, { "infoType": { "name": "PHONE_NUMBER" }, "redactionColor": { "red": 1, "blue": 0, "green": 0.6 } } ] }
Sensitive Data Protection returns the following:
{ "redactedImage": "[BASE64-ENCODED-IMAGE]" }
Decode the base64-encoded image.
The resulting image appears as follows:
![Redacted image, three infoTypes color-coded.](/https/cloud.google.com/static/sensitive-data-protection/docs/images/redacting-sensitive-data-images-dlpafter3.jpg)
Redacting all text from an image
Sensitive Data Protection also contains an option to redact all detected text in an image.
To redact all text from an image, submit a request to the DLP API's
image.redact
method. The request must include the following:
- The image.
- The
redactAllText
option set totrue
.
Consider the original image from the first section. To redact all text, send the
following JSON to the DLP API's
image.redact
method:
C#
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Go
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Java
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Node.js
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
PHP
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Python
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
REST
{ "byteItem": { "data": "[BASE64-ENCODED-IMAGE]", "type": "IMAGE_JPEG" }, "imageRedactionConfigs": [ { "redactAllText": true } ] }
Sensitive Data Protection returns the following:
{ "redactedImage": "[BASE64-ENCODED-IMAGE]" }
Decode the base64-encoded image.
The API returns the same image(s) you gave it, but any text identified as containing sensitive information according to your criteria has been redacted.
The resulting image appears as follows:
![Redacted image, all text.](/https/cloud.google.com/static/sensitive-data-protection/docs/images/redacting-sensitive-data-images-dlpafter4.jpg)
Code example with likelihood setting
This example is similar to Redacting specific infoTypes from an image. It additionally demonstrates how to specify a minimum likelihood.
C#
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Go
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Java
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Node.js
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
PHP
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Python
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries.
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Try it out
You can try out each of the examples on this page yourself—or experiment
with your own images—in the APIs Explorer on the reference page for
image.redact
:
What's next
- Learn more about image inspection and redaction.
- Work through the Redacting Sensitive Data with Sensitive Data Protection codelab.
- Learn how to inspect images for sensitive data.
- Learn more about creating a de-identified copy of data in storage.