# Facial Privacy Protection with Dynamic Multi-User Access Control for Online Photo Platforms
## 1 Introduction
Image encryption provides a robust solution to protect facial data by ensuring that the original face remains hidden until decrypted. Although encryption protects against unauthorized access, it introduces challenges in balancing an image's security and usability. For instance, encrypting an entire image can render it unusable for general viewing [15]. This tradeoff is particularly significant on online platforms, where the goal is to share visually meaningful images [16]. Full-image encryption undermines this usability by obscuring both facial and non-sensitive content, limiting the effectiveness of image sharing. To address these limitations, our previous work introduced SnapSafe [17], a single-party system designed to protect individuals' privacy by selectively encrypting facial regions in images while preserving the visibility of non-sensitive content. SnapSafe focuses on proactive privacy protection at the source, ensuring that individuals' privacy is preservedbefore an image enters the public domain. Using a deep-learning model based on the YOLOv8 architecture [18] for face detection and an AES algorithm for image encryption, SnapSafe demonstrated the feasibility of safeguarding facial data with minimal impact on image usability. This approach provides a practical solution for protecting facial data in shared images, particularly in the SnapSafe context, i.e., organizational settings where privacy concerns are paramount. However, in the context of SnapSafe, the original system was designed primarily for organizational use cases, where a single entity--the organization--controlled both encryption and decryption. Consequently, only the organization could reveal faces, as it retained exclusive control over the decryption keys. This centralized model restricted access to the original faces solely to the organization. Nevertheless, the demand for secure photo sharing extends beyond organizational contexts to online photo platforms, where images are shared among multiple users. Given the limitations of SnapSafe, particularly its single-party design and lack of dynamic access control mechanisms, our current work addresses these gaps by introducing dynamic access control mechanisms that enable controlled sharing of facial data among multiple users while ensuring flexible, user-centered privacy protection. In this study, we classify users into two categories: image owners and image consumers. The interaction between these two groups, including how images are shared and accessed, is illustrated in Figure 1.  
An image owner, referred to as [PERSON], is an individual who captures and uploads a photograph to the system, rather than the person depicted in it. This classification aligns with U.S. Copyright Office Circular 42 [19], which states that copyright belongs to the photographer, not the subject, unless transferred to another party. However, this assumption must be applied carefully, as publishing images containing identifiable individuals raises privacy concerns that vary across jurisdictions. Once an image is uploaded, it may be shared publicly, making it accessible to the public domain, or within a restricted group, where access is limited to specific users. As shown in Figure 1, people who have permission to view facial data are referred to as image consumers, [PERSON] representing an example. [PERSON] can view the facial data unless his access is revoked, whereas the public domain can only access images with encrypted face regions. Our proposed system enables image owners to encrypt facial data when necessary. This encryption may be optional for individuals prioritizing privacy or mandatory for organizations (e.g., schools, Non-Governmental Organizations (NGOs), or companies) to comply with regulations such as the General Data Protection Regulation (GDPR) [20]. For example, a school that shares images of its activities online acts as the image owner and can implement measures to protect students' privacy before publication.