# Facial Privacy Protection with Dynamic Multi-User Access Control for Online Photo Platforms
## 1 Introduction
If a parent (acting as an image consumer) wishes to view their child's face in an image, they must submit a permission request, which the school administrator may approve or deny based on institutional policies and privacy considerations. However, the process of verifying image consumers--such as determining whether or not the requester is the child's parent in the school use case and whether or not they have the right to view the face--is beyond the scope of this study. Upon approval, the system splits the original secret key into two shares: one assigned to the owner and the other to the consumer. For decryption, the image consumer must have access to both key shares, ensuring security and restricting access exclusively to authorized users. As part of this process, the image consumer must provide relevant details, such as the image identifier, to initiate the decryption. If all conditions are met, the system decrypts the facial data and displays the original face to the consumer. Although Figure 1 illustratesthe decryption process for the consumer, it does not depict the decryption process by the image owner, which will be detailed in subsequent sections. Additionally, the system enables the image owner to revoke previously granted access at any time, ensuring that full control over facial data is retained. This owner-centric permission system, combined with the request-based mechanism for initiating permissions, guarantees that non-facial areas of images remain accessible for general viewing, while facial data are protected under strict, dynamic access control policies. By implementing encryption-based access control, our system ensures file-level security for images, allowing only authorized users to access facial data. This approach is particularly relevant for securely sharing privacy-sensitive images while enforcing strict access control measures. While our discussion primarily focuses on school environments, similar concerns extend to other domains. For instance, companies may need to regulate access to event photos, NGOs might publish images from community projects while safeguarding individuals' identities, and individuals may wish to share photos from social gatherings while preserving the privacy of those depicted. Building on this foundation, our approach redefines the role of organizational users in the original single-party SnapSafe system. Instead of a single-user control model, these users now participate equally in sharing protected photos online. This shift to a multi-user access model expands the system's applicability, supporting a wider range of use cases. The following sections outline the proposed system in detail and are structured as follows. Section 2 presents related works on facial privacy protection. Section 3 provides a preliminary discussion of key concepts and technologies relevant to the proposed system, along with an overview of this work's contributions. Section 4 describes the proposed system in detail, covering its components, the workflow for key operations, and security considerations. Section 5 discusses the experimental setup and analysis. Finally, Section 6 summarizes the study's findings and conclusions and outlines potential directions for future research.