IPTC metadata automatically added to uploaded images on Facebook

Question

Many images uploaded on Facebook contain IPTC/IIM fields which are apparently automatically added during the upload process:

• Special Instruction, a string beginning with "FBMD"
• Original Transmission Reference.

See for example this (personnal) image uploaded on Facebook and decoded using Jeffrey's Exif Viewer: http://exif.regex.info/exif.cgi

What is this?

Condensation

“What is this?” – that’s something you’d have to ask Facebook … – Guayule

BTW, is it possible to view IPTC data not using a tool or an API like Jeffrey's Exif Viewer? i.e. in a hex-viewer? or at least check if there is IPTC data by examining the binary image file only? (e.g. in a text editor capable of showing hex content) So far, I have been unsuccessful in finding out the answer +1 for a great question. – Passage

I'm currently trying to find out the same, what is encoded in this metadata field. As I've been working at the byte level, I can tell you that it is as he posted, after the FBMD you find the numbers as alphanumeric text (all within the ASCII set). So it's just text, in my test cases 94 bytes long, and I can't crack them yet to see what is stored there. – Overbalance

@Overbalance that's doesn't really look like ascii characters as in my case there's a lot zeroes in row – Dysgenic

@Dysgenic I've been away from this topic for a while, so it could be that facebook has changed their use of this kind of metadata. They seem to be using (abusing maybe?) the ITPC metadata field to hold their own, who-knows-how encoded metadata. Without more information, there's very little to hold on to for reverse engineering the data field. – Overbalance

Can it please be confirmed if two visitors downloading a photo from Facebook will receive bit-wise identical files? – Cinema

Related: twitter.com/oasace/status/1149181539000864769 – Robalo

Answer 1

According to this site:

Special Instructions [IPTC Core] Alternative label from older IPTC IIM schema, used for "Instructions."

Instructions [IPTC Core] This is a simple text field that can include any of a number of instructions from the provider or creator to the receiver of the photograph. Any of the following might be included: embargoes (eg: News Magazines OUT) and other restrictions not covered by the Rights Usage Terms field (or new PLUS rights related fields); information regarding the original means of capture (scanning notes, color profile, etc.) or other specific text information the user may need for accurate reproduction; additional permissions or credits required when publishing. Note: This field is “shared” with the “Instructions” field in the Origin panel of the Adobe Photoshop File Info dialogue.

Examples: *Image to be used one time only, non-exclusive in English-language-edition magazine as inside image, no larger than a full page in color. Additional third-party rights to be negotiated with Julie Doe / XYZ Agency in advance. All rights not specifically granted are reserved. See delivery memo for specific license.

For consideration only; no reproduction in any form without prior, written permission.*

That's the International Press Telecommunications Council (IPTC) standard Information Interchange Model (IIM).

I haven't been able to decode Facebook's data, but pasting, downloading, and pasting an image again will change the data slightly.

Using IrfanView to set special instructions to "testing" in a JPG without IPTC data, adds these bytes to the header:

I've downloaded 339 images with instruction length 94 after the FBMD, and the following bytes stayed the same:

0 {'0': 339}
1 {'1': 339}
2 {'0': 339}
3 {'0': 339}
4 {'0': 339}
5 {'a': 339}
8 {'0': 339}
9 {'3': 339}
10 {'0': 339}
11 {'0': 339}
12 {'0': 339}
13 {'0': 339}
18 {'0': 339}
19 {'0': 339}
20 {'0': 339}
21 {'0': 339}
26 {'0': 339}
27 {'0': 339}
28 {'0': 339}
29 {'0': 339}
34 {'0': 339}
35 {'0': 339}
36 {'0': 339}
37 {'0': 339}
42 {'0': 339}
43 {'0': 339}
44 {'0': 339}
45 {'0': 339}
50 {'0': 339}
52 {'0': 339}
53 {'0': 339}
58 {'0': 339}
60 {'0': 339}
61 {'0': 339}
66 {'0': 339}
68 {'0': 339}
69 {'0': 339}
74 {'0': 339}
76 {'0': 339}
77 {'0': 339}
82 {'0': 339}
84 {'0': 339}
85 {'0': 339}
90 {'0': 339}
92 {'0': 339}
93 {'0': 339}

I also found 3 images with only 86 mystery bytes after FBMD, e.g. 23000986030000f91d0000e5230000502900004889000041ac000004c900007aee0000cf0f0100f02d0100, also saved in the past few months. Same bytes there were:

0 {'2': 3}
1 {'3': 3}
2 {'0': 3}
3 {'0': 3}
4 {'0': 3}
5 {'9': 3}
6 {'8': 3}
8 {'0': 3}
9 {'3': 3}
10 {'0': 3}
11 {'0': 3}
12 {'0': 3}
13 {'0': 3}
16 {'1': 3}
18 {'0': 3}
19 {'0': 3}
20 {'0': 3}
21 {'0': 3}
26 {'0': 3}
27 {'0': 3}
28 {'0': 3}
29 {'0': 3}
34 {'0': 3}
35 {'0': 3}
36 {'0': 3}
37 {'0': 3}
42 {'0': 3}
43 {'0': 3}
44 {'0': 3}
45 {'0': 3}
50 {'0': 3}
51 {'0': 3}
52 {'0': 3}
53 {'0': 3}
58 {'0': 3}
59 {'0': 3}
60 {'0': 3}
61 {'0': 3}
66 {'0': 3}
67 {'0': 3}
68 {'0': 3}
69 {'0': 3}
74 {'0': 3}
76 {'0': 3}
77 {'0': 3}
82 {'0': 3}
84 {'0': 3}
85 {'0': 3}
86 {'\x00': 3}

This blog post appears to know more about it:

[...] on 2014-11-13, Facebook introduced a new tracking code. It appears as an IPTC Special Instructions metadata field. They look like:

Special Instructions: FBMD01000ac60300004a1d00002d4b000067580000c9650000d5fc000054350100953a0100d3420100e84b01005f8f0100

Special Instructions: FBMD23000969010000b1590000cb7700000a8600000c07010046820100b8c0010052590200e5c902006e440300

I think that "FBMD" stands for "Facebook Member Data" (but I could be wrong).

I've manged to decode one interesting aspect in these strings: the length. Each string starts with "FBMD", two hex characters (1 bytes), and a 16-byte (4-character) length. Then comes length+1 sets of 32-bit (8-byte) values.

FBMD01 000a = length 10, so expect 11 fields: c6030000 4a1d0000 2d4b0000 67580000 c9650000 d5fc0000 54350100 953a0100 d3420100 e84b0100 5f8f0100

FBMD23 0009 = length 9, so expect 10 fields: 69010000 b1590000 cb770000 0a860000 0c070100 46820100 b8c00100 52590200 e5c90200 6e440300

I've asked the Facebook community about it.

Cavalryman

I bet it's FaceBook MetaData rather than Member Data. – Sulphonate

Answer 2

Well looks like someone is watching.

I have found this at first, there is link to this stack post

Citing from above:

"Upload picture and Facebook tags it with a secretly embedded tag: A008E8E97FA55

Friend “A” on Facebook downloads it.

Friend “A” texts it to another friend – someone you don’t know, their friend Friend “B”, and another friend of theirs Friend “C.”

Friend “B” isn’t on Facebook, or maybe they mostly just post to Reddit.

Friend “B” posts to Reddit. Facebook sees this (by scouring Reddit systematically, the way search engines scour the entire ‘web’ in general). After seeing this a few times, quickly repeated, Facebook now knows you are somewhat close to Friend “B.”

So now Facebook knows who another of your “Friend of a Friend” connections are – a person you don’t even know about yourself!

Repeat this activity on a large scale, and now Facebook knows your Facebook friends, Facebook followers, and your real-world friends, co-workers, and associations. They even know your “friends of friends” (people you don’t know) and their buying and lifestyle details, and yours, and how your friendship circles fit together, even outside of facebook."

Some more stuff on Twitter

Lubber

Not just Facebook, but their advertisers and anyone else watching reposts on other sites. – Sulphonate