GDPR-Safe Image URLs: What Not to Put in Query Parameters

What GDPR considers personal data

When image URL parameters become personal data

GDPR defines personal data as any information relating to an identified or identifiable natural person. A URL parameter like ?text=John+Smith is personal data if John Smith is a real user in your system. A URL parameter like ?text=400x300 is not personal data — it describes the image, not a person.

The risk is subtle. Developers building avatar placeholders often add the user's name or initials: https://fallback.pics/api/v1/avatar/80?text=JS for a user named John Smith. If this URL appears in CDN access logs retained for 90 days, and those logs are processed by a data processor without a DPA, you may have a GDPR violation.

The same applies to user IDs in URL paths: /api/v1/avatar/80?user_id=12345. Even if the URL doesn't contain a name, if user_id maps to an identifiable person in your database, the URL parameter constitutes personal data in the log.

Safe patterns

URL parameters that are safe to use in placeholder APIs

Category labels are safe: ?text=Product, ?text=Avatar, ?text=Preview. These describe content type, not a person. Dimensions and colors are safe: /400x300/7C3AED/FFFFFF. Role-based labels that don't identify individuals are safe: ?text=Admin, ?text=Team.

Initials are a grey area. AB could refer to a specific person (Alice Brown) or be entirely generic. If initials are derived from a real user's name, treat them as personal data. Use role-based or category-based text instead.

// Safe — no personal data in URL
https://fallback.pics/api/v1/avatar/80?text=AB           // generic initials
https://fallback.pics/api/v1/avatar/80?text=User         // role label
https://fallback.pics/api/v1/400x300/7C3AED/FFFFFF       // no text at all

// Avoid — may constitute personal data
https://fallback.pics/api/v1/avatar/80?text=John+Smith   // full name
https://fallback.pics/api/v1/avatar/80?text=j.smith      // username
https://fallback.pics/api/v1/avatar/80?user_id=12345     // not a real parameter, but demonstrates risk

Server logs

CDN and server log retention for URL-embedded data

Cloudflare logs image requests including the full URL with query parameters. If a Cloudflare worker serves your images, and the URL contains a user's name, that data sits in Cloudflare's log pipeline for your configured retention period. Cloudflare is a GDPR-compliant data processor with a standard DPA, but you're still responsible for minimizing data in logs.

Fallback.pics is a third-party service. Its access logs include the full request URL. Avoid embedding personal data in fallback.pics URLs just as you would avoid logging personal data to any third-party service.

// Pattern: generate a hash instead of embedding a name
// Instead of: /avatar/80?text=John+Smith
// Use: a deterministic color derived from user ID, no name in URL

function userColor(userId: number): string {
  const colors = ['7C3AED', '3B82F6', '10B981', 'F97316', 'EF4444'];
  return colors[userId % colors.length];
}

// URL contains user ID category color, not personal data
const avatarUrl = `https://fallback.pics/api/v1/avatar/80/${userColor(user.id)}/FFFFFF?text=U`;

Data minimization

Applying GDPR data minimization to image URL design

GDPR's data minimization principle (Article 5(1)(c)) requires processing only the personal data necessary for the specified purpose. An avatar placeholder's purpose is to show a visually distinct image — the user's name is not necessary for that purpose. A colored circle with a category label achieves the same UI goal without personal data in the URL.

Design your fallback URL generation to use the minimum information required: dimensions, brand colors, and a generic role label. Derive display information (colors, initials) client-side from stored profile data, but don't embed it in the image URL.

// Client-side: derive visual from profile, encode minimally in URL
function buildAvatarUrl(user: { id: number; role: string }): string {
  const colors = ['7C3AED', '3B82F6', '10B981', 'F97316'];
  const color = colors[user.id % colors.length];
  const label = encodeURIComponent(user.role.charAt(0).toUpperCase());
  // Role initial (A=Admin, U=User) — not personal data
  return `https://fallback.pics/api/v1/avatar/80/${color}/FFFFFF?text=${label}`;
}

Data subject rights

Right to erasure and URL-embedded personal data

If a user exercises their GDPR right to erasure (Article 17), you must delete their personal data from your systems. If their name or ID is embedded in a CDN-cached placeholder URL, you cannot easily purge that cached response. CDN cache invalidation by URL pattern is possible but requires knowing every URL that contains the user's data.

Keeping personal data out of image URLs entirely avoids this problem. A URL like /avatar/80/7C3AED/FFFFFF?text=U contains no data that maps to an individual and requires no special erasure handling.

Resources

Privacy guides and fallback.pics documentation

Review your use of placeholder image APIs against these guidelines before deploying to production for EU users.

// GDPR-safe fallback.pics patterns
https://fallback.pics/api/v1/avatar/80/7C3AED/FFFFFF?text=U    // role initial only
https://fallback.pics/api/v1/400x300/E5E7EB/71717A             // no text
https://fallback.pics/api/v1/400x300/7C3AED/FFFFFF?text=Photo  // category label

https://fallback.pics/docs/
https://fallback.pics/placeholder-image-api/
https://fallback.pics/blog/referrer-policy-placeholder-urls/
https://fallback.pics/blog/csp-img-src-placeholder-apis/