Every week, organisations and individuals send PDFs containing information they never intended to share. Not because they were hacked — but because PDFs are deceptively complex containers that carry far more data than the visible pages suggest. Metadata, revision history, embedded objects, and improperly applied redactions can all expose sensitive content to anyone with the right tool and two minutes of curiosity. The good news is that each of these leaks is entirely preventable once you know where to look. This article walks through the five most common ways private data escapes in PDFs, drawn from real-world incidents involving government documents, legal filings, and corporate contracts, and explains the specific steps to close each gap. None of the fixes require expensive software. Most can be done in any capable PDF editor — and several can be done directly in your browser with a tool like PDFTheGuide.

1. Hidden metadata that reveals authors, revision history, and software

Every PDF produced by a word processor or authoring tool embeds a metadata dictionary. This dictionary routinely includes the author's full name, their organisation's name as registered with the software licence, the date the document was first created, the date it was last modified, the software that created it, and sometimes the computer username of the person who exported it. This metadata is invisible when you read the document — but it is trivially readable by anyone who opens the PDF in a tool like ExifTool or Adobe Acrobat's File › Properties panel. A company sending a contract might inadvertently expose the name of the lawyer who drafted it, the software version in use, and when the document was first created (which may differ meaningfully from the date printed on the page). The 2003 Iraq dossier incident is the canonical example: the UK government published a PDF that, when examined with basic tools, revealed the names of the four individual civil servants who had edited it — embarrassing the government and undermining the document's claimed independence. How to fix it: Before distributing any PDF, strip the metadata. In Adobe Acrobat, use File › Properties › Description and clear the fields, or use the Sanitize Document tool (Acrobat Pro). With ExifTool on the command line: exiftool -all= document.pdf. After stripping, verify the output with a second read to confirm the fields are blank.

2. Redaction done with highlighter instead of true redaction

This is perhaps the most dangerous mistake because it looks correct at first glance. Someone opens a PDF, selects text, and applies a black highlight or draws a black rectangle over it — the text appears hidden on screen. But in most tools that work this way, the original text is still present in the PDF's content stream; only a black shape has been drawn on top of it. Any reader can remove the black overlay in seconds: select it with an editing tool and press Delete, or simply copy-paste the text from the PDF (some viewers allow text selection through overlapping shapes). The 2005 case of the inadvertent exposure of an Associated Press reporter's confidential source in a Department of Justice PDF is the most cited example, but the same mistake appears in legal filings every year. True redaction works differently. It permanently removes the underlying content — deleting the text from the content stream and replacing it with a filled rectangle in the same operation, so there is nothing left to recover. The PDF/A-1a standard and PDF 2.0 both define redaction annotations (/Redact subtype) specifically to handle this workflow correctly. How to fix it: Use a tool with true redaction capability — one that explicitly removes the underlying content, not just covers it. PDFTheGuide's redaction tool permanently removes content from the PDF structure. If you need to cover content without permanent removal, use the whiteout tool knowing it is a visual-only cover. For archived or legally sensitive documents, always use true redaction and verify by selecting text over the redacted area after download — if nothing is selectable, the content is gone.

3. Embedded form data left in the file after printing to PDF

Interactive PDF forms — AcroForms — store field values in a separate data structure within the PDF. When someone fills a form and then "prints to PDF" (rather than saving properly), depending on the tool, the resulting PDF may flatten the visual appearance of the fields but still contain the original interactive field dictionaries — and their values. More subtly, a form PDF that was opened, partially filled with test data, and then shared might carry those test values in the field dictionaries even if the printed version shows blank fields. This has caused the accidental disclosure of pre-filled personal data — tax identification numbers, home addresses, dates of birth — in template PDFs distributed by organisations for others to fill out. How to fix it: When distributing a template PDF, open it in a PDF editor and explicitly clear all field values before sharing. Better still, if the form is intended as a blank template and recipients will fill their own copies, flatten the form (merge the blank field appearances into the page as static content) so the file no longer contains interactive field infrastructure at all. PDFTheGuide's form tool downloads PDFs with values embedded in the page — there are no residual field dictionaries to inspect.

4. Attached files and embedded objects inside the PDF container

The PDF format supports file attachments — arbitrary binary files embedded directly inside the PDF container. A Word document, a spreadsheet, a JPEG, or another PDF can be attached to a PDF and is invisible to anyone who only reads the pages. This capability is used legitimately in PDF/A-3 (which allows XML invoices to be attached to human-readable PDFs), but it also means that a PDF may carry sensitive supporting documents that were attached during authoring and never removed. Less obviously, some PDF creation workflows embed the original source file as an attachment. A PDF exported from InDesign, for instance, may contain the original .indd file as an embedded attachment if the export settings include "embed InDesign file." That source file may contain layers, edit history, and content that was removed from the final layout. How to fix it: Before distributing any PDF, check for attachments. In Adobe Acrobat, open the Attachments panel (View › Show/Hide › Navigation Panes › Attachments). Remove any attachments not intended for the recipient. For PDFs produced by design or publishing software, review the export settings and disable any option to embed the source document.

5. Invisible text layers in scanned PDFs after OCR

When a scanned PDF is processed with OCR (Optical Character Recognition), the software adds a hidden text layer beneath the page images. This is the intended behaviour — it makes the document searchable. But if the scan included pages that were not meant to be included (a sticky note, a handwritten annotation, a cover sheet with personal details), the OCR layer captures and embeds that text in machine-readable form even though it may be visually obscured. More concretely: a photocopier that scans a multi-page physical document may pick up content from the previous user's session if the platen glass was not cleared. Post-OCR, that stray content becomes searchable text in your PDF without appearing on the visible pages. Similarly, handwritten notes on physical documents that were scanned as "background noise" may be correctly transcribed by OCR and become extractable text. How to fix it: After OCR, review the text layer. Use a PDF editor to verify that the selectable text matches only the content you intend to share. For pages where OCR has captured unintended content, use true redaction on those sections (which removes both the image pixels and any text layer at the same coordinates) or re-scan only the pages you need. When using OCR services, choose tools that let you preview and edit the text layer before finalising the document.
PDF data leaks are almost always preventable — they stem from misunderstanding how the format stores data, not from sophisticated attacks. The five vectors above (metadata, cosmetic redaction, form data, attachments, and OCR text layers) account for the vast majority of documented PDF disclosure incidents. Building a simple pre-distribution checklist takes five minutes and can prevent incidents that take years to recover from. At minimum: strip metadata, verify redactions by attempting to select text over them, clear form field values in templates, check for embedded attachments, and review OCR output before sharing scanned documents containing mixed content. The tools to do all of this are freely available — including right here at PDFTheGuide.