Talk to us
How it works / Phase 4 · Publish
Capabilities · URL Proxy

A class photo with one withdrawn parent. Twenty-three children stay in the picture.

The URL Proxy serves selected public images through a consent-aware endpoint. If a person withdraws consent, their face can blur on the next request — or the image can be taken down automatically, your choice. No file changes. No new CMS. Just the same link.

Fig. 01 · Same URL, two responses consent-aware
Direct from CMS · before
cms.example.dk/uploads/2019/class-3b.jpg
10 visible faces 0 consent records checked
Through the URL Proxy · after
img.ansikt.dk/uploads/2019/class-3b.jpg
8 consenting faces · visible 2 withdrawn · blurred by proxy
01 · How it works

A publish layer that checks current consent.

Serve selected image URLs through the proxy host. The proxy fetches from your origin, applies the current decision for matched faces, and returns the response you configured.

Fig. 02 · Request lifecycle
01 · request Browser asks for an image img src points at the proxy host. No JS. No cookies needed.
02 · origin Proxy fetches from origin Read-only. Your CMS, drive or S3 bucket, signed and authenticated.
03 · consent Lookup, per face Matched faces are checked against the current consent record. Withdrawn faces are marked for the configured response.
04 · serve Transform or refuse Blur, mask or block, depending on the configured mode for that source.
Note · the file at your origin is never modified · only the response varies
i.

Per-face, not per-photo.

A group photo can survive a withdrawal. Blur the one face that asked, not the whole image. Or take the image down automatically, your choice.

ii.

Source untouched.

Your CMS still keeps the original. If a decision changes, the next proxy response changes with it. Nothing is destructively edited.

iii.

Use the proxy link.

Ansikt gives you a proxy URL for the image you want to publish. Use that link where consent should be enforced. Images served outside the proxy stay outside enforcement.

02 · Modes

How a withdrawn face renders, your call.

A setting for the source or image type. Default is "blur" — keep the photo, hide the face. Switch to "refuse" for images where the rest of the photo does not make sense without the primary subject.

Mode A · default

Blur the face, keep the picture.

The face is blurred where it appears in the photo. The rest — composition, context, the people who consented — stays as the photographer took it.

GET /uploads/2019/class-3b.jpg
→ 200 OK · withdrawn faces blurred
Mode B · opt-in

Refuse the photo when a primary subject withdraws.

Some images are "about" one person — a portrait, a press photo, an event headshot. When that subject withdraws, the proxy returns the response you configured: a 410 Gone, a 404, or a placeholder image.

GET /press/headshot-2024.jpg
→ 410 Gone · primary subject withdrawn
03 · How it sits in the request path

An ethical layer that stays out of the way.

A consent-aware image layer should be boring to operate. It reads from your origin, checks the current decision, and returns the allowed response.

EU-hosted EU providers Production infrastructure runs in the EU, on EU providers.
Live lookup Per request Each proxy request checks the current decision. Withdrawals apply on the next request.
Per-face Granular blur We modify only the faces that asked. The rest of the photo stays as it was.
Read-only Origin untouched The proxy never writes to your CMS, DAM or bucket.
04 · The honest fine print

What the URL Proxy doesn't do.

Out of scope · by design

The proxy enforces decisions only where traffic goes through it.

It doesn't enforce on images served direct from your origin, CMS or DAM — only images served through the proxy host. Origin-served takedowns are manual in the source system.
It doesn't crawl the public internet — only sources you connect.
It doesn't blur in real-time video; static images and frame stills only.
It doesn't replace your CMS access controls — it sits in front of them.
It doesn't decide who has withdrawn — that comes from the consent record.
It doesn't modify EXIF, captions or alt text. Your DAM is still your DAM.
It doesn't claim to be perfect — false negatives go to a review queue.
See consent management All capabilities
Part of a loop

The proxy enforces consent at serve time for images routed through it. When something changes after publication — a withdrawal, an access request, an expiry or a removal — Operate closes the loop: find the affected images, choose the action, and export the audit trail.