Strip Location From Both Halves of an iOS Live Photo Before Upload

A helpful comment on my EXIF test suggested using a metadata scrubber. That is useful for ordinary still images, but a mobile upload contract must define every asset it sends. An iOS Live Photo can include both a photo resource and a paired video resource.

The failure case is simple: the JPEG derivative has no GPS EXIF, while metadata or an original file associated with the paired video survives in the upload or retry path.

Build the resource inventory first:

let resources = PHAssetResource.assetResources(for: asset)
for resource in resources {
    print(resource.type, resource.originalFilename)
}

Then make privacy assertions per output, not per UI selection:

Artifact	Required check
still derivative	no EXIF GPS/location fields
paired video derivative	no location metadata
upload manifest	only derived filenames
retry queue	no path to original resources
temporary directory	deleted after success or cancellation

My lifecycle test would start an upload, force the app into the background after the still image is prepared, kill it while the paired video is processing, and relaunch. Recovery must either regenerate both safe derivatives or delete the incomplete pair. It must never mix a scrubbed still with an original video.

Apple’s PHAssetResource API exposes the resources associated with a Photos asset. That enumeration should become evidence in the test: fail when an unexpected resource type is present rather than silently uploading it.

Also verify what reaches the server. Device-side inspection alone misses multipart manifests, queued originals, and server-generated previews. Download the stored pair in a test environment and run the same metadata assertions again.

A “remove location” button needs a precise scope. For Live Photos, the user reasonably expects it to cover the complete paired asset and every retry copy—not just the JPEG they can see.