What is geoprivacy? What does it mean for an observation to be obscured?

While all observations posted to iNaturalist are public, there are tools to restrict access to an observation’s geographic information. In this section, we’ll describe:

1. Who decides when information is restricted
2. The mechanics of how information is restricted
3. When restricted information is shared

First, there are two separate flavors of restricted geographic information: geoprivacy and taxon geoprivacy. For geoprivacy, the individual observer decides when information is restricted and when restricted information is shared. For example, a user might choose to add geoprivacy to an observation made in their backyard for personal privacy reasons and the iNaturalist platform will never share this information without explicit permission from the observer, which can take the form of affiliating with one of iNaturalist’s international network sites, trusting a project, or trusting other members of the community.

Alternatively, taxon geoprivacy is a process through which the iNaturalist platform automatically restricts geographic information associated with observations of taxa threatened by location disclosure and may share this information with the conservation community. For example, observations of certain orchids are automatically obscured because these species are sought after by poachers. For both geoprivacy and taxon geoprivacy the mechanics of how information is restricted is identical.

1. Who decides when information is restricted

Geoprivacy: When creating and updating your own observations there is a geoprivacy field which by default is set to "open". By changing this to "obscured" or "private" you can restrict public access to this information. Only the observer can alter the geoprivacy setting on their own observations.

Taxon geoprivacy: Taxa on iNaturalist can have multiple conservation statuses. A conservation status can be global or associated with a particular place. These conservation statuses help explain threats associated with a species. If the threats include pressures that are increased from location disclosure, the conservation status may include a geoprivacy setting of ‘obscured’ or in rare cases "private". This will automatically apply this geoprivacy setting to all observations of that taxon globally or in the place specified by the conservation status.

The iNaturalist community helps inform which taxa should have a taxon geoprivacy set by flagging taxa. iNaturalist curators and specific collaborating conservation organizations help respond to these flags, moderate discussions, and maintain taxon geoprivacy settings. The goal of these discussions is to reach a consensus that involves the iNaturalist community and informed external stakeholders such as department of natural resource professionals. If consensus cannot be reached, decisions are made by iNaturalist staff and iNaturalist network affiliates.

2. The mechanics of how information is restricted

Obscured: For obscured observations, the latitude and longitude are moved to private latitude and private longitude fields which are not publicly visible. The public positional accuracy is increased to the diagonal of a 0.2 x 0.2 degree cell (~500km2 at the equator or about the same size as the Isle of Man). Latitude and longitude are replaced with a random point within this cell.

Other information on an observation that may help reveal the true location such as Locality notes and date are also publicly replaced with coarser representations (e.g. "Yuba Ave, San Pablo CA, US" replaced with "California, US" and in some cases "June 21, 2021" replaced with "June 2021"). Geographic searches on most places use the publicly blurred latitude and longitude (searches on countries, states, and counties use the private latitude and longitude).

Private: No geographic information is shared publicly. Latitude, Longitude, and Locality Notes are completely hidden from the public (note that the timezone part of the date is still shown). Similarly, observations are ignored by all place-based observation searches (e.g. a private observation located in California would not be returned by a search of observations in California). The private setting should be used sparingly since the complete lack of geographic context makes it difficult or impossible for the community to identify observations or spot geographic data quality issues.

To tell whether you are seeing the true location or an obscured location pay attention to whether you are seeing a stemmed marker (indicating the true location) or a stemless marker (indicating an obscured location). To tell whether the observation is open, obscured or private (independent of what you may be seeing based on your permissions), pay attention to the icons pointed out by the orange arrows below.

Note on mechanics: iNaturalist’s approach to restricting geographic information isn’t perfect. There are ways that the precise location of obscured observations can be guessed. For example:

• Clues in the photos or description: Landmarks visible in an observation’s photo, text in its description, or inclusion in certain projects may reveal clues about the true location.
• Interpolating from nearby observations: If an obscured observation was made at a similar time to an open observation made by the same user, the true location of the obscured observation can be guessed. iNaturalist avoids displaying the exact date of obscured observations publicly but this information is still available in the API responses and nearby observations can be inferred by searches, the observation_id, or even just making guesses about a user’s behavior including the places they frequent. We are working on structural changes to make interpolating locations more difficult, but in the meantime we recommend not posting any open observations nearby in space and time to where your obscured observation was posted.
• Data breaches: While we do our best to protect iNaturalist against data breaches, we can not guarantee that data breaches will never occur.

If the true location of an obscured observation of extreme sensitivity can be guessed through means such as those described above, the observer should be contacted and persuaded to edit or delete the observation. In extremely rare cases, if the observer is unreachable and the nature of the sensitivity is extreme please contact iNaturalist staff who may intervene.

When restricted information is shared

Geoprivacy: If you set geoprivacy on your observations there are three ways the restricted location information can be shared with others:

• If you "trust" an individual
• If you "trust" a project
• If you join via or affiliate with an iNaturalist Network Node (e.g. iNaturalist Australia)

Taxon Geoprivacy: In addition to the above ways to share, iNaturalist occasionally responds to inquiries from conservation organizations and researchers with exports that include geographic information restricted due to taxon geoprivacy.