隐私设计 PDF 工具：七条原则怎么逐条核对 / Privacy by Design for PDF Tools: How to Check the Seven Principles

一句话结论 / Short answer

隐私设计（Privacy by Design）是 Ann Cavoukian 在 1990 年代提出的七原则框架，它至今仍是判断一个 PDF 工具最顺手的清单，原因很简单：它把「这家公司值不值得信任」换成七个当天就能验证的问题。PDF 合并正好是合适的测试对象，因为要合并的文件通常是合同、病历或报税材料，而工具要么拿走一份副本，要么不拿。这篇把每条原则翻成在真实工具上的样子，给出通过与不合格的对照表，最后附一套不用问供应商就能跑完的验证。

Privacy by Design is a framework of seven principles that Ann Cavoukian published in the 1990s, and it is still the handiest checklist for judging a PDF tool, for a simple reason: it turns a vague question about trust into seven things you can verify in an afternoon. A PDF merge makes a good test case, since the file is usually a contract, a medical record or a tax return, and the tool either takes a copy or it does not. This article translates each principle into what it looks like on a real tool, gives a table of pass and fail signals, and ends with a verification you can run without asking the vendor anything.

七条里有两条承担了大部分工作。第二条「隐私作为默认设置」决定用户什么都不改就能拿到什么；第三条「隐私嵌入设计」决定这个默认是架构事实还是一段政策文字。落到 PDF 工具上，两者的差别非常具体：本地合并的代码里没有上传分支，默认保护不是承诺而是缺项；需要上传的工具可以承诺 24 小时删除，而文件在这段时间里已经经过了 CDN、日志管线和备份。

Two of the seven carry most of the weight. Principle two, privacy as the default setting, decides what a user gets without changing anything. Principle three, privacy embedded into design, decides whether that default is a fact about the architecture or a paragraph in a policy. On a PDF tool the difference is concrete. A browser-local merge has no upload branch in the code, so the default protection is an absence rather than a promise. A tool that requires an upload can promise deletion within 24 hours while the file has already passed through a CDN, a logging pipeline and a backup.

说明：下面是给工具选型和内部制度用的核对口径，不是法律意见。具体义务以适用的法规和本单位法务的判断为准。

七条原则在 PDF 工具上长什么样 / The seven principles, on a PDF tool

原则本身是抽象的，判断价值全在第三列。第二列写得再漂亮，第三列出现其中任何一条，前两列就不用看了。

The principles are abstract on their own, and the third column is where the judgment lives. However good column two reads, any hit in column three makes the first two irrelevant.

第一行和第四行最容易被一起忽略。供应商常把「我们从未发生过泄露」当作第一行的证据，但没出过事只说明运气或规模，不说明结构。第四行的问题更隐蔽：如果本地版少了挑页码或批量合并这类功能，用户就会被推回上传路径，隐私退化成一道收费门槛。

Rows one and four tend to be missed together. Vendors often offer the absence of past incidents as evidence for row one, but never having had a breach says something about luck or scale and nothing about structure. Row four is subtler: when the local version is missing page selection or batch merging, users get pushed back onto the upload path and privacy turns into a pricing tier.

第六行决定了这张表能不能被验证。一个不提供自测方法的工具，七条里的每一条都只能听它自己说，核对也就退化成阅读它的营销文案。

「默认」这个词约束什么 / What default actually constrains

默认指的是用户什么都不设置、什么都不勾选时，系统给出的那一份结果。它约束的不是能力上限，而是大多数真实用户最终拿到的东西，因为绝大多数人不会去翻设置页。

Default means what the system delivers when the user sets nothing and ticks nothing. It constrains not the ceiling of what is possible but what most real users end up with, and most people never open the settings page.

第一行决定了后面几行的难度。文件从来没有离境，留存期限、删除记录、跨境传输这些条款就整段失效，第二行到第五行从要谈判的事项变成一句陈述。这一点和元数据那条线是分开的：元数据是本地工具也要处理的收尾步骤，写进默认项只是因为它同样该在导出前被提醒一次。

Row one sets the difficulty of everything below it. When a file never leaves the device, retention windows, deletion records and cross-border transfer clauses stop applying as a block, and rows two to five collapse from matters you negotiate into a single statement. That is separate from the metadata line, which every tool has to deal with at the end. It appears here only because it deserves the same reminder before export.

还要区分「默认」和「可选」。一个工具提供本地模式但默认走上传，它满足的是能力，不满足第二条原则。判断时看首次使用的路径，不看设置里有没有那个选项。

Default and optional are different things. A tool that offers a local mode but uploads by default satisfies capability and fails principle two. Judge it by the path a first-time user takes, not by whether the option exists somewhere in the settings.

当天能跑完的核对表 / A check you can finish today

把下面七步固定成一次流程，最后那页记录可以直接进供应商清单和内部制度档案。前三步判定结构，第四步判定取舍，后三步判定证据。

Fix these seven steps once and the last page becomes the record that goes into the vendor list and the internal policy file. The first three judge structure, the fourth judges trade-offs, and the last three judge evidence.

1. 确认上传路径：断网状态下跑一次完整合并，能跑完就说明核心功能不依赖服务端
2. 确认默认设置：用一个全新的浏览器配置打开，全程不改任何选项，记录实际发生的行为
3. 确认留存条款：在隐私政策里搜保留期限、日志、备份、第三方四个词，看有没有明确写出天数
4. 确认功能对等：挑页码、调页序、批量处理在本地版是否齐全，缺一项就记一项
5. 确认元数据行为：导出前后对比文档信息字典，看工具名与处理时间是否被写入
6. 确认可验证性：有没有给出自测方法，没有就把这一步的验证动作写进自己的文档
7. 把以上六条连同工具名、版本、核对日期和核对人签在同一页纸上归档

1. Settle the upload path: run one full merge with the network off, and if it completes, the core function does not depend on a server
2. Settle the defaults: open the tool in a clean browser profile, change no setting at all, and record what actually happens
3. Settle retention: search the privacy policy for retention, logs, backups and third parties, and look for an actual number of days
4. Settle feature parity: check whether page selection, reordering and batch processing exist in the local version, and log each gap
5. Settle metadata behaviour: compare the document information dictionary before and after export to see whether a tool name or timestamp was written in
6. Settle verifiability: if no self-test method is published, write the verification step into your own document
7. Sign all six items with tool name, version, date and reviewer on one page, then file it

合并这一步在 pdfmergenext.shop 全程本地完成，挑页码和调页序都不需要交出文件，默认项那一栏因此直接空着。挑页语法见 /blog/pdf-page-selection-1-3-5-syntax，元数据各层的实际表现见 /blog/pdf-metadata-preservation-merge，分享前该清哪些字段见 /blog/strip-pdf-metadata-before-sharing。

Merging on pdfmergenext.shop happens entirely on your device, so selecting pages and reordering never means handing the file over, which leaves the default column blank. Page selection syntax is in /blog/pdf-page-selection-1-3-5-syntax, how each metadata layer behaves in /blog/pdf-metadata-preservation-merge, and which fields to clear before sharing in /blog/strip-pdf-metadata-before-sharing.

五分钟自己验证 / Verify it yourself in five minutes

下面四步不需要账号、不需要联系销售，也不需要读完整份隐私政策。做完这四步，前六条原则基本都有结论了，剩下的只有条款层面的核对。

None of the four steps below needs an account, a conversation with sales, or a full read of the privacy policy. After them, six of the seven principles have an answer, and only the contractual part is left.

• 断网跑一次：拔掉网线或开飞行模式，再合并一次。仍然能出结果，说明处理在本机完成
• 看 Network 面板：合并期间筛选请求，观察有没有指向外部域名的上传请求和文件大小
• 导出前后比元数据：用任意 PDF 阅读器看文档属性，工具名、公司、处理时间是否被写入
• 换一个干净浏览器配置：不登录、不改设置，走一遍首次使用的路径，记录默认行为

• Run it offline: unplug the network or switch on airplane mode, then merge again. A result means the processing happened on the device
• Watch the Network panel: filter requests during the merge and look for uploads to an external domain, along with their size
• Compare metadata before and after export: open document properties in any PDF reader and see whether a tool name, company or timestamp was added
• Use a clean browser profile: no sign-in, no setting changes, walk the first-time path once and write down the default behaviour

第一步的判据最硬，因为它不依赖任何说明。第二步的逐项操作见 /blog/devtools-network-tab-privacy-guide，本地方案的能力边界见 /blog/offline-pdf-merge-limits，服务端架构的差别见 /blog/client-side-vs-server-side-pdf-tools。

Step one is the hardest evidence, because it depends on no statement at all. The step-by-step version of step two is in /blog/devtools-network-tab-privacy-guide, the limits of the local route in /blog/offline-pdf-merge-limits, and the architectural difference in /blog/client-side-vs-server-side-pdf-tools.

我们的评估口径见 我们怎么评估隐私优先的 PDF 工具，零上传的实现方式见 零上传 PDF 工具是怎么做到的，全部文章在 /blog。