Results at a glance
Three runs per tool, measured on 6 October 2026 between 22:59 and 23:04 UTC. Ranges cover all three runs.
| Tool | Test file sent | Third-party domains | Cookies set | Published deletion |
|---|---|---|---|---|
| iLovePDF | Yes, as soon as it was selected: 7,457-byte upload to api*.ilovepdf.com | 14 | 24 | Within 2 hours |
| Smallpdf | Yes, as soon as it was selected: 6,213 bytes to Smallpdf’s storage on Cloudflare R2 | 10 | 12 | After 1 hour (free tools) |
| PDF24 | Yes, as soon as it was selected: 6,410-byte upload to filetools*.pdf24.org | 6–135 | 10–274 | About 1 hour after processing |
| FreePDFKit | No | 0 | 0 | Nothing to delete: the file stays in the browser |
Deletion policies are the services’ own statements: iLovePDF security, Smallpdf Trust Center, PDF24 FAQ. We did not verify what happens on their servers.
What each tool did
iLovePDF
Selecting the file started a POST to /v1/upload on one of iLovePDF’s numbered API servers, 7,457 bytes: the 6,213-byte test file plus upload framing. Compression then ran on the server and the browser was sent to a download page. The page contacted 14 third-party domains, almost all advertising and measurement: Google (DoubleClick, AdSense, Analytics, Tag Manager), Criteo, OpenX, The Trade Desk (adsrvr.org), Opera’s ad network and Temu. 24 cookies were set, 13 of them by iLovePDF itself.
Smallpdf
Selecting the file uploaded it with a PUT to a Cloudflare R2 storage bucket named smallpdf-production-files, which is Smallpdf’s own storage on Cloudflare’s infrastructure. The upload happened while the compression options were still on screen, before Compress was clicked. The page contacted 10 third-party domains, including Microsoft Clarity and Hotjar (session analytics), Microsoft Bing, Google Analytics and Tag Manager, and TrackJS (error monitoring). 12 cookies were set, 4 by Smallpdf.
PDF24
Selecting the file sent it in a POST to client.php on one of PDF24’s numbered file servers, 6,410 bytes. In two runs the page contacted 6 third-party domains, all Google advertising and analytics, and set 10 cookies. In one run it ran a full programmatic advertising auction: 1,632 requests, 135 third-party domains and 274 cookies, almost all from ad exchanges and data brokers. PDF24 says on the page that the site is free thanks to advertising.
FreePDFKit
All 120 requests went to FreePDFKit’s own domain, and every one was a download (GET): the page, its scripts and fonts, and prefetched page data. None of them sent data. The file was compressed inside the browser tab and never left it. No third-party domain was contacted and no cookie was set.
Since 1 November 2026 FreePDFKit also counts page views with Google Analytics, so a repeat of this test would show requests to Google and, outside the EEA, the UK and Switzerland, its _ga cookies. The file still never leaves the browser; the privacy policy has the details.
What this does and does not show
- Uploading is not the same as being unsafe. Server-based tools need the file to process it. All three services publish encryption in transit and short deletion windows, and our iLovePDF, Smallpdf and PDF24 guides summarise their published safeguards.
- The upload starts before you confirm. On all three sites, choosing a file was enough for it to be sent. Changing your mind before pressing Compress does not undo the upload.
- Third parties see the visit, not the file. Advertising and analytics requests carry page and cookie data. None of them had a body anywhere near the size of the test file.
- It is a snapshot. Advertising differs by country, time and visit, and sites change. We tested logged-out visits from a single connection and did not answer cookie banners, so no consent was given.
- It measures the browser, not the server. We cannot see how long files are really kept, who can access them or how they are backed up.
Method
- Test file: a 3-page, 6,213-byte PDF of harmless text with the marker
FPK-AUDIT-7Q4Xand no personal data, generated by the script. - Browser: Playwright 1.63.0 driving Chromium 153 (headless), a fresh profile for every run, 1366 × 900 window, English (US).
- Steps: open each tool’s Compress PDF page and wait 5 seconds (load), choose the test file through the page’s own file input and wait 4 seconds (select), then click the site’s Compress button and wait for the result (run).
- File sent: a request whose body contains the marker, or whose size is the file’s size plus at most 2 KB of upload framing, measured from the browser’s
Content-Lengthheader. - Third party: any registrable domain other than the tool’s own, so a service’s own storage on another company’s infrastructure (Smallpdf on Cloudflare) counts as third party in the domain count.
- Runs: three per tool, in rotation. The runs made while the script was being built showed the same upload behaviour.
Reproduce it
Download the audit script and the raw data (every request from every run, without URL paths, which contain one-time IDs, and with hostnames that reveal the test location masked). With Node.js installed, run:
npm install playwright pdf-lib
npx playwright install chromium
node pdf-tool-privacy-audit.mjs all -run1It writes one JSON file per tool. To check a single tool by hand instead, follow the steps in how to check if a PDF tool uploads your file. We plan to repeat the audit every quarter.
People also ask
Common questions
Do iLovePDF, Smallpdf and PDF24 upload my PDF?
Yes. In every run of our test, each of them sent the test file to its own servers or storage. They all did so as soon as the file was selected, before the Compress button was clicked.
Is it safe to upload a PDF to these sites?
For everyday documents, these services publish reasonable safeguards: encrypted transfers and deletion within one to two hours. For contracts, IDs, medical or financial records, the safer choice is a tool that never receives the file, because a copy exists on someone else’s server until it is deleted.
Do advertisers receive my file?
Not in our test. Apart from the upload to each service’s own servers or storage, no request carried a body as large as the test file. Advertising and analytics services did receive ordinary page-visit data, such as the page address and cookies.
Why do the numbers for PDF24 vary so much?
In one of three runs, PDF24’s page ran a full advertising auction: 1,632 requests to 135 third-party domains and 274 cookies. In the other two it contacted 6 third-party domains and set 10 cookies. Advertising varies by visit, time and country.
Is this a fair comparison when FreePDFKit ran it?
FreePDFKit is one of the tools measured, so judge the method rather than our word: the script and the raw data are published, and anyone can run the same test.
How can I check a tool myself?
Open the browser’s developer tools, go to the Network tab, add a test file and watch for large outgoing requests. Our guide on checking whether a PDF tool uploads your file walks through it step by step.