nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How to prevent data export from hosted feature layer

DonMorrison1

I have a hosted feature layer and I want to prevent users from doing any kind of export or download. I thought unclicking the checkbox "Allow others to export to different formats" on the item's Settings tab would do the trick. It does remove the remove the "Export Data" option from the item's Overview tab, but it seems there are many other ways to export the data that are still enabled. For instance:

In ArcGIS Hub - search for the item -> Download Options
In ArcGIS Pro - add the item to a map, then right click -> Data -> Export Features

Is there any way to really lock down an ArcGIS Online hosted feature layer?

Find more posts tagged with

Content Management

Sharing and collaboration

Data and services

Accepted answers

jcarlson

If it's public with feature-level access, it can be downloaded. One way around it is to provide the service as a map image, but that can come with significant limitations on what you can actually do with the layer.

All comments

jcarlson

DonMorrison1

Thanks Josh. This article appears to confirm your comment. However, even the layer in the article that ESRI's PatrickHammons1 says is not downloadable is indeed exportable from ArcGIS Pro. I know that I've seen layers in ArcGIS Pro that have export disabled but I suspect that those came from ArcGIS Server REST services and not ArcGIS Online.

jcarlson

That setting, as far as I can tell, only refers to the AGOL / Portal "Export" button on the Item page. In a very real sense, any person who views the feature service on a web map is downloading parts of the data into their browser. A determined person could simply save the returned features to a file from their browser's cache. Or submit a query directly tot he REST endpoint. Or use any number of non-Esri tools / coding languages to simple scrape the service to the filetype of their choice.

We can do our best to make data slightly inconvenient to acquire, but fully preventing it can be hard. But not impossible! What I have seen other organizations do is present the data publicly as a map image with no data access. Little more than a non-interactive basemap, essentially. When their map was clicked, however, the coordinates were forwarded to a REST endpoint through some proxy (not my area of expertise, I may be mis-using terms), and the attribute information was piped into a popup from the intersection with that point. But the service itself was never directly exposed to the end user, and only attributes were returned. Even if you wanted to try intersecting a fishnet of points, all you'd have is attributes, no shapes.

I should mention, this setup appeared to rely heavily on third-party tools. I can't really speak to what goes into putting a setup like this together. But know that if providing public visibility to your data and simultaneously keeping it "locked down" is your aim, it's a problem I've seen others solve.

DonMorrison1

I think in our case, making it inconvenient would be good enough. For layers coming from the ArcGIS Server, I removed the 'Extract' capabilities. With this I no longer get the Data->Export option is ArcGIS Pro. As you point out, I could still write a Python program to query the layer and build a local copy of the data. I see no way to remove the "Download" button in Hub. The download request are going to https://opendata.arcgis.com which I'm not familiar with.....

Join the Conversation

Signed in members can post, follow updates, and more. New here? Register a free account.

Quick Links

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.