Deleted annotations are just made invisible. They're still in the PDF document.
- Add an annotation containing the text
foobar
and save. - Delete it and save.
- Find it in a text editor by searching for
f.o.o.b.a.r
orFreeText
.
This is a flaw with poppler because evince, okular, atril, and every other FOSS PDF reader that use poppler will have this serious privacy violation. No such issue if deleting a PDF with master pdf editor OR adobe acrobat DC. If the two mentioned PDF editors can remove an annotation without the annotation being left in the PDF document for anyone with vi to find, poppler can as well.