Public Profile SEO & OpenGraph

Private profile pages that emit OpenGraph tags leak user identity to search crawlers and social preview scrapers, violating GDPR Art. 25 (data protection by design). A user who marks their profile private reasonably expects that og:title, og:image, and og:description do not appear in Google's index or in link previews shared by third parties. Simultaneously, public profiles without OpenGraph metadata miss every social share amplification opportunity — both failure modes live in the same generateMetadata function.

In app/users/[id]/page.tsx, return robots: 'noindex' from generateMetadata whenever the profile is private or the viewer is unauthorized. For public profiles, populate the full OpenGraph object.

// app/users/[id]/page.tsx
export async function generateMetadata({ params }: { params: { id: string } }) {
  const user = await getUserProfile(params.id)

  if (!user || user.is_private) {
    return { robots: { index: false, follow: false } }
  }

  return {
    title: `${user.name} — YourApp`,
    description: user.bio ?? `See ${user.name}'s profile on YourApp`,
    openGraph: {
      title: user.name,
      description: user.bio ?? '',
      images: user.avatar ? [{ url: user.avatar, width: 400, height: 400 }] : [],
      type: 'profile'
    }
  }
}