Before a photo goes on social media, into a complaint or across a group chat, there is often one face in it that does not belong to you to share.
People have published the exact thing they meant to hide by drawing over it in an editor that keeps layers, then saving a file that still contained the original underneath. Several phone editors work this way, and the covering can be lifted straight back off.
A safe tool flattens the picture as you paint. Each stroke reads the pixels that are actually there, replaces them with an obscured version, and writes that back, so by the time you save there is no separate layer to remove.
Be generous with the area. Faces are recognisable from the hairline, the jaw and the ears as much as the features, so a neat oval over the eyes and nose often leaves someone perfectly identifiable to anyone who knows them.
Raise the strength until no feature of the face is recognisable, not just until it looks soft. The default is a reasonable start, and for someone who must not be identified, push it to the top or use the solid block, which cannot be undone.
Cover the whole face and a little of the hair and neck, because people can be recognised from more than their eyes. Look at the saved picture at full size before you share it, and check that nothing nearby, such as a name tag, is still visible.
Not from the saved file. The pixels are replaced before the file is written, so the detail is not in there to recover.
Blur looks better on a face. Pixelate is worth choosing when you want it to be obvious that something was deliberately hidden.
No, that is a separate job. If the photo is going to strangers, remove the metadata as well.
Strong enough that no feature is recognisable. If there is any doubt, use the solid block, which replaces the area completely.