Before a photo goes on social media, into a complaint or across a group chat, there is often one face in it that does not belong to you to share.
People have published the exact thing they meant to hide by drawing over it in an editor that keeps layers, then saving a file that still contained the original underneath. Several phone editors work this way, and the covering can be lifted straight back off.
A safe tool flattens the picture as you paint. Each stroke reads the pixels that are actually there, replaces them with an obscured version, and writes that back, so by the time you save there is no separate layer to remove.
Be generous with the area. Faces are recognisable from the hairline, the jaw and the ears as much as the features, so a neat oval over the eyes and nose often leaves someone perfectly identifiable to anyone who knows them.
Not from the saved file. The pixels are replaced before the file is written, so the detail is not in there to recover.
Blur looks better on a face. Pixelate is worth choosing when you want it to be obvious that something was deliberately hidden.
No, that is a separate job. If the photo is going to strangers, remove the metadata as well.