What Your Photos Secretly Reveal: EXIF Data and Privacy

A photo file is not just pixels. Alongside the image, cameras write a structured block of metadata called EXIF (Exchangeable Image File Format) — a few kilobytes of text describing when, how and often where the picture was taken. It is invisible in every normal photo viewer, which is precisely why most people have never thought about it. This guide covers what EXIF contains, when it leaks, and the reliable ways to strip it before a file leaves your hands.

What EXIF actually stores

Open the metadata of a typical phone photo and you will find:

• Date and time the photo was taken, to the second.
• Device make and model — "Apple iPhone 15 Pro", "Samsung SM-S928B".
• Camera settings — shutter speed, aperture, ISO, focal length, whether the flash fired.
• Software used to process or edit the file.
• GPS coordinates — on phones with location enabled, the latitude and longitude of the shot, often with altitude and compass direction too.

The GPS entry is the sensitive one. Phone coordinates are recorded with enough decimal precision to place you within a few metres: a pair like 48.8584° N, 2.2945° E does not say "Paris" — it says "at the foot of the Eiffel Tower". Paste any photo's coordinates into a map and you get a pin, not a neighbourhood.

The risk, stated plainly

No drama needed — the mechanics alone are worth understanding:

• A photo taken at home can embed your home address. Sell a sofa on a classifieds site with a photo shot in your living room, and if the platform does not strip metadata, the listing may carry your coordinates.
• Timestamps build patterns. A series of photos with dates, times and locations sketches your routine: where you are on weekday mornings, when the house is empty, where your children go to school.
• Metadata outlives the post. Once a file with EXIF is downloaded by someone else, deleting your post does not recall the data.

None of this requires a skilled attacker. Reading EXIF takes two clicks in any operating system, as you will see below.

Who strips EXIF for you — and who does not

Here is the part that trips people up: some channels remove metadata automatically, others pass the file through untouched.

The big social platforms — Facebook, Instagram and X — re-process every upload and strip EXIF from the copies they serve. Someone downloading your Instagram photo gets pixels, not coordinates. One honest caveat: the platform itself receives the original first, so the metadata exists on their servers even though the public never sees it.

Plenty of other channels do not strip anything, because they transfer your file as-is:

• Email attachments — the recipient gets your exact file, EXIF included.
• Messaging apps in "document" or "original file" mode — the compressed photo mode in WhatsApp strips metadata, but sending the same image as a document preserves it. Our guide to sending photos by email and messaging apps covers the difference in detail.
• Cloud links — a Google Drive, Dropbox or iCloud share link serves the original file.
• Forums and older websites — many small sites store uploads unmodified.
• Direct transfers — AirDrop, USB sticks, network shares: byte-for-byte copies.

Check before you share

A quick reference for the most common channels:

How to see what a photo is carrying

Before stripping anything, look at what is there. It takes seconds:

Windows

Right-click the file → Properties → Details tab. Camera model, capture date and — if present — GPS latitude and longitude are all listed. The link at the bottom, "Remove Properties and Personal Information", can create a metadata-free copy on the spot.

macOS

Open the photo in Preview → Tools → Show Inspector (Cmd+I). The info panel shows an EXIF tab with camera details, and a GPS tab with a map pin when coordinates are present — including a button to remove the location info.

On your phone

In iOS Photos or Google Photos, open a picture and swipe up (or tap the ⓘ info button). You will see the capture date, device, resolution and a small map if the photo is geotagged. If a map appears, the coordinates are in the file.

How to strip EXIF before sharing

1. Use your phone's share options

On iOS, when you share a photo, tap Options at the top of the share sheet and switch Location off — the copy that leaves your phone has no coordinates. Android's Google Photos offers a similar setting to remove geolocation from shared items. This is the lightest-touch fix: the original in your library keeps its data, only the shared copy is cleaned.

2. Re-encode through a canvas tool

Any tool that redraws an image onto a canvas and exports a new file — rather than copying the original — produces output with no EXIF from the source photo, because canvas re-encoding writes only pixels; metadata is simply not carried across. Our Image Resizer and Watermark App both work this way, entirely in your browser: the photo never leaves your device, and the exported file is a fresh one without the original's date, device or coordinates (JPEG, PNG or WebP from the Resizer; PNG from the Watermark App). Resizing for the web and stripping metadata in one step is a convenient pairing — smaller file, cleaner file.

3. Remove it in the operating system

Windows' "Remove Properties and Personal Information" dialog (see above) and Preview's location-removal button handle one-off files without any extra software.

4. Stop recording location in the first place

If you rarely want geotags, turn them off at the source. iOS: Settings → Privacy & Security → Location Services → Camera → Never. Android: open the Camera app's settings and disable Save location. Date, time and camera settings are still recorded — those are rarely the sensitive part.

What stripping EXIF does not do

An honest limit: removing metadata anonymises the file, not the image. The pixels themselves can still reveal your location and identity — a street sign, a distinctive building through the window, a reflection in a mirror, an addressed envelope on the desk, a school uniform. Treat EXIF removal as one layer of hygiene, and review the visible content with the same care. Our screenshot guide has a practical pre-share privacy checklist that applies equally to photos.

Also worth knowing: metadata is not always the enemy. Copyright fields can support an ownership claim, and for images you publish on your own site, capture data is harmless — image SEO is decided by filenames, alt text and page context, not EXIF. Strip deliberately, where the audience or channel calls for it.

The bottom line

Assume every photo from a phone carries the time and place it was taken. Big social platforms clean uploads for you; email, cloud links, document-mode sends and small websites do not. Check a file once so you know what it holds, use the share-sheet location toggle for quick cases, and route anything sensitive through a canvas-based tool so the exported file starts from zero. Then give the image itself a five-second look — the pixels can talk too.