What your photos reveal about you

Every photograph your phone takes carries a block of data describing how, when and where it was taken. Most of it is harmless. Some of it is a precise record of where you were at a precise moment, attached to a file you are about to send to a stranger.

What EXIF actually stores

EXIF — Exchangeable Image File Format — is metadata embedded inside JPEG and most raw files. A typical phone photo carries:

• Date and time the shot was taken, usually to the second, often with the time zone.
• GPS coordinates — latitude, longitude and frequently altitude, accurate to a few metres.
• Device make and model, and on many cameras the serial number and lens serial number.
• Camera settings — aperture, shutter speed, ISO, focal length, flash, white balance.
• Orientation, which is why some photos appear rotated when metadata is stripped badly.
• Software used to edit it, and sometimes an edit history.
• A thumbnail — and this one surprises people, because on older software the embedded thumbnail was not always regenerated after a crop. There are documented cases of a cropped photo whose thumbnail still showed the original, uncropped image.

Some cameras and phones add more: shot count, which reveals how much a camera has been used, and on some models the owner's name if it was ever entered in the settings.

You can see all of it for any photo with the EXIF viewer, which reads the file in your browser without uploading it.

The location problem

This is the part that matters.

If location services are on for your camera app — the default on most phones — every photo records where it was taken to within a few metres. Photograph something at home and the file contains your home address in a form anyone can paste into a map.

The risk is rarely one photo. It is the pattern. A set of photos shared over months describes where someone lives, where they work, when they are away, which school their children attend and what time they arrive. None of that is inferred from the pictures; it is read directly from the numbers.

It is worth being specific about who is exposed. Anyone selling something online and photographing it at home. Anyone posting pictures of children. Anyone whose safety depends on an address not being known — which includes people fleeing domestic abuse, journalists and activists. For those groups this is not a theoretical concern.

Which platforms strip it, and which do not

Most large social platforms strip EXIF when they re-encode an upload. Facebook, Instagram, X and LinkedIn all do. That is genuinely protective — though note they strip it from the copy you see, having first read it themselves.

The gaps are where people get caught:

• Messaging apps sending "as a file" rather than as a photo. Sending an image as a document in WhatsApp, Telegram or Signal usually preserves the original bytes, metadata included. Sending it as a photo normally re-encodes and strips.
• Email attachments. Nothing is stripped. The file arrives exactly as it left.
• Cloud storage links — Drive, Dropbox, iCloud shared albums. These share the original file.
• Forums, marketplaces and small websites that store uploads as-is. Many classified-ad sites do.
• Your own website, unless your publishing tool strips metadata, and many do not.

Never assume a platform strips it. It costs nothing to check.

Cases where it mattered

In 2012 the fugitive John McAfee, then wanted for questioning in Belize, was located after journalists published a photograph taken on an iPhone. The GPS coordinates in the file placed him in Guatemala. The photo itself showed nothing identifying.

Vice, who published it, later removed the metadata — after it had been downloaded thousands of times. That is the recurring lesson: you cannot un-share a file, and you generally cannot tell how many copies exist.

The pattern repeats regularly in less prominent cases: people revealing home addresses in marketplace listings, and photographs of "anonymous" locations placed precisely within minutes.

How to check and remove it

Check first. Guessing is how mistakes happen. Drop a photo into the EXIF viewer and you will see exactly what it carries, including a map link if GPS is present. Nothing is uploaded — the file is read locally.

To remove it, the most reliable method is re-encoding, which is what the browser does when it redraws an image onto a canvas: the pixels are preserved and the metadata block is simply not carried over. Both the image resizer and the WebP converter do this as a side effect, so a photo that passes through either comes out clean. So does the image cropper.

Better still, stop it at the source. On iPhone, Settings → Privacy & Security → Location Services → Camera → Never. On Android, open the camera app's settings and turn off location tags. You lose the ability to sort photos on a map, which for many people is a fair trade.

Two related hazards worth a moment. If a photo shows a face or a document you did not intend to publish, the blur and pixelate tool handles it — though be aware that pixelation is reversible in some circumstances, so a solid block is safer than a light blur for anything genuinely sensitive. And if you want a visible date on a photo rather than a hidden one, the date stamp tool draws it into the pixels.

When you want to keep it

EXIF is not the enemy. It is genuinely useful and stripping it indiscriminately loses things worth having.

Photographers rely on settings data to learn what worked. Copyright and author fields — part of the related IPTC standard — assert ownership, and removing them from someone else's photo is a legal issue in several jurisdictions. Journalists and researchers use timestamps and coordinates as evidence of provenance, which matters more each year as synthetic images improve. And your own photo library uses dates and locations to organise itself; strip everything and you lose the map view and the chronology.

The sensible rule is not "always strip" but strip before sharing outside your control, keep the originals intact. Archive the untouched file; share a re-encoded copy. If you publish photographs professionally, remove GPS but keep the copyright field, and consider a visible watermark for anything you care about.

Pikkit has the rest of the photo tools, all running in your browser with nothing uploaded, and Images & Files collects them together.