What is actually in there
EXIF — Exchangeable Image File Format — is a metadata standard embedded in JPEG, TIFF and HEIC files. PNG uses different metadata containers but can carry similar information. A typical smartphone photo contains a few dozen fields, of which these are the ones that matter for privacy:
- GPS coordinates: latitude and longitude, typically accurate to a few metres, plus altitude. This is the significant one.
- Timestamp: the exact date and time the shutter fired, usually with timezone.
- Device make and model: 'iPhone 16 Pro', 'Canon EOS R6'.
- Camera serial number: on many dedicated cameras, a unique identifier that links every photo you have ever taken with that body.
- Lens model and settings: aperture, shutter speed, ISO, focal length.
- Software: the app or editor that last wrote the file, including version.
- Orientation, colour profile and thumbnail: the embedded thumbnail is worth knowing about, because it is not always regenerated after an edit.
The stale thumbnail problem
That last item deserves its own paragraph, because it has caused real harm.
EXIF can embed a small thumbnail of the image. Some editing software updates the main image but leaves the original thumbnail in place. The result is a file that looks cropped or redacted at full size, but still contains a small copy of the unedited original inside its own metadata.
This has produced actual privacy failures — cropped photos where the uncropped version was recoverable from the thumbnail. Modern mainstream editors handle it correctly, but it is a good argument for stripping metadata after editing rather than trusting that the editor did the right thing.
Who strips metadata and who does not
The picture is better than it used to be, but it is inconsistent enough that you should not rely on it.
Most large social platforms strip EXIF on upload — Facebook, Instagram, X and LinkedIn all remove GPS data from images they serve publicly. This is not entirely altruistic: they parse the metadata first and keep it for themselves. The location is gone from the file other people download, not from the platform's records.
Messaging apps vary. WhatsApp and Signal strip metadata. Telegram strips it when sending as a photo, but not when sending as a file — which is exactly the option people choose when they want to preserve quality. iMessage and email attachments generally preserve everything.
The places metadata most reliably survives are the ones people think least about: files attached to emails, images uploaded to forums and small websites, listings on marketplace sites, cloud storage share links, and anything sent as a document rather than a photo.
The classifieds case is worth stating plainly. Photographing an item for sale inside your home, then posting it with GPS intact, publishes your home address to anyone who downloads the image. Some marketplace sites strip metadata; not all do.
How someone reads it
There is no technical barrier. On Windows, right-click a file, choose Properties, and open the Details tab. On macOS, open the image in Preview and press Command-I. Any of dozens of free web tools and command-line utilities will dump the full field list in a second.
This is worth internalising: metadata is not obscured or encoded. Anyone who receives your file can read every field in about five seconds, with no expertise and no special software.
When you want to keep it
Metadata is not purely a liability, and blanket stripping has costs.
For photographers, EXIF is how you learn: reviewing which aperture and shutter speed produced a result is most of the feedback loop. Copyright and authorship fields in IPTC metadata are how professional images assert ownership. Photo libraries use timestamps and GPS to build timelines and maps, and stripping them breaks that organisation.
The sensible policy is to keep metadata on your originals and strip it on the copies you share. Treat your library as private and the exported file as public.
How to remove it
The most reliable general-purpose approach is a dedicated tool that rewrites the file without the metadata blocks. Our EXIF remover does this in your browser — the photo is never uploaded, which matters more than usual here, since the whole point is that you are handling a file you consider sensitive.
Two things worth knowing. First, screenshots of images do strip metadata, because the screenshot is a new file — but they also lose resolution and quality, so this is a crude fallback rather than a technique. Second, some formats carry metadata in more than one container: a file can have EXIF, IPTC and XMP blocks holding overlapping information, and a tool that clears only EXIF may leave GPS coordinates in the XMP block. A tool that rewrites the image data wholesale avoids this class of problem.
On phones, both major platforms now let you strip location at share time — iOS through the Options menu in the share sheet, Android through a similar toggle in Google Photos. These handle the common case well.