Why you should strip EXIF data before posting a photo

A photo taken on a phone is not just pixels. It also carries a block of metadata — EXIF — that records the make and model of the camera, the lens, the exact date and time, the shutter speed and aperture, and, on most phones, the GPS coordinates of where you were standing. That data is written before you take the picture and it goes wherever the image goes.

This is not a fringe concern. It is why a photo you post of your home, your car, a school play or a document on your desk can be mapped and dated by anyone who downloads it. The EXIF viewer shows you exactly what your own photos contain; the EXIF stripper removes it in one click, in your browser.

What is actually in there

The GPS block is the headline item: latitude and longitude in decimal degrees, accurate to a few metres. Combined with a timestamp it can reconstruct a diary of your movements — which is exactly what happened in the 2012 vice-presidential photo scandal, where the EXIF on a family photo from a restaurant exposed the location of the vice president's residence.

Alongside location you get device identifiers (make, model, lens, serial number), capture parameters, orientation, thumbnails, and software tags naming the app that saved the file. Not all cameras write all of these. iPhones write GPS by default; Android varies by maker and by whether location services are on for the camera; screenshots and images from messaging apps usually have most of it stripped already.

Who can read it

Anything the image passes through can. That includes social platforms — although most major ones strip EXIF on upload as a matter of policy, with varying thoroughness — messaging apps, email clients, print kiosks, and any site that accepts an image upload without re-encoding it. Metadata also survives having an image resized or converted by a careless tool, which surprises people who assume the metadata went away with the original.

The gap between what people expect and what happens is the problem. Plenty of people assume posting to Instagram removes location data. For Instagram, it generally does. For a forum attachment, a classified ad, a dating profile, a marketplace listing, or your own website's uploads folder, it frequently does not.

What stripping does and does not remove

Stripping removes the metadata block. It does not remove information that is in the picture itself: if your reflection is in a window, if a document is visible, if your house number is on the door, or if a landmark identifies the location, none of that is EXIF and no tool can take it out. Crop out what is in frame.

For a genuine privacy habit, treat stripping as one step rather than the whole job. Check the frame, then strip the metadata. The image metadata viewer is also worth running on photos you took years ago, just to see what has been sitting in your library.

When to keep it instead

For your own archive, keep it. EXIF is how photo software groups a shoot by date, or sorts a camera roll by location, and that is genuinely useful. The export-to-the-world copy is where the strip belongs — a copy for upload, a copy to print, and the untouched original on your disk.

Striping is a per-file operation, so the practical habit is to strip at the moment you export for sharing rather than trying to remember which files in a 4,000-photo library are safe to post. Both tools run locally and work offline once loaded, so nothing is uploaded in the process. More on this in the image tools collection.