What Does EXIF Data Reveal in a Photo?

A photo file holds more than pixels. Unless location is switched off, a typical phone photo also records where you stood (GPS coordinates), when you pressed the shutter (to the second, with a time zone), and which phone and lens took it. That block of data is called EXIF, and it travels with the file whenever you send the original.

What an EXIF block actually contains

EXIF is a standard from the Japanese camera industry (JEITA and CIPA, specification DC-008) that defines tags a camera writes into JPEG and HEIC files. We wrote a set of realistic values into a 400 px test file and read them back with a metadata parser. The coordinates are a famous landmark's, not a real home, but the field names and formats are what a phone writes.

The three groups matter for different reasons.

Where. GPS latitude and longitude are stored as degrees, minutes and seconds, usually with fractions of a second. One arcsecond of latitude is about 31 meters on the ground (111 km per degree divided by 3,600), so even whole seconds place you within a house or two, and a phone that writes fractions of a second narrows it further. Altitude and compass direction come along, which can tell someone which floor you were on and which way you were facing.

When. DateTimeOriginal is the shutter time on the device's clock. OffsetTimeOriginal adds the UTC offset, so the time zone is readable. A folder of photos from one week gives someone a rough timetable: when you leave home, when you reach the office, when you are away.

What took it. Make, model and operating system version identify the device. Lens model and exposure settings are harmless on their own, but a consistent model and lens across many photos link them to the same camera.

Some other fields are less obvious. The orientation tag records how the phone was held, and browsers and apps use it to turn the picture upright. Some cameras add a serial number or an owner name, and editing software writes its own name and version into the Software field.

Why this matters more than it seems

Taken alone, one tag is rarely a problem. The risk is combination: a precise location, a time and a device in a photo of your front door, your child's school bag or a parked car. Anyone who receives the original file can read all of it in a few seconds with a free viewer. Nothing needs hacking; the data is in the file.

EXIF is also easy to forge. Any tool can edit or delete a field, so a timestamp is a clue, not proof, and a device clock set wrong writes the wrong time. Treat it as information the photographer's device supplied, nothing more.

Which sites strip it, and which don't

We looked for official statements from Instagram, Facebook, X and WhatsApp on whether they remove metadata from uploads, and did not find a current one on a help page. Third-party guides say the big social networks remove location from the copy other people see, while sending a photo as a file, by email or as a "document" in a messaging app often keeps everything. They also disagree on whether the platform itself keeps the data it received.

Since that can't be checked from the outside, the safe rule is to remove location from the file before it leaves your device, and not to rely on the destination. That is also the reasoning in what happens to photos you upload, where the question is retention rather than metadata.

Check what a photo carries

On an iPhone, open the photo in Photos and swipe up (or tap the info button) to see the date, the device and a map when location exists. On a Mac, choose a photo and press Command+I in Preview, then open the Exif and GPS tabs. On Windows, right-click the file, choose Properties and open the Details tab, where GPS and camera fields are listed. Android's gallery apps show date, device and sometimes a map in the same way, though the menu names differ by maker.

For a full list rather than the friendly summary, use a viewer that prints raw tags, such as the free command-line tool ExifTool (exiftool photo.jpg). The summary views hide fields like the UTC offset and the software version.

Remove location on each platform

iPhone. To share without location, select the photo, open the Share sheet, tap Options and turn Location off. Apple documents this in its Personal Safety guide. To change the stored photo instead, open it, choose Adjust, then Adjust Location, then No Location. The share toggle covers one share, so you repeat it each time, and the camera's own Location Services setting is what stops new photos being tagged.

Android. Turn off location tags in the camera app's settings so new photos carry none. Removing GPS from photos you already have depends on the gallery app: some offer a remove-location action, and some don't. When yours doesn't, a metadata-removal app or a desktop tool is the dependable route.

Windows. Right-click the photo, open Properties, then Details, and choose Remove Properties and Personal Information at the bottom. You can save a copy with everything removable stripped, or pick only the GPS fields. Making a copy is better than editing the original, because you keep the tagged file for your own records.

Mac. In Photos, select the images and choose Image, then Location, then Hide Location, which Apple also covers in the guide above.

Any computer. exiftool -gps:all= photo.jpg removes the GPS group and leaves camera and time data; exiftool -all= photo.jpg removes nearly everything. One side effect: removing every tag also removes orientation, so some photos then show sideways. Keep that one tag (-all= -tagsfromfile @ -orientation), or rotate the photo first.

Strip first, then check the result

Whatever you use, open the saved file the same way you opened the original and look for the GPS group. A viewer that shows no GPS and no map means the location is gone. This also works for anything you export from another app, including an edited or enlarged copy: the metadata of the output file is separate from the metadata of the input, and the only way to know is to look.

If you plan to enlarge a private photo, do it with a tool where the photo never leaves your device, and see why on-device processing keeps files private for what that does and doesn't protect. Removing location data from the output before you post it is still your job.