Take a photo of your desk and send it to someone. You have shown them your desk. You may also have told them the coordinates of the building you are sitting in, the make, model and serial number of your phone, and the exact second you pressed the shutter.
None of that is in the picture. It is in a block of data attached to the file, written automatically, and it travels with the photo wherever it goes.
What EXIF is
EXIF — Exchangeable Image File Format — is a standard for storing information about a photograph inside the photograph. It was designed for photographers: recording the shutter speed, aperture and ISO of every shot is genuinely useful when you are learning what worked.
Then phones happened. A phone knows things a camera never did — where it is, what software it runs, who is signed into it — and the EXIF block had room for all of it.
A typical photo from a modern phone contains:
Why the location field is different
The other fields are mildly identifying. The GPS field is categorically different, because it is not information about your equipment. It is information about you, at a specific place, at a specific time.
Three ordinary situations where that matters:
Selling something online. You photograph a bicycle in your driveway and post it to a classifieds site. Anyone who downloads the image gets your address before they have sent a message.
Posting about your children. A photo taken at home, shared in a group, forwarded onwards. The coordinates go with it every time.
Working somewhere you would rather not name. A photo from a hotel, a clinic, a lawyer's office. The building is in the metadata even when it is not in the frame.
There is a well-known case from 2012: the fugitive John McAfee was located after a magazine published a photograph of him with the GPS data intact. The photographer had simply not thought about it. Almost nobody does.
Who actually sees it
Less than the scare stories suggest, and more than nothing.
Large social platforms usually strip EXIF. Facebook, Instagram, X and similar services re-encode uploaded images and discard the metadata. Not out of charity — it saves them storage — but the effect is real. A photo posted to Instagram generally does not carry your coordinates onward.
Almost everything else does not. Email attachments keep it. Messaging apps that offer to send “the original” keep it, and some keep it regardless. Classifieds sites, forums, file-sharing links, and any small site that stores what you uploaded — all keep it. Cloud drives keep it, and a shared link shares it.
So the honest summary is: you cannot know. It depends on the destination, and the destination can change its behaviour without telling you. The reliable move is to remove the data before it leaves your device rather than to hope the recipient discards it.
How to see what your own photos say
The abstraction disappears the moment you look at a real file of your own. There are three ways.
On Windows, right-click the file, choose Properties, then the Details tab. Scroll down: you will find the camera fields, and GPS latitude and longitude if they are set.
On a Mac, open the image in Preview, then Tools → Show Inspector, and select the EXIF and GPS tabs.
In your browser, the EXIF tool on this site reads the block and lists every field, marking the ones that identify you. It parses the file on your own device — uploading a photo to find out whether it is private would be a strange way to begin.
Try it on something taken outdoors with location services on. Most people are surprised by the precision.
Removing it
The most reliable method is also the simplest to explain: decode the image to pixels, and re-encode it. A pixel buffer holds colour values and nothing else, so anything that is not the picture cannot survive the round trip.
That is exactly what happens when an image passes through a canvas in a browser, which is why every image tool on this site removes EXIF as a side effect — resizing, cropping, compressing or converting a photo all produce a file with no metadata block. The dedicated tool exists so you can see what was there first, and so removal is a deliberate act rather than an accident.
Two smaller points worth knowing.
Orientation is special. Phones record “this image is rotated” as an EXIF tag instead of rotating the pixels. Strip the block naively and your photo turns sideways. Good tools apply the rotation to the pixels first, which is why a stripped photo from here stays upright.
Turning it off at the source is better than cleaning up. On iOS: Settings → Privacy & Security → Location Services → Camera → Never. On Android: open the camera app settings and disable location tags. You lose the ability to see your photos on a map, which some people value. That is the trade.
What removing metadata does not do
Stripping metadata buys less confidence than people take from it.
The picture is still the picture. A house number, a street sign, a distinctive view from a window, a reflection in a mirror — all still there. If the frame gives away the location, cropping the image is what removes it, because cropping an image genuinely discards the pixels outside the box.
Faces are identifying. Metadata removal has no bearing on that.
Sensor noise is a fingerprint. Every camera sensor has a unique pattern of imperfections that survives compression, and forensic techniques can match photos to a device from it. This is not a realistic worry for ordinary privacy. It is the reason to call metadata removal good hygiene and not anonymity.
A practical routine
Nothing here needs to become a project. For anything going onto the public internet, or to someone you do not know:
Check the photo once, so you know what your device actually writes. Strip the metadata. Look at what is visible in the frame and crop if it gives away more than you want. If it is going on a web page, resize it too — a 4000px photo displayed at 800px is wasting everyone's bandwidth.
After the first time, it takes about fifteen seconds. And the first time is worth doing simply to see what has been travelling with your photos all along.