What Is EXIF Metadata?
EXIF (Exchangeable Image File Format) metadata is information a camera or phone writes inside each photo file. It typically records when the photo was taken, the device used, the camera settings and, if location is enabled, the GPS coordinates. Most people never see it. Anyone with simple software can read it.
The standard is maintained by the Japanese industry bodies JEITA and CIPA, and it is used across phones and cameras. Newer revisions exist. The privacy problem hasn’t changed.
What is in there
- Date and time of capture.
- The device make and model.
- Camera settings.
- GPS latitude and longitude, if the phone was allowed to record location.
Whether your phone writes the GPS fields depends on its location permission for the camera app. I’d test it: take a photo, run it through any metadata viewer, and look.
Why it matters
A photo posted from inside a home can carry the home’s coordinates. A photo of a child at a school can carry the school’s. The attacker doesn’t need to read the background of the picture. The file says where it was. That is the section of How Kidnappers Choose Their Targets headed “Meta-data Harvesting.”
How to stop it
- Stop recording it. On iPhone, Apple’s guide says to set Camera’s location access to Never under Location Services. On a Pixel, Google’s guide says to turn off “Save location” in the Camera settings. Other Android makers use different labels, such as location tags.
- Strip it when sharing. On iPhone, the Share sheet has an Options menu with a Location switch. Turn it off before sending.
- Scrub old photos. Photos you already took keep their metadata. Use software built to remove it before you distribute them.
Don’t rely on the platform
Some social apps strip EXIF from the public copy of a photo. I wouldn’t depend on it. The platform still received the original, messaging apps and cloud links often keep the metadata, and the behavior can change without notice. Strip it yourself.
A note on this site
The share image for this site, the one that appears when a link is pasted into a chat, was generated by a script that checks the file for metadata and fails if it finds any. It found none.