EXIF Data and Privacy: What Your Photos Reveal About You

Last year, a journalist friend showed me something that made me rethink how I share photos online. She pulled up a real estate listing photo, ran it through an EXIF reader, and extracted the exact GPS coordinates, the agent’s phone model, the date and time the photo was taken, and even the direction the camera was facing. All from a single JPEG.

The listing agent had no idea this data was embedded. Neither do most people.

What Is EXIF Data?

EXIF stands for Exchangeable Image File Format. It’s a metadata standard that digital cameras and smartphones automatically embed in every photo they take. Think of it as a detailed log entry that travels invisibly inside the image file.

Here’s what a typical iPhone photo contains:

Camera: Apple iPhone 15 Pro
Lens: iPhone 15 Pro back camera 6.765mm f/1.78
Focal Length: 6.77mm (24mm equivalent)
Aperture: f/1.78
Shutter Speed: 1/120s
ISO: 50
Flash: Did not fire
Date: 2026-03-15 14:23:07
GPS: 41.0082° N, 28.9784° E
Altitude: 42.3m
Software: 17.3.1

That GPS coordinate? It pinpoints the exact location to within a few meters. The timestamp tells exactly when you were there. The device info uniquely identifies your phone model.

Why This Matters

Your Home Address

Photos taken at home contain GPS coordinates that reveal where you live. Post one on a forum or personal website, and anyone who knows how to read EXIF data (it’s not hard) has your home address.

Your Daily Routine

A series of photos with timestamps and GPS data maps out your daily routine. Morning coffee spot, office location, gym after work, home in the evening. People have been stalked using exactly this kind of metadata trail.

Device Fingerprinting

Camera serial numbers and unique device identifiers can link photos across different platforms. Even if you use different usernames, the same camera serial number appears in every photo taken with that device.

Sensitive Locations

Photos taken at hospitals, legal offices, political gatherings, or religious institutions reveal information that many people would prefer to keep private.

What Strips EXIF Data (and What Doesn’t)

This is the part that surprised me:

Platforms That Strip EXIF

Facebook — strips all EXIF on upload
Instagram — strips all EXIF on upload
Twitter/X — strips all EXIF on upload
WhatsApp — strips EXIF when sending images
Signal — strips EXIF by default
iMessage — partial stripping (keeps some metadata)

Platforms That Preserve EXIF

Email attachments — full EXIF preserved
Google Drive / Dropbox shared links — full EXIF preserved
Personal websites — full EXIF preserved unless you strip it
WordPress uploads — full EXIF preserved by default
Flickr — preserves EXIF (displayed publicly)
Google Photos shared links — may preserve GPS data
Cloud storage direct links — full EXIF preserved

The gap between these two categories is where privacy problems happen. People assume all platforms work like Instagram. They don’t.

How to Check Your Photos

Before sharing any image outside of EXIF-stripping platforms, check what’s embedded:

Open the EXIF Metadata Viewer
Drop your photo on it
Check the GPS Location tab — if it shows coordinates, your location is embedded
Check the Camera & Lens tab for device identification data
Check timestamps for date/time information

The viewer runs entirely in your browser — the photo doesn’t get uploaded anywhere, which is the whole point when you’re checking for sensitive data.

Check any photo instantly: The EXIF Metadata Viewer extracts all EXIF, IPTC, and XMP metadata directly in your browser. GPS data is shown with a Google Maps link so you can see exactly what location is embedded.

Real-World EXIF Incidents

These aren’t hypothetical risks. They’ve happened:

John McAfee (2012) — While on the run from authorities, a Vice magazine journalist interviewed McAfee and published a photo. The EXIF GPS data in the photo revealed McAfee’s exact location in Guatemala. He was arrested shortly after.

Military base exposure — Fitness tracking app Strava published a global heatmap of user activities. Soldiers exercising at secret military bases in Afghanistan and Syria were clearly visible because their phones were recording GPS-tagged activity data.

Real estate agent tracking — Research has shown that real estate listing photos often contain EXIF data that reveals the agent’s home address (from other photos on the same camera roll), work schedule, and device information.

The Orientation Tag Problem

There’s a technical reason developers should care about EXIF beyond privacy: the orientation tag.

When you hold your phone sideways and take a photo, the camera sensor always captures in the same physical orientation. Instead of rotating the actual pixel data, the phone writes an EXIF orientation tag (values 1-8) that tells image viewers how to rotate the display.

The problem? Some software reads this tag. Some doesn’t. This is why photos sometimes appear rotated on websites but look fine in a gallery app. The browser might ignore the EXIF orientation, showing the raw pixel data which is sideways.

CSS has image-orientation: from-image which tells the browser to respect the EXIF tag, and modern browsers do this by default. But if you’re processing images server-side or on a canvas, you need to read the orientation tag yourself and rotate accordingly.

The EXIF Viewer shows both the raw orientation tag value and a human-readable description (e.g., “Rotated 90° CW”) so you know exactly what rotation to apply.

What About IPTC and XMP?

EXIF isn’t the only metadata standard. Photos can also contain:

IPTC (International Press Telecommunications Council) — Editorial metadata used by news agencies and stock photo services: headline, caption, keywords, photographer credit, copyright notice.

XMP (Extensible Metadata Platform) — Adobe’s metadata framework that can store virtually any key-value pair. Lightroom, Photoshop, and Bridge write extensive XMP data including editing history, keywords, ratings, and GPS data.

A single professional photo can contain all three — EXIF for camera data, IPTC for editorial info, and XMP for editing history. That’s a lot of information in what looks like a simple JPEG file.

For Photographers: EXIF as a Learning Tool

Privacy concerns aside, EXIF data is incredibly valuable for learning photography. Every photo I take is a lesson if I read the metadata:

“This sunset shot looks great — let me check what settings I used. f/8, 1/125s, ISO 200. I’ll use those as a starting point next time.”
“This indoor shot is grainy — ISO 6400, that explains it. Next time, bring a tripod and use a lower ISO.”
“The bokeh in this portrait is beautiful — f/1.8 on the 85mm. Good to know.”

The EXIF Viewer makes this instant: drop a photo, see the camera, lens, focal length, aperture, shutter speed, and ISO at a glance.

Practical Recommendations

Check before sharing — Use an EXIF viewer on any photo before uploading to a platform that doesn’t strip metadata (personal website, email, cloud storage)
Disable location in camera settings — If you don’t need GPS in your photos, turn it off. iPhone: Settings → Privacy → Location Services → Camera → Never.
Be aware of timestamps — Even without GPS, timestamps reveal when you were where (especially combined with location context from the image content itself)
Use EXIF-stripping platforms for sensitive shares — If you need to share a sensitive image, use a platform that strips metadata, or strip it yourself before sharing
For professional photographers — EXIF is your friend. Use it to track your settings, learn from your shots, and embed proper copyright information