Photo metadata and geotagging: what your pictures reveal about where you live

Every photo you take carries two things: the image itself, and a hidden layer of data that travels with it wherever it goes. That second layer, called metadata, can reveal where a photo was taken, when, and on which device, to anyone who receives the original file.

This isn't a fringe concern. The FBI has warned that location data embedded in photos can reveal where you are (FBI Portland). Understanding what's in your images, and how to control it, is a practical step you can take right now.

What is EXIF data, and what does it actually store?

EXIF stands for Exchangeable Image File Format. It's a technical standard first published in 1995 by the Japan Electronic Industries Development Association (JEIDA), whose work is now carried on by JEITA and CIPA. Most digital cameras and smartphones write EXIF data into the photos they take.

What's stored inside? Quite a lot:

• GPS coordinates: latitude, longitude, and often altitude, with accuracy that varies by device and conditions
• Date and time: the exact second the shutter fired, synced to your device's clock
• Device make and model: for example, "Apple / iPhone 15 Pro" or a specific Samsung model number (imgscrub)
• Camera settings: focal length, shutter speed, aperture, flash mode
• Software: the firmware version on your phone, or the editing app you used
• Author fields: in some workflows, the registered name of the person who edited the image

Most of this gets written automatically. GPS is the exception: it is recorded only if your camera app has access to your location, which your phone asks about the first time you use it. Once you grant that access, location is added to your photos until you turn it off.

Beyond EXIF, photos can also carry IPTC data (editorial info like captions and copyright) and XMP data (editing history written by apps like Lightroom or Photoshop). A single JPEG from your phone can contain dozens of discrete data fields, most of them invisible to anyone just looking at the picture. Pixeldefence

How metadata becomes a real-world threat

The GPS field is the most direct risk. A photo taken at home can give anyone with the original file a close fix on where you live. Cross that with a satellite map, and you have your house, your yard, your neighborhood.

Here are the main ways that data can be misused:

Stalking. If you send someone the original file, they can read its location with free tools such as ExifTool or the Preview app on a Mac. A stalker who receives an unedited photo taken at your home or workplace gets a street-level location without ever asking where you are. Major platforms are reported to clean the public copy of your photos (more on that below), so the bigger risk is usually files you send directly.

Doxxing. Photo metadata is a known way to work out where someone is. One widely reported example: in December 2012, Vice published a photo of John McAfee, then wanted for questioning by Belize police, with GPS coordinates in its EXIF data that placed him in Guatemala. Vice later removed the location data from the published photo, and he was arrested in Guatemala City two days later for entering the country illegally. McAfee afterward claimed he had altered the data himself, and it is unclear whether the geotag played any role in the arrest. (Kaspersky, Vice)

Online marketplace listings. If you sell something and photograph it at home, the photo's GPS data can point to your address. Some listing sites remove location data from uploaded photos and some may not, so check the photo before you post it instead of assuming the site handles it.

Timeline reconstruction. One timestamp records one moment, but many photos shared over weeks or months can add up. Together with location data, they can show when you are usually home, when you leave for work, and when you return. That is useful information for anyone trying to find you at a predictable time.

Account correlation. Some cameras write a serial number into EXIF, which can link photos taken with the same camera (EFF). Phones usually record only make and model, which many people share, so on its own that is a weak signal. Still, a pseudonymous account and a real-name account can be connected if either one posts photos that keep their location data.

None of this requires advanced skills. Free tools can read the data if the file still has it.

Do social media platforms strip it for you?

Some do, but not all, and the ones that do have a catch.

Major platforms such as Instagram, Facebook, X (formerly Twitter), TikTok, and Snapchat are commonly reported to remove EXIF from the public-facing version of uploaded photos, so someone downloading your Instagram photo usually can't pull GPS data from that file. ExifPixel Most platforms don't document this in their help centers, though, so treat it as likely behavior, not a guarantee.

The catch: any stripping happens after upload. The platform receives your original, unmodified file first, metadata included. The FBI notes that some platforms don't share EXIF publicly but may use it internally (FBI Portland). The public copy and the original are not the same thing.

Some services keep metadata by default. Flickr, for example, keeps a photo's EXIF data unless you hide it in your privacy settings (Flickr Help). Email attachments and cloud-sharing links like Dropbox or Google Drive send your file unchanged, and Google notes that downloaded or emailed photos keep the device's original location data (Google Photos Help). Kaspersky

The rule that matters: if someone receives the actual file, they have everything inside it.

How to see what's in your photos

Before you change anything, it helps to know what you're dealing with.

On a Mac, open the photo in Preview, go to Tools, and select Show Inspector. Open the More Info Inspector and select the GPS tab.

On Windows, right-click the image, select Properties, then the Details tab. You'll see GPS coordinates, device info, and timestamps listed there.

On iPhone, the built-in Photos app shows location under the photo's info panel (open a photo, then swipe up or tap the Info button). Third-party apps like Metapho let you see and edit the full EXIF block.

On Android, most gallery apps have an info or details panel. In Google Photos, open the photo and swipe up or tap Info to see where it was taken. Steps vary by app and version.

How to remove metadata before you share

The most effective approach is to strip metadata before the file reaches any server. Here's how to do it on each platform:

iPhone (iOS 13 and later): When sharing a photo from the Photos app, tap Options at the top of the share sheet before you send. Turn off Location to remove GPS data; "Location Not Included" appears above Options when it is off. Note this removes location only, not all EXIF.

Android: When you share an album in Google Photos, tap Share, then Options, and turn off "Share photo locations." That controls what Google Photos shows recipients, but a file you download or email still keeps its original location data. To remove metadata from the file itself, use a dedicated metadata-removal app.

Windows: Right-click the image, go to Properties, then Details. Select "Remove Properties and Personal Information" and follow the prompts to remove metadata properties from the file or save a clean copy. It works on many file types, so check the Details tab afterward.

Mac: In Preview, open the Inspector (Command-I), go to the GPS tab, and choose Remove Location Info. Or use a free tool like ImageOptim to strip metadata in bulk, then check the result in Preview.

Online tools: Some browser-based EXIF removers process the file locally in your browser, and some upload it to a server. It is not always clear which. Unless a tool clearly states that it works locally, prefer the built-in options above.

Turn off geotagging at the source

Stripping metadata from existing photos matters, but the cleanest fix is to stop the data from being written in the first place.

On iPhone: Go to Settings, then Privacy and Security, then Location Services, and tap Camera. Set it to "Never." This stops new photos from being geotagged going forward. Photos already in your camera roll still have GPS data from when they were taken.

On Android: Open the Camera app, go to Settings, and turn off "Save location" or "Geotagging." The setting label varies by manufacturer: on Pixel it is "Save location," and on Samsung it is "Location tags."

Worth knowing: turning off location for the camera doesn't remove metadata entirely. Your phone still records device make, model, timestamps, and other technical fields. If device fingerprinting is a concern, you'll want to strip the full EXIF block, not just the GPS fields.

What this means for your everyday photos

What you need to do depends on where the photo is going.

• Posting to a large social platform: the public copy is usually cleaned, but the platform still receives the original, so turning off camera location is the more reliable protection.
• Sending a file to a person or a group: strip the location first, because they receive everything inside the file.
• Listing something for sale or posting on a smaller site: check the photo's details before you upload, since not every site removes metadata.

One caveat: tools differ in what they remove, so open the cleaned copy and check its details before you rely on it.

Get a free security scan with Guardio today and stay protected.

Conclusion

Most people share photos without thinking twice about what's inside them. That's completely understandable. The data is invisible, the risks aren't obvious, and the tools to exploit it are quietly accessible to anyone who goes looking.

The good news is that protecting yourself here is straightforward. Turn off camera location access. Learn how to strip metadata before sharing files directly. And know that when you post a photo online, the platform's own copy isn't necessarily the only version that matters.

Your pictures say more than you think. A few small habits change that.