EXIF data: what your photos quietly reveal (and how to strip it)

Every photo from a phone or camera carries a second, invisible payload: structured metadata describing when, where and how the shot was taken. Most of the time it is harmless and even useful. Occasionally — a photo of an item for sale, taken in your living room, with GPS coordinates embedded — it reveals more than the pixels do.

What is actually in there

EXIF (Exchangeable Image File Format) is a metadata block inside JPEG, HEIC and most raw formats. A typical phone photo includes:

• Timestamps — when the photo was taken, to the second, plus time zone on newer devices.
• GPS coordinates — latitude, longitude, often altitude, precise to a few metres, if location tagging is on (on many phones it is by default).
• Device details — make, model, sometimes the lens and firmware version.
• Camera settings — exposure, aperture, ISO, focal length, flash.
• Orientation — which way up the camera was held (more on this one below, because it causes the classic sideways-photo bug).
• Sometimes an embedded thumbnail of the image — which in a few infamous cases preserved a version of a photo its owner had cropped.

None of this shows in the image itself. It is read by software — photo apps use it to build timelines and maps, which is the legitimate purpose.

Where it travels, and where it gets stripped

The pattern that matters: big social platforms strip EXIF on upload; direct transfers do not.

Facebook, Instagram and X remove metadata from the copies they serve (while reading it first for their own purposes). But a photo sent as an email attachment, uploaded to a marketplace listing, shared via cloud drive link, posted on a forum, or attached in most messaging apps’ “original quality” modes typically keeps everything — GPS included. The risk cases are precisely the informal ones: selling furniture with photos taken at home, CVs with photos, images on a personal website.

Checking is easy: on Windows, right-click → Properties → Details; on macOS, Preview → Tools → Show Inspector; on phones, the photo’s info panel shows a map when coordinates are present.

The orientation tag: EXIF’s everyday bug

One EXIF field causes visible trouble weekly: Orientation. Cameras often save the sensor image unrotated and record “rotate 90°” as metadata. Software that reads the tag shows the photo correctly; software that does not shows it sideways — the classic photo that is upright on your phone and horizontal in some web form.

The robust fix is to bake the rotation into the pixels and reset the tag, which is what the rotate tool here means by “permanently, not just EXIF” — after that, every viewer agrees which way is up.

Stripping metadata deliberately

Any operation that re-encodes the pixels produces a new file without the original’s metadata block, unless the software deliberately copies it over. The image tools on this site — compress, convert, crop, resize — re-encode, do not copy EXIF, and run entirely in the browser, so the photo containing your coordinates never leaves your device in the first place. Any of them produces a clean file; the conversion or compression is a side benefit.

Native routes exist too: Windows’ Properties → Details has “Remove Properties and Personal Information”; macOS Preview can strip location data; both iOS and Android offer “remove location” toggles at the point of sharing. And the preventative option — turning off location tagging in the camera app — removes the most sensitive field at the source, at the cost of losing the map feature in your own photo library.

A sensible policy

Metadata is not a threat in your own library — it is what makes photo search and timelines work. The moment that changes is publication:

• Keep EXIF in photos that stay in your library and backups.
• Strip it from anything published where you would not also post your address: marketplace listings, forum posts, images on a website, attachments to strangers.
• Assume nothing about the channel — platforms change their handling without notice, so stripping before upload beats trusting the uploader.

The photo itself already reveals whatever is in the frame; EXIF just adds the parts you cannot see. Handle it the way you would any other document metadata: fine internally, checked at the door.