What Your Photos Say About You: EXIF, XMP, IPTC and Location Privacy

Send a photo straight from your phone as a file and the recipient gets two things: the picture, and a small record card attached to it. The card says which device took the photo, at what minute, with which settings and, if location access was on, where on Earth it was taken. That card is metadata. Most of it is useful for organizing your own library. The trouble starts when it travels with a copy you meant to share.

Three record cards inside one photo

EXIF: the camera’s shooting record

EXIF is a standard maintained by CIPA, the Japanese Camera & Imaging Products Association. It places a small TIFF-style table inside the JPEG and records the camera make and model, lens, aperture, shutter speed, ISO, date and time, orientation and GPS coordinates. The current edition, Exif 3.0, was published in 2023 and was the first to allow UTF-8 text. The same structure appears inside iPhone HEIC files and most camera RAW formats.

Location sits in a separate GPS block. Latitude and longitude are stored as degrees, minutes and seconds, each a fraction, sometimes with altitude, the compass direction the camera faced, and a UTC timestamp. One second of latitude is about 31 m (roughly 100 ft), and phones record fractions of a second. That is enough to point at a single house.

EXIF can also contain the serial numbers of the camera body and lens. They are common on mirrorless and DSLR cameras, and they matter even without GPS: two photos with the same body serial came from the same camera. If a photo posted under a pseudonym shares a serial number with one posted under your real name, the two accounts are linked.

XMP: the editor’s record

XMP is Adobe’s XML-based format. Edit a photo in Lightroom or Photoshop and it accumulates the software name, the edit history, original document IDs, star ratings and keywords. Modern phones also use XMP to store motion-photo and portrait-depth data. Some tools that advertise “EXIF removal” leave XMP untouched, so the word EXIF on a button is not a guarantee that the file is clean.

IPTC: the caption sheet

The IPTC Photo Metadata Standard, from the International Press Telecommunications Council, carries the human-written description: photographer name, copyright notice, caption, keywords, and place names such as city and country. It is almost always present in news-agency photos. In personal photos it shows up when a photographer has registered their name and copyright line in the camera or editing software. That is helpful for protecting your work and unhelpful when you post somewhere you did not want your real name to appear.

Cases where metadata gave away a location

In December 2012, Vice magazine was traveling with software entrepreneur John McAfee, who had gone into hiding while police in Belize wanted to question him. The magazine published a photo of him taken with an iPhone 4S, and its EXIF data still held GPS coordinates. People on Twitter pulled the coordinates out and found they pointed to a spot in Guatemala. McAfee first claimed he had faked the data, then admitted he was indeed in Guatemala, as NPR reported on December 4, 2012.

Earlier that year, a hacking investigation turned on the same detail. A person linked to the group CabinCr3w defaced law-enforcement websites and posted a photo of a woman. The photo’s EXIF recorded an iPhone model and GPS coordinates, which pointed to a location in Australia. The Register and others reported that the FBI used this as one of the leads in the case.

Neither case needed sophisticated forensics. The information was readable by anyone who opened the file’s properties or a metadata viewer, which also means a single check before publishing would have prevented it.

iPhone

Apple’s Personal Safety User Guide describes the steps: in Photos or Camera, select the photos, tap the Share button, tap Options at the top of the share sheet, and turn off Location. The sheet then shows “Location Not Included” above the Options button. To remove the location from a photo already in your library, use Adjust Location in the photo’s info and choose No Location. To stop recording location in new photos at all, go to Settings > Privacy & Security > Location Services > Camera and choose Never.

Treat the share option as something to check every time rather than a setting you flip once. The label at the top of the share sheet tells you what is about to happen.

Samsung Galaxy

Starting with One UI 3.1, Samsung added a “Remove location data” option to the Gallery share screen. Select a photo, tap Share, and the toggle appears under the preview; turn it on and the shared copy leaves without location. Samsung’s support page describes location data specifically. It does not claim to remove other EXIF fields such as the device model or camera settings.

Google Photos

Google’s help center explains that you can control whether photo locations are shared for each shared album, link or conversation you create in Google Photos. It also states that this does not apply to photos shared outside Google Photos, for example when you download a photo and email it: in that case, the original location your device saved goes with it. Hiding the location inside the app is not the same as removing it from the file.

Many large platforms are widely reported not to show EXIF to other users, often because images are recompressed on upload. What is much harder to find is an official, current statement of exactly what each service removes, whether the original is retained on its servers, and how options such as “send as file” or “original quality” change things. Policies also change without notice, and uploads made through third-party schedulers or APIs may take a different path.

So check instead of trusting. Download your own post or a message you sent from another device and open it in the Photo Metadata Viewer. Within a second you can see whether a GPS group survived. The safer habit is to send a copy you cleaned yourself, whatever the platform promises.

What survives even a perfect cleanup

A photo with every byte of metadata removed can still reveal where it was taken. The skyline or hills outside a window, a shop sign, a bus route number, a shipping label on a box, a school uniform or name badge, a reflection in a window, a mirror or sunglasses: all of these are used routinely by people who geolocate images from their content alone. The file name counts too. Phone names like IMG_20260922_211005 carry the date and time.

Documents behave the same way. Clearing the author field in a Word file does nothing to the text of tracked changes and comments, which still show who changed what. Removing metadata is one layer of checking, not the whole job.

Decide whether you need location at all. If you never use it, turning off the camera’s location permission is the most thorough fix. If you want it for your own travel library, keep it on and remove it when sharing.
Check the share option. On iPhone, Options > Location in the share sheet; on Galaxy, Remove location data. Every time.
Clean files yourself when sending them as files. Email attachments, cloud links and “send as document” in messaging apps are the most likely to deliver the original. Run the copy through the Metadata Cleaner, which removes EXIF, XMP and IPTC and also handles HEIC, video and office documents.
Open the result again. Drop the cleaned file into the viewer and confirm that GPS and serial numbers are gone.
Rename the file. Replace date-stamped camera names with something neutral.
Look at the picture itself. Scan for views, reflections, papers, screens and badges. Crop or cover them; a solid shape is safer than a blur.
Watch for thumbnails after editing. After cropping or covering something, send the newly saved file rather than the original, and check the viewer for a leftover embedded thumbnail.

Location tagging is not a bad feature. The same GPS tag is what tells you, years later, where a photo was taken. Keep it in your own library and strip it from the copies that leave your hands.