What EXIF data reveals about you

A typical phone photo carries the exact GPS position where it was taken, the date and time to the second, the make and model of the phone, the software version, and often a small preview image — and some cameras add a serial number unique to your device. None of it is visible when you look at the picture, but anyone who gets the original file can read it in seconds. The quickest way to see what a specific photo holds is to drop it into the EXIF viewer; this article explains what each piece means and why it matters.

What EXIF actually is

EXIF — the Exchangeable Image File Format — is a standard for storing information about a photo inside the photo file. It was designed for photographers: if you want to know why one shot came out sharper than another, the shutter speed, aperture, ISO and focal length are right there. Camera makers adopted it universally, and phone makers followed. Over time the format was joined by others that live alongside it in the same file: XMP, an XML-based format used heavily by Adobe software and phone gallery apps; IPTC, which newsrooms use for captions, credits and keywords; and more recently C2PA content credentials, a signed record of where an image came from and how it was edited. When people say "EXIF data" they usually mean all of this together.

The important thing to understand is that metadata travels with the file. Copy a JPEG to a USB stick, attach it to an email, upload it to a cloud folder or drop it into a chat as a "document" rather than a photo, and every tag goes with it. Whether a website or app removes the data when you upload depends entirely on that service, and it is not always documented.

The fields that matter for privacy

GPS location

If location services are enabled for the camera app, phones write a GPS block containing latitude, longitude and altitude, and often the compass direction the lens was facing and a GPS timestamp. Modern phone positioning combines satellites, Wi-Fi and cell data, so the recorded point is frequently accurate to within a few metres — enough to identify a specific house, not just a street. This is the field behind most real-world metadata incidents: a photo of a for-sale item, a pet or a new car posted from home quietly publishes the home's coordinates. The EXIF viewer converts the degrees-minutes-seconds values to decimal coordinates and links to a map, which is usually the moment people decide to strip their photos.

Date and time

EXIF stores several timestamps: when the photo was taken (DateTimeOriginal), when it was digitised, and when the file was last modified, often with sub-second precision and, on newer devices, a time-zone offset. On its own a date seems harmless. Combined with location it reveals routine: the gym at 6:30 every Tuesday, the school gate at 3:15. Timestamps also undermine the "this photo is old" defence when someone reposts a picture you thought was from years ago.

Device identity and serial numbers

Make and model ("Apple iPhone 15 Pro", "Canon EOS R6") are almost always present. Many interchangeable-lens cameras go further and write a BodySerialNumber and sometimes a LensSerialNumber. A serial number is a stable identifier: any two photos carrying the same one came from the same camera. That is useful for proving ownership of a stolen camera, but it also means anonymous photos can be linked to ones you posted under your own name. Some cameras also store an owner name typed in during setup, plus proprietary "maker notes" — blocks of binary data whose contents vary by manufacturer and can include internal counters and settings.

Software and editing history

The Software tag usually records the phone's operating-system version or the editing program that last saved the file. XMP can hold far more: the editing application, a history of saves, original and current document IDs, and in some workflows the full list of adjustments applied. Document IDs persist across edits, so two differently cropped versions of the same picture can be matched to one another even when they look different.

The embedded thumbnail

EXIF includes a small preview image so file browsers can show thumbnails quickly. Here is the catch: some editing tools crop or retouch the main picture but leave the old thumbnail untouched. There are well-known cases of a cropped photo whose embedded preview still showed the uncropped original, including the part the owner deliberately cut out. When the EXIF viewer finds a thumbnail it displays it, so you can check whether it matches what you think you are sharing.

Captions, keywords and copyright

IPTC and XMP fields hold captions, titles, keywords, the photographer's name, a copyright notice and sometimes contact details. Professionals add these on purpose — they help with licensing and attribution — so stripping them is a decision, not a reflex. If you sell or license your work, you might keep a copyright notice and remove only the location and device fields.

Content credentials (C2PA)

C2PA manifests are a newer kind of metadata: a cryptographically signed record describing how an image was made — which camera or app created it, whether generative AI was involved, and what edits followed. Supporters see it as a defence against misinformation. From a privacy angle it is still metadata about you and your tools, and because it lives in its own block (APP11 in JPEG, a caBX chunk in PNG) many traditional strippers miss it. The viewer flags it when present. Note that removing a manifest does not remove invisible watermarks some generators embed in the pixels.

What a typical phone photo contains

The values above are illustrative; exactly which tags appear depends on the device, its settings and any app that has touched the file since.

How to check a photo yourself

1. Open the EXIF viewer and drop in the photo. It is read locally; nothing is uploaded.
2. Look at the coloured flags first. A red GPS location or Serial number flag is the one to act on.
3. If there is a GPS block, follow the map link to see exactly what the coordinates point at.
4. Expand All metadata fields for the complete list, grouped by block.
5. Press Remove metadata and download the clean copy. The tool re-reads its own output and reports how many tags remain.

Operating systems can show some of this too: on Windows, right-click a file and open Properties › Details; on a Mac, open the file in Preview and choose Tools › Show Inspector; on an iPhone, swipe up on a photo in the Photos app. These views are convenient but partial — they rarely show XMP history, maker notes, thumbnails or content credentials.

Does metadata ever help?

Yes, and that is worth remembering before stripping everything from your own archive. Capture dates let photo libraries sort decades of pictures correctly. Location tags power "places" albums and help you remember where a trip photo was taken. Exposure data is how photographers learn. Copyright and creator fields help your work stay attributed when it circulates. A sensible habit is to keep metadata in your private library and strip it from the copy you share — which is exactly the workflow the remover is built for: it never changes your original file, it gives you a separate clean copy.

Key takeaways

• The original file of most phone photos contains a precise location, a timestamp and a device fingerprint.
• Metadata travels with the file through email, cloud links, USB drives and "send as file" options.
• Thumbnails, XMP edit history and content credentials are easy to overlook and can say more than the main EXIF block.
• Check before you share, and share a clean copy rather than the original. To stop location being recorded in the first place, follow the phone and computer settings guide.