What your photos say about you: EXIF explained

Every photo you take carries a second, invisible layer: EXIF metadata. It records the camera, the lens, the exact second the shutter fired and, on most phones, where you were standing. None of it shows up when you look at the picture. All of it can travel with the file when you send it to someone, upload it or attach it to an email.

We spend a lot of time around photo files, and we still get surprised by what turns up inside them. So this is a plain explanation of what photo metadata is, what the main formats store, where it survives and where it gets stripped, and how to look at it yourself. A practical guide on removing location data before you share follows next month.

Three kinds of photo metadata

People say "EXIF" for all of it, but a typical photo can hold three different blocks of metadata, written by different tools for different reasons.

EXIF (Exchangeable Image File Format) is written by the camera at the moment of capture. It is a standard maintained by Japanese camera industry bodies, and it lives inside JPEG, HEIC, TIFF and most raw files, with support in PNG and WebP too. EXIF is the technical record: settings, time, device and position.

XMP (Extensible Metadata Platform) was created by Adobe and is stored as XML inside the file or in a sidecar file next to it. Editing software uses it to record what happened after capture: ratings, keywords, develop settings and, depending on the app, a history of edits and exports.

IPTC comes from the news industry. It holds the human parts: a caption, the photographer's name, copyright, keywords, and place names such as city, region and a more specific sublocation. Photo agencies depend on it. Ordinary people fill it in without noticing when an app adds a caption or a place name for them.

On top of these, most camera and phone makers write a private block called MakerNotes. The format is proprietary and often undocumented, and it can hold things like internal serial numbers, shutter counts and focus details.

What a single photo can hold

Open a photo straight off a modern phone in a metadata viewer and you will usually find something like this:

Device. Make and model, often the exact phone or camera body, plus the software version that processed the image.
Lens and exposure. Focal length, aperture, shutter speed, ISO, whether the flash fired, which of several lenses was used.
Time. The original capture time, usually to the second, and on newer devices a time zone offset as well. That offset alone narrows down which part of the world you were in.
Location. Latitude, longitude and altitude, often accurate to a few metres outdoors. Many phones also record the direction the camera was facing and sometimes speed.
Serial numbers. Some cameras write a body serial number and a lens serial number into the file. Phones tend not to, but dedicated cameras often do.
A thumbnail. A small preview image embedded in the file. Some older editing tools changed the main image but left the original thumbnail alone, so a cropped photo could still carry an uncropped preview.
Edit history. In XMP, the software used, sometimes a list of editing steps, and document IDs that tie an exported file back to its original.

Most of this is harmless on its own. The trouble is that it is precise, it is automatic, and it is easy to combine.

The real privacy risks

The obvious risk is location. A photo taken in your kitchen and posted to a marketplace listing can carry your home address, give or take a few metres. Several photos taken at the same place on weekday mornings say where you work. Photos of your children taken at a park you visit every Saturday say more than you would ever write down.

Time is the quieter one. A capture time with a time zone offset tells someone when you were not at home, and a series of them shows a routine.

Serial numbers are the one people rarely think about. If a camera writes the same body serial into every file, then photos posted under different names, on different sites, can be linked back to the same camera. That matters to journalists, activists and anyone who keeps separate identities online for good reasons.

Edit history and document IDs can connect a published image to an original you never meant to share, or show which software and which machine touched it.

It is also fair to say what metadata does not cover. Stripping EXIF removes the location tags. It does not remove the street sign, the view from your window or the reflection in someone's sunglasses. People have been located from the pixels alone many times. Metadata is the easy leak, not the only one.

What platforms keep and what they strip

This part changes over time, so treat it as a general picture and check the service you actually use.

Large social networks generally remove most EXIF data, including GPS, from the copy of the image that other people can download. That does not necessarily mean the platform threw the data away. They may read it and keep it on their side before publishing the stripped copy, and their privacy policies are where to look for that.

Messaging apps vary. Several popular ones recompress photos sent the normal way, which usually drops most metadata along with some quality. Many of the same apps let you send a photo "as a file" or "as a document" to avoid the compression, and in that case the original file, metadata included, is often what arrives.

The channels that almost always keep everything are the ones that move files rather than pictures: email attachments, cloud storage share links, AirDrop and similar transfers, USB sticks and chat apps that send the original file. Phone operating systems have added share options to leave location out (on iPhone, the Options link at the top of the share sheet has a Location switch), but those only apply when you use them.

Our working rule is simple. If the recipient could download the exact file you picked, assume the metadata went with it.

How to see what is inside your photos

You do not need special tools to start. Every major platform shows at least some metadata:

macOS Preview. Open the image, choose Tools, then Show Inspector, and look at the info tab. If the file has location data there is a GPS section with a map.
macOS and iOS Photos. The info panel shows the camera, lens, exposure and a map of where the photo was taken.
Windows. Right click the file, choose Properties, then the Details tab. The GPS fields are near the bottom.
Android. In Google Photos and most gallery apps, swipe up on a photo or open its details to see the camera and location.

Those views show the common fields. To see everything, including MakerNotes and XMP, the standard tool is ExifTool, a free command-line program by Phil Harvey, available from exiftool.org. This prints every tag, grouped by where it lives in the file:

exiftool -a -G1 -s photo.jpg

The -G1 option shows the group for each tag (EXIF, GPS, XMP, IPTC, MakerNotes and so on), and -a includes duplicate tags, which is how you find a location stored in two places at once. The first time you run it on a phone photo, the list is usually longer than people expect. A single image can have a few hundred tags.

One caution: be careful with online metadata viewers. Uploading a private photo to a website to find out whether it leaks private data defeats the point. A local tool is the better habit.

Why we care about this

We make software that works with people's files, and we think about metadata as part of the file, not a detail. One of our apps, Exif AI, looks at an image with an AI vision model and writes a title, description, tags and subject back into the file's EXIF, XMP and IPTC fields. You can find it with the rest of our desktop apps. Writing metadata makes you careful about it: every field you add travels with the file, so you should know what is in there before you decide where the file goes.

Metadata is not the enemy. Photographers rely on it to sort thousands of images, archivists need accurate dates and places, and a map of your own holiday photos is a nice thing to have. The problem is only that it leaves with the photo by default, and most people never see it. Open one of your recent photos in a viewer today and read the GPS line. It is usually more precise than you would guess.