Images & metadata

EXIF (Exchangeable Image File Format) is the block of data that cameras and phones write into each photo. Related formats, XMP and IPTC, hold captions, copyright notices and editing history, and phone videos carry similar fields in their own container. The fields that matter most for privacy:

• Location: GPS latitude and longitude, altitude, and on many phones the direction the camera was facing. A photo taken at home records where you live.
• Device: make and model, lens, and firmware or software version. The EXIF standard also has fields for the camera body’s serial number, the lens serial number and the owner’s name (ExifTool tag list), which many dedicated cameras fill in.
• Time: when the photo was taken and last modified, often with the time-zone offset, which hints at your region even without GPS.
• Settings and history: exposure, flash, colour profile, and the program that edited or exported the file.

Whether metadata survives depends on how the file travels, and apps change their behaviour over time. Plan for the worst case:

• Messengers, sending as a photo: images are usually re-compressed. EFF notes that Signal strips metadata from images it sends (EFF Surveillance Self-Defense). Do not assume the same of every app; see the messaging guide.
• Messengers, sending as a file or document: this option exists to deliver the original file. Assume all of its metadata arrives with it.
• Email, cloud storage, file-transfer services and many forums keep the file exactly as you uploaded it.
• Social networks: many remove EXIF from the copy other people see, but not all do, and the service still receives your original upload and can read it. Meta, for example, said in 2024 that it would label images on Facebook, Instagram and Threads when it detects industry-standard C2PA or IPTC metadata indicating AI generation (Meta). Strip files before you upload them.

All of these run offline on your own computer. They remove file metadata only: none of them changes sensor noise, invisible watermarks or what is visible in the picture.

On a phone, the most reliable habit is to send every photo through a cleaner from the share menu before it reaches a messenger or social app.

iPhone and iPad without extra apps

• Stop the camera recording location: Settings > Privacy & Security > Location Services > Camera > Never.
• When sharing, tap Options at the top of the share sheet and turn off Location. Apple describes this option for location only, so other metadata may still go out.
• Remove location from photos already in your library: open the photo, tap More, then Adjust Info > Adjust Location > No Location (Apple).
• For a fuller strip, Privacy Guides describes a Shortcuts workflow that converts images with “Preserve Metadata” turned off (Privacy Guides).

Android camera settings

• Turn off location tagging in your camera app’s settings and turn it on only when you want it.
• On GrapheneOS, the built-in camera removes EXIF data from photos by default except orientation, and location tagging is off unless you enable it (GrapheneOS). See the operating systems guide.

Documents can carry author and organisation names, software versions, creation and edit dates, comments and tracked changes. Images pasted into a document keep their own metadata inside it.

• mat2 and Metadata Cleaner clean PDF, Office and OpenDocument files. The Tails documentation warns that complex formats cannot be cleaned reliably, for example images embedded in Office files, so clean images before inserting them and use simpler formats such as plain text where you can.
• ExifTool and ExifCleaner are not suitable for PDFs: their PDF changes can be undone, so the original metadata stays in the file.
• Dangerzone, from the Freedom of the Press Foundation, turns PDFs, Office documents and images into a new PDF rebuilt from pixels inside an offline sandbox, so only what is visible on each page survives. It is built for opening untrusted documents safely, and also works as a blunt way to flatten a document before sharing it (dangerzone.rocks).
• Printed pages can carry tracking dots from the printer; see the printer guide.

Content Credentials are a standard from the Coalition for Content Provenance and Authenticity (C2PA) for attaching a cryptographically signed record to a file: which device or app created it, when, and how it was edited since. The goal is to help people tell genuine camera photos from AI-generated or altered images. The record is also information about you and your device, and a growing number of devices add it automatically:

• Google Pixel 10: the Pixel Camera app attaches Content Credentials to every JPEG photo, with a signed time-stamp from a protected clock on the phone that works offline. Google Photos adds them to images edited with AI tools. Google says each signing certificate is used for one image only, that its certificate authorities do not log IP addresses, and that the credentials therefore cannot link your photos to each other or to you (Google Security Blog, September 2025).
• Professional cameras: Leica’s M11-P and SL3-S can sign every photo they take (Content Authenticity Initiative). Sony sells a licence, aimed at news organisations, that adds a hardware-backed signature, a server-acquired time-stamp and 3D depth data to stills and video from supported cameras (Sony).
• Editing tools and identity: Content Credentials can record each edit made in compatible apps and, when the creator adds it, who made the content (Content Authenticity Initiative).

Stripping all metadata deletes the Content Credentials embedded in a file along with the EXIF data. “Durable” Content Credentials are designed to survive that: an invisible watermark carries an identifier that can be used to look the record up again after a platform strips it (Content Authenticity Initiative, January 2026).

Watermarks on AI-generated content

• Google SynthID is embedded in content from many of Google’s AI tools, including images, video, audio and text. Google says the image and video watermark is designed to withstand cropping, filters and lossy compression, and that the Gemini app and its SynthID Detector can check for it, including in content from partners such as OpenAI and NVIDIA (Google DeepMind).
• Meta marks photorealistic images from Meta AI with visible markers, invisible watermarks and metadata (Meta), and in December 2024 open-sourced Video Seal, a watermarking model for video (Meta AI research).
• Samsung overlays a visible watermark on images saved from the generative AI editing features of the Galaxy S25 series (Samsung, January 2025).
• In the EU, Article 50 of the AI Act, which applies from 2 August 2026, requires providers of generative AI systems to mark their output in a machine-readable way as artificially generated (AI Act, Article 50). Rules elsewhere differ. See also the AI guide.

Every image sensor has tiny manufacturing differences between its pixels: some respond slightly more strongly to light than others. This photo-response non-uniformity (PRNU) adds a faint, stable noise pattern to every photo the camera takes, and it works like a fingerprint. With enough reference photos from a camera, a forensic analyst can test whether another photo came from the same sensor. That can be used to:

• Identify the camera that took a photo, if the camera or other photos from it are available
• Link photos posted under different accounts to one device
• Spot edited regions where the pattern is missing

The pattern lives in the pixels, not in the metadata, so stripping EXIF does nothing to it. Forensic research describes it as surviving lossy compression, filtering and gamma correction, and detection methods search for resizing and cropping too (Fridrich, Digital Image Forensics Using Sensor Noise).

Editing and exporting leave traces too. Some are ordinary metadata: the program name and version, edit times, colour profiles and sometimes an edit history, all of which a cleaner removes. Others are in how the image is encoded. JPEG compression uses quantization tables, the numbers that decide how much detail is thrown away, and cameras and programs use different tables. A 2006 Dartmouth study showed these tables can narrow down which camera model or editing program last saved an image, even with no metadata at all. Photoshop’s tables, for example, differed from those of all 204 cameras tested, so a JPEG last saved in Photoshop could be told apart from a camera original (Farid, Digital Image Ballistics from JPEG Quantization).

Taking a screenshot of a photo does drop the photo’s original metadata, because the screenshot is a new file. EFF suggests it as one way to scrub a picture. Screenshots have leaks of their own, though:

• Their own metadata. According to GrapheneOS, on Android each screenshot includes an EXIF tag with the OS build number, which usually reveals the phone model family, plus the local date, time and time-zone offset. GrapheneOS removes the build tag and turns the time fields off by default (GrapheneOS).
• Everything else on screen. Status-bar icons, carrier name, battery level, notification previews, usernames, language, time format and app theme all narrow down who took it. Crop tightly.
• Cropped areas that are not gone. In 2023 researchers found that the Pixel’s Markup editor (“aCropalypse”, CVE-2023-21036) and the Windows 11 Snipping Tool saved edited screenshots over the original without removing the old data at the end of the file, so parts of the cropped-out area could be recovered (David Buchanan, BleepingComputer). Save edits as a new file, then strip it.
• Identity overlays. Some workplace tools stamp the viewer’s identity on screen. Microsoft Teams Premium, for example, can overlay each participant’s email address on shared content and video, so a screenshot or screen recording names whoever made it (Microsoft).
• Pixelation and blur can be reversed. Pixelated text can sometimes be reconstructed (see the Depix proof of concept), and EFF advises blocking out faces rather than blurring them. Cover sensitive details with a solid, opaque box.

A perfectly clean file can still reveal where it was taken. Investigators have long geolocated photos from signs, shop fronts, architecture, vegetation and terrain; AI now does it in seconds. In January 2025 404 Media reported on GeoSpy, a tool from Boston-based Graylark Technologies trained on millions of images and marketed to police and government agencies; members of the public had used it too, some asking for help locating specific women, and public access was closed after the outlet contacted its founder (404 Media). In April 2025 users showed that OpenAI’s o3 model could often name the city, and sometimes the exact bar, in ordinary photos, in many cases without relying on EXIF data, though it also made mistakes (TechCrunch).

Before posting, look at the picture the way a stranger would:

• Windows and the view through them, street signs, house numbers, number plates, shop names
• Reflections in glasses, mirrors, screens and car paint
• Landmarks, skylines, mountains, coastlines and distinctive vegetation
• Shadows and light, which hint at the time of day and season, and weather that can be matched to a date
• Faces, tattoos, clothing, uniforms and badges, including of bystanders who did not agree to be photographed
• Papers, screens and packaging with names or addresses

For reducing what others can find about you more generally, see the OSINT defense guide.

Habits that work

• Strip every image before it leaves your device, even if the app you send it through claims to do it for you.
• Keep location tagging off in the camera app and turn it on only when you need it.
• Check the result, not the promise. Inspect a cleaned file with exiftool -a -G1 file or mat2 --show file before sharing it.
• Know where the originals end up. Some tools overwrite in place, some save a copy, and ExifTool keeps a backup of the original. Delete the copies you do not want to keep.
• Look at the picture before the metadata. Crop out windows, signs, reflections, screens, documents and faces first.
• Cover, do not blur. Use solid boxes for text and faces, then export a new file.
• Use separate cameras for separate identities. A phone that takes your personal photos should not also produce photos for an anonymous account.
• Watch the timing. When you post, the light in the photo and the time zone in a file can confirm a location or contradict what you say about it.

Common mistakes

• Posting straight from the phone’s gallery with the location still in the file
• Assuming a platform strips metadata, or that stripping the public copy keeps the data from the platform itself
• Sending the original as a “file” or “document” in a messenger
• Believing a metadata cleaner removes sensor fingerprints, invisible watermarks or what is visible in the frame
• Editing a screenshot in place and sharing it, or pixelating text instead of covering it
• Using the same camera, editor and export settings for accounts that must stay unlinked

• Privacy Guides: data and metadata redaction toolsprivacyguides.orgCommunity-maintained recommendations for desktop, Android and iOS.
• EFF Surveillance Self-Defense: attending a protestssd.eff.orgCovers photo metadata, blocking out faces and Signal’s blur tool.
• Tails: removing metadata from filestails.net
• Google Security Blog: Pixel 10 and C2PA Content Credentials (2025)security.googleblog.com
• Jessica Fridrich: Digital Image Forensics Using Sensor Noisews.binghamton.eduTechnical tutorial on PRNU camera identification and device linking.
• 404 Media: the AI tool that can geolocate photos in seconds (2025)404media.co