The location data hiding in your photos
Take a photo on a phone with location switched on for the camera, and the file records where you were standing. Not the suburb: the coordinates, usually accurate to a few metres outdoors, often with altitude and sometimes the direction the camera was pointing. Nothing on the photo itself shows this. It sits in the file's metadata, and it travels wherever the file goes.
What EXIF is
EXIF is a standard for storing information inside image files, first published in 1995 by the Japanese electronics industry. It was designed to help photographers: which camera, which lens, what shutter speed and aperture, when the picture was taken. GPS fields were added as cameras gained the ability to know where they were. Phones fill them in automatically.
A typical phone photo carries dozens of fields. The camera make and model. The exact time, often with the time zone. The exposure settings. The software version. And, if allowed, latitude, longitude and altitude.
When it matters
For most photos, it does not. A picture of a sunset from a public beach reveals nothing anyone would care about. The risk is in photos taken at places you would not otherwise tell a stranger about:
- Selling things online. The couch photographed in your lounge room tells a buyer, or anyone browsing, where the lounge room is.
- Photos of children taken at home or at school and shared beyond family.
- Dating profiles and forums where you would rather stay anonymous.
- Routine. A set of photos from the same spot at the same times of day tells a story about when you are home and when you are not.
Who strips it and who does not
This is where it gets unreliable. Many large social networks remove location and other EXIF data from photos when you post them publicly. Chat apps that re-compress photos to save data generally drop it too. That has given many people the impression that it is handled.
But plenty of routes pass the original file along untouched:
- Email attachments.
- Cloud storage share links.
- Sending a photo “as a file” or “as a document” in a messaging app, which is often chosen specifically to avoid compression.
- AirDrop and similar direct transfers.
- Many marketplaces, forums and smaller sites, which store what you upload.
Platforms also change their handling over time, and you usually cannot tell from the outside what a given site does. The only dependable approach is to make sure the file is clean before it leaves your hands.
More than location
GPS gets the attention, but other fields can matter too. Some cameras record their serial number, which can link photos posted under different names to the same device. Editing software can leave a history in XMP data, including the names of earlier files. Timestamps can contradict a story or confirm one.
There is also an old oddity worth knowing: EXIF can hold a small thumbnail of the photo. Some editing software used to crop or edit the main image while leaving that thumbnail untouched, so a cropped photo carried a tiny preview of the uncropped original. Modern software rarely does this, but it is a good illustration of how much can hide in a file.
How to check a photo
Open it in an EXIF viewer. If there is location data, a good viewer will say so plainly and show you where on a map. Do this once with a photo from your own phone; many people are surprised by how precise it is.
Phones can show it too. On an iPhone, swipe up on a photo in the Photos app to see its map location. On Android, the photo details in the gallery app usually include location.
How to stop it
At the source
Turn off location access for your camera app. On iPhone, that is under Settings → Privacy & Security → Location Services → Camera; on Android it is in the app's permissions. You lose the ability to browse your photos on a map, which some people love and some never use.
iPhones also let you strip location per share: in the share sheet, tap Options at the top and switch off Location before sending.
Before sharing
Run the file through a metadata remover. A good one removes EXIF, GPS, XMP and comments without re-compressing the picture, so there is no quality loss. Choose one that works on your own device rather than uploading, since sending your photos and their coordinates to a server to have the coordinates removed rather defeats the purpose.
One practical catch: phones often store photos unrotated and rely on an EXIF tag to display them the right way up. Strip the tag carelessly and portrait photos appear sideways. Better tools detect this and fix the rotation in the pixels first.
In the picture itself
Metadata is only half of it. House numbers, street signs, school uniforms, car number plates, mail on a bench and the view from a window all give away location too. If a photo is going somewhere public, look at it as a stranger would. Blur or box out what you would not say out loud.