What your photos quietly carry

What is actually stored inside a photo file?

A JPEG is a train of segments. The picture lives in one of them; everything else is bookkeeping, and four kinds of bookkeeping matter here.

EXIF is the camera's own record: device, settings, timestamps, GPS. It sits in an APP1 segment that starts with the ASCII marker Exif. XMP, Adobe's XML-based metadata, also uses an APP1 segment, identified by a namespace URI instead. IPTC, the older news-industry captioning format (bylines, captions, keywords), rides inside an APP13 segment wrapped in a Photoshop resource block. ICC color profiles live in APP2 and describe how the colors should be rendered on screen.

Only the first three can identify you. An ICC profile says "this image uses Display P3", which is about your image, not about you, and stripping it can visibly shift colors. That distinction matters later.

What does my phone record when I take a picture?

A typical unedited phone photo carries:

• Device: make and model ("Apple iPhone 15 Pro"), and often the OS or app version in the Software field.
• Timestamps: when the photo was taken, when it was digitized, and when the file was last modified, from the device clock.
• Camera settings: exposure, aperture, ISO, focal length, flash, lens model.
• Orientation: a flag saying "this image is stored sideways, rotate it on display". Keep this one in mind.
• GPS: latitude and longitude, and frequently altitude, compass direction the camera faced, and speed if you were moving. Phones write this whenever the camera app has location permission, which is the default prompt most people accept once and forget.

Some cameras add MakerNotes, an opaque vendor blob that can include serial numbers. Editing software appends its own trail: Photoshop and Lightroom write XMP edit history into the file.

How precise is the GPS, really?

EXIF stores coordinates as degrees, minutes, and seconds in rational numbers, so the format itself has effectively unlimited precision. The practical limit is the phone's GPS fix. In the open, modern phones are usually accurate to a few meters.

Here is what that means on the ground: one degree of latitude is about 111 km, so the fifth decimal place of a coordinate is about 1.1 meters. A photo's coordinates do not point at your neighborhood. They point at your house, and often at which end of your house. Combined with the timestamp, a single shared photo can say "this person was at this address at 7:42 on a Tuesday". A series of photos says where you live, where you work, and when you are away.

Do platforms strip metadata when I upload?

Mostly yes for public social feeds, mostly no for direct file transfer, with traps in the middle. Two separate questions hide in this one. Does the viewer of my photo get the metadata? And does the platform get it? For every service below, the platform receives your original file; stripping happens on their servers, after upload. Meta's own privacy policy states that they collect metadata from content, including the location of a photo. If your threat model includes the platform, strip before upload. There is no other way.

The pattern worth memorizing: anything that recompresses your photo for bandwidth tends to shed metadata as a side effect, and anything that promises "original quality" preserves metadata as a side effect. The "send as file/document" option people use to avoid compression is precisely the option that forwards your GPS coordinates.

We could not verify current official documentation for every cell above, and platforms change pipelines without announcements. Treat the table as "tested recently", not "guaranteed forever". The only behavior you control is what you upload.

How do I remove metadata without wrecking the image?

There are exactly two honest strategies, and every tool on earth uses one of them.

Lossless segment strip. Walk the JPEG's segments, drop the metadata ones, keep everything else byte for byte. The compressed image data is never touched, so the pixels cannot change, not even slightly. This is what our EXIF remover does by default: it removes APP1 (EXIF and XMP), APP13 (IPTC), the comment segment, and the generic APP3 through APP12 range, while deliberately keeping APP0 (JFIF), APP2 (the ICC color profile), and APP14 (Adobe's color-transform hint), because removing those can change how decoders render color. We built it this way because "remove the tracking, keep the picture identical" is the only version of this promise a tool can actually keep.

Re-encode. Decode the image to raw pixels and save a fresh JPEG with no metadata at all. This guarantees a bare file but it is a lossy generation: quality drops slightly and the file is new. Our tool offers this as a second button, encoding at quality 92, which is visually transparent for nearly all photos.

The orientation gotcha is why both buttons exist. Phones often store the sensor's native orientation and rely on the EXIF orientation flag to display the photo upright. A lossless strip removes that flag along with everything else, so some viewers will show the photo sideways. Our tool reads the flag first and warns you when a photo depends on it; the re-encode path rotates the actual pixels before saving, so the corrected file displays upright everywhere with no flag needed.

What about PNG, WebP and screenshots?

PNG has had textual metadata chunks from the start (tEXt and zTXt in 1996, with iTXt added in 1999), and the current specification defines an eXIf chunk that carries full EXIF, GPS included. WebP's container likewise defines EXIF and XMP chunks, flagged in the file header. So neither format is metadata-free by nature. In practice they usually are anyway, because most PNG and WebP files are exports and screenshots rather than direct camera output, and exporters rarely copy EXIF across.

Screenshots deserve their own line: a screenshot is a brand-new image the OS draws from the screen. It cannot contain the original photo's EXIF, because that data was never part of the pixels. What a screenshot can leak is what is visible in it, such as notifications, a clock, a battery percentage, or a map tile in the background. Different channel, same lesson.

Which beliefs about metadata should die?

"EXIF proves when and where a photo was taken." No. Every EXIF field is plain, unsigned data that free tools can rewrite in seconds, and the timestamp is only ever as good as the device clock. EXIF is evidence the way a handwritten label is evidence: useful when nobody had a reason to lie.

"Stripping metadata damages the image." Not with a segment strip. The pixels are untouched by construction; the file just gets smaller.

"Metadata survives screenshots or re-saves." Screenshots, no, as above. Re-saves, it depends: many editors copy EXIF into the output on purpose, so "I edited it first" is not a cleaning step.

"Metadata is over; C2PA fixes this." C2PA Content Credentials are the actual successor to the authenticity half of this story: cryptographically signed provenance, backed by a coalition of over 500 companies including Adobe, Microsoft, Google, OpenAI, Sony and the BBC, with signing support shipping in cameras from Leica, Sony, Nikon and Canon. But adoption is early, most pipelines still strip the credentials in transit, and an unsigned photo proves nothing either way. For privacy, C2PA changes little: it is more metadata, deliberately attached, and the question of what your file discloses remains yours to manage.

Fair questions

Can someone find my home from a photo I texted?

If the photo went through a channel that preserves EXIF (email, "send as file", most cloud links) and your camera had location on, then yes, to within a few meters. If it went through a stripping pipeline, the copy they hold has no coordinates.

Is the "date taken" in a photo reliable?

Only as a hint. It comes from the device clock and is trivially editable afterward. Never treat it as proof in a dispute.

Should I remove the color profile too?

Usually not. The ICC profile contains no personal information, and removing it can make colors shift on wide-gamut screens. Our remover keeps it for exactly that reason; the re-encode option produces a standard sRGB-behaving output if you want a fully bare file.

Do photo metadata removers upload my photo somewhere?

Some web tools do. Ours runs entirely in your browser; the file never leaves your device, which you can verify because the page makes no network requests when you use it.

The working rules

• Decide your default: if you share photos of your home, kids, or daily locations, turn off location for the camera app in your phone's permission settings. Metadata you never record needs no cleanup.
• Before sharing anywhere that preserves files (email, cloud links, "send as document"), strip metadata first. Lossless strip for identical pixels; re-encode if the tool warns about a rotation flag.
• Never rely on a platform to strip for you. It only protects you from other users, not from the platform, and the behavior can change without notice.
• Remember the trap: the "original quality" sending option is the metadata-preserving option, on every messenger that offers one.

Sources and further reading

1. W3C: PNG specification (third edition) — defines PNG's eXIf and text chunks.
2. Google: WebP RIFF container — WebP's EXIF and XMP chunks.
3. exifdata.org: 2025 platform test — independent test of platform stripping.
4. fast.io: what platforms strip — platform-by-platform stripping behavior.
5. fast.io: messenger metadata tests — photo mode versus file mode.
6. sammapix: which apps strip metadata — app-by-app stripping tests.
7. sammapix: Signal and EXIF — Signal's stripping behavior, tested.
8. Signal-iOS issue 1984 — the 2017 iOS metadata report.
9. Content Credentials — the C2PA coalition and membership.
10. AFIP: C2PA complete guide — C2PA adoption state of play.
11. C2PA supported devices — cameras shipping C2PA signing.