What Your Photos Give Away When You Share Them
Every phone photo can carry the exact coordinates where it was taken. Here's what's inside the file, who strips it, and how to check before you post.
Someone lists a bike for sale. Good photo, taken in the back garden. They meet a buyer in a car park two miles away, sensibly, because you don’t invite strangers home.
The photo already told the buyer where they live. To within a few metres.
What’s actually in the file
A photo isn’t just pixels. Cameras and phones write a metadata block called EXIF into the file, and it typically contains:
- GPS coordinates: latitude, longitude, often altitude. Usually accurate to a handful of metres.
- Date and time the photo was taken, sometimes with timezone.
- Device: make and model of the phone or camera, often the lens too.
- Exposure settings: aperture, shutter speed, ISO, whether the flash fired.
- Software: the app or editor that last touched it.
- Serial numbers, on many cameras. Which links separate photos to one physical device.
None of this is visible in the picture. All of it travels with the file.
The part that catches people
Location is on by default in most camera apps, because it powers the map view in your photo library. Which is genuinely useful. Nobody switches it on deliberately, and almost nobody knows it’s there.
The consequences are ordinary and well-documented:
Marketplace listings. Photographing an item indoors publishes your home address to everyone who downloads the image. Police forces in several countries have issued warnings about this specific route to burglary.
Photos of children. A back-garden or school-gate photo carries the location of the garden and the school.
Anyone posting anonymously. Journalists, activists and people escaping abusive relationships have been located through image metadata. The picture revealed nothing; the file revealed everything.
Working photos. Site surveys, client documentation, evidence photographs. All carrying coordinates and timestamps you may not intend to pass on.
Who strips it and who doesn’t
This is the bit worth memorising, because the rule isn’t “social media is safe”.
| Where | Strips EXIF? |
|---|---|
| Large social networks | Usually, after reading it themselves |
| Messaging apps, sent as a photo | Usually |
| Messaging apps, sent as a file | No |
| Email attachments | No |
| Forums and smaller sites | Often not |
| Cloud folder sharing | No |
| Marketplace listings | Varies. Don’t assume |
The pattern: compression strips, file transfer preserves.
Which produces a nasty trap. Sending a photo “as a document” to avoid quality loss also preserves the metadata. The more careful you are about image quality, the more you leak.
And note that platforms stripping EXIF protects you from other users. It does not protect you from the platform, which read it on the way in.
Check yours
Take any photo from your phone camera and open it in the EXIF viewer. It runs entirely in your browser, the file isn’t uploaded, which matters more here than almost anywhere, since the whole point is that these files contain things you’d rather not hand out.
If GPS coordinates come back, that’s what every recipient of that file has been getting.
Two ways to fix it
Stop creating it. Turn location off for the camera:
- iPhone: Settings → Privacy & Security → Location Services → Camera → Never
- Android: Camera app → Settings → Location tags (wording varies)
- Cameras: disable built-in GPS, or the phone-pairing that adds it
You lose the map view in your library. Some people consider that a real loss, which is a fair trade to weigh.
Strip before sharing. Keep location on for your own library, remove it from anything leaving your device. The EXIF viewer downloads a clean copy. So does resizing a photo, redrawing on a canvas discards metadata as a side effect, which is why the image resizer also strips it.
The catch with this approach is that it depends on you remembering, every time, forever. If you share photos often, turning it off at source is the more reliable fix.
What stripping doesn’t fix
Metadata is the invisible layer. The visible one still needs judgement.
A photo can show a house number, a street sign, a distinctive view from a window, a school uniform, a reflection in a mirror, a delivery label with your address on the table behind. People have been located from the pattern of a curtain and a slice of sky.
Stripping EXIF removes what you can’t see. It does nothing about what you can. And that part is on you to look at before you post.
The reasonable version of this
None of this is a reason for alarm about photography in general. It’s a reason to know that a file contains more than a picture, and to check once so you know what your own camera is doing.
Thirty seconds, one photo, and you’ll know whether this applies to you at all.
Try it yourself
Free, instant, and nothing you enter leaves your browser.