A regular photo from your phone carries more than what's in the picture: the coordinates of where you took it, accurate to the house, the camera model and serial number, the time down to the second, and sometimes your name.
All of it sits in the metadata (a hidden note inside the file that never shows up in the picture), and anyone who gets the file can read that note in about a second. The good news is you can pull the note out without touching the image, and you can stop your phone from writing it in the first place. Here's what's in there, when it actually matters, how to check your own photos, and how to strip it on iPhone and Android.
where it was taken to a few meters camera model, serial the exact unit date and time to the second owner's name if it's filled in └─ readable by any program, not just ours
What EXIF data is in a photo
The format is called EXIF (the standard cameras use to write service fields into a file). Camera makers invented it to store shooting settings, and phones added location on top. Here's what's usually in there and why each field matters.
| Field | How precise | Why it matters |
|---|---|---|
| Coordinates (GPS) | a few meters | home, work, your kid's school, from a single post |
| Camera model and serial number | the exact unit | ties all your photos together, even under different names |
| Date and time | to the second | rebuilds your day and contradicts "I was somewhere else" |
| Owner name, software | as written | direct deanonymization if the field is filled |
The serial number is the one people underrate. Plenty of services strip coordinates, but the camera's serial stays in the file for years and it's identical across every photo from that phone. Two photos with the same serial posted under two different usernames are one person, and nobody needs your address or your account to see it.
When photo location data is a real problem
Let's not panic over nothing. A photo you send as a photo in a messenger, or post to a social feed, is usually clean already: the platform recompresses the image to save space, and the service sections don't survive that. A screenshot is safe too, because your system makes it, not your camera, so there's no location in it.
The dangerous file is the original straight from the camera. It goes out untouched in four situations:
- sent "as a file" or "as a document" in a messenger, with no compression;
- a marketplace listing where photos upload directly;
- a forum, a blog, your own site, anywhere the file lands without processing;
- an email attachment.
Selling stuff secondhand is the most common one. Someone photographs a couch in their apartment and posts the picture with the apartment's coordinates baked in. The buyer knows your address before you've agreed on a meeting.
"as photo" in a messenger usually stripped social feed usually stripped screenshot never had any "as file", "as document" goes out intact listing, forum, email goes out intact └─ "usually" means check, not trust
That "usually" isn't a hedge for style. Every platform has its own policy and it changes. The only way to know for sure about one specific file is to look inside it yourself.
How to view photo metadata
Open the photo metadata viewer and cleaner and drop a file on it. It shows everything it finds: coordinates on a map, the camera, the time, the name. The file never leaves your device. It's read inside the browser tab, and no network request happens at all. You don't have to take that on faith: open your browser's developer tools, the Network tab, and do it again. Nothing new shows up.
Three steps, one minute:
- Grab a photo from your gallery, not from a messenger. One the camera actually shot.
- Drop it onto the tool.
- Read what's there. If there are no coordinates, either your camera never wrote them or the file already went through a service that stripped them.
If it comes up empty, there's nothing to remove, and that's a useful answer too.
How to remove location from a photo: three levels
You can deal with this in three places, and the first one works best because once it's done you don't have to remember the other two.
1. Don't write it in the first place. Turn off location for the camera. On iPhone: Settings → Privacy & Security → Location Services → Camera, then tap Never. On a Pixel: open the Camera app's settings and turn off "Save location". On Samsung it's called "Location tags", on Xiaomi "Save location info". This won't stop the serial number and model, those get written every time.
2. Strip it from photos you already took. In Google Photos, open the photo, open its info, and tap "Remove location". On iPhone, open the photo in Photos, tap the More button, then Adjust Location, then No Location. When you share from an iPhone, you can also tap Options in the share sheet and turn off Location for just that send. All of these remove only the coordinates. The model, serial and time stay.
3. Scrub everything before it goes out. This is where the tool earns its keep: it cuts out the whole EXIF section, plus XMP and IPTC, serial number and timestamp included, and doesn't touch a single pixel. The picture stays exactly the same, it just had the note pulled out of it. The color profile stays on purpose, because without it your colors shift, and it's no threat to your privacy.
[ ] camera location turned off
[ ] coordinates removed from old shots
[ ] file run through the cleaner
before sending
└─ the third one covers what the
first two can't reachHonestly, here's what I'd do: turn off camera location once and forget it, and use the cleaner only before listings and attachments. Scrubbing every photo is pointless, but a file that's about to land on somebody else's site is worth one minute.
What metadata removal doesn't fix
Pulling the note out of the file doesn't hide everything. Three things stay with you:
- The picture itself. A street sign in the background, a license plate, a reflection in a mirror. No cleaner removes that. You have to look with your own eyes.
- Your address on the network. The site you upload to sees your IP address (your connection's number, like a house number) and guesses your city from it. What exactly it can see is in what can someone do with my IP address.
- Your browser fingerprint. A site recognizes you without any files at all: screen size, fonts, time zone. How that works and what to do about it is in browser fingerprinting explained.
Metadata is what you hand over yourself, along with the file. The rest is told by your address and your browser, and those are different tools: a VPN hides the address, and what your browser is showing right now is one click away.
One more habit from the same family: the links you share carry tags too. What's baked into them and how to clean it is one click over at link cleaner.
If the tool shows you a field you don't recognize and you'd rather not dig through it yourself, hand the list to an AI.
Help me understand what's in my photo's metadata
and which of it is a problem.
What the tool showed: (list the fields, e.g.
coordinates, camera model, serial number,
time, name).
Where I'm about to send the file:
(marketplace listing / forum / messenger as a
file / email / other).
Tell me which fields I should remove for this
specific case and why, and which are harmless.
If you need more info, ask.In short
A photo from your camera carries coordinates down to the house, a serial number, a timestamp and sometimes a name. Messengers and social feeds usually strip that; files, listings, forums and email send it as is. Turn off camera location once, and before you hand a file to somebody else's site, run it through the metadata cleaner. It removes every service field and leaves the picture alone.
