guide · privacy
What Is EXIF Data? What Your Photos Reveal
Updated October 28, 2026 · 7 min read
direct answer
EXIF data (Exchangeable Image File Format) is the metadata block your camera or phone writes into every photo: the camera make, model and often its serial number, the exact date and time of the shot, exposure settings, and — when location services are on — the GPS coordinates where you stood. Anyone who receives the original file can read all of it in seconds. To see what yours reveals, drop a photo into the free Photo Metadata Remover; to remove it before sharing, the same tool strips it losslessly in your browser.
A photo is two things: the image you see, and a paper trail you don't. This guide walks the paper trail — every field EXIF records, who writes it, who can read it, and how it differs from the XMP and IPTC blocks that often ride along.
EXIF data, defined in one paragraph
EXIF is a standard, first published by JEIDA in 1995, for tucking a structured record into an image file. Technically it is a small TIFF block embedded in a JPEG (and, with slight variations, in PNG, WebP, TIFF and HEIC files). The block carries the camera's own account of the shot: what device took it, when, with which lens and settings, and usually where. The image pixels and the EXIF block travel together in one file — copy the file, and you copy the record with it.
A typical phone photo carries 40 to 80 EXIF fields. Most are harmless optics data. Four or five are privacy-sensitive: location, timestamps, device identifiers, and whatever the photographer typed into the author or comment fields.
The fields that matter, field by field
Every camera writes a slightly different set, but these are the ones that appear again and again — and what each one tells a stranger:
| Field | What it records | What it reveals about you |
|---|---|---|
GPSLatitude / GPSLongitude | Where the shutter fired, to about 4 metres | Your home, workplace, school run, hotel, habitual routes |
DateTimeOriginal | The exact second you took the photo | Routines, alibis, when a house was empty |
Make / Model | Camera or phone manufacturer and model | Which device you own — useful for targeted phishing |
BodySerialNumber | The camera body's serial number | Links every photo back to one physical device, worldwide |
LensModel | Lens make and focal length | Confirms a high-end kit; narrows who the photographer is |
Software | The last editor that saved the file | "Adobe Lightroom", "Photoshop" — proof of post-processing |
Artist / Copyright | Who the camera owner typed in, once, years ago | A real name attached to every photo that device takes |
UserComment | Free text some apps and cameras write | Notes, filenames, app identifiers left in by accident |
Orientation, ExifVersion, ISO, FNumber | Technical shooting data | Harmless — this is the part that helps photographers |
The serial number deserves a special mention. Camera manufacturers stamp each body's serial into every shot, and law enforcement has used matching to convict burglars who photographed themselves with stolen cameras. The feature exists to fight grey-market gear and theft; the side effect is that your camera leaves a fingerprint in every file it produces.
EXIF vs XMP vs IPTC — the three blocks most photos carry
"Remove the metadata" usually means EXIF, but a shared photo can carry up to three separate records, written by different software at different times:
| Block | Written by | Typical contents |
|---|---|---|
| EXIF | The camera or phone at capture time | Device, serial, lens, exposure, timestamp, GPS, orientation |
| XMP | Adobe apps, editors, asset libraries (XML) | Edit history, labels, ratings, keywords, sometimes the original filename |
| IPTC | Press and stock workflows | Caption, byline, credit, location names, usage rights |
The practical consequence: clearing EXIF in one app can leave XMP and IPTC untouched. Edit history in XMP has exposed "untouched" press photos, and IPTC captions have outlived the crops that were supposed to bury them. A proper strip removes all three.
Who writes EXIF — and who can read it
Writers: every phone camera, every dedicated camera, most drones and scanners. Editors then append: Lightroom adds XMP, Photoshop may add its own working history, and some photo apps write the account name into the Artist field automatically. Nothing about this is hidden or malicious — the standard was designed to help photographers organise their work.
Readers: anyone who holds the file. No special access is needed — the block sits in plain bytes near the start of the file. Concretely, the full record is readable by:
- The direct recipient of the original file — a buyer on a marketplace, a stranger you AirDrop to, an email attachment recipient
- Anyone who downloads an image from a site that does not strip it — many forums, marketplaces and file hosts keep EXIF intact
- Any free online "EXIF viewer" — which is also why pasting a sensitive photo into a random viewer site just moves the exposure from the file to the upload
Three ways this actually bites people
- The marketplace sale. List an item "collection only", attach the original photo, and the GPS field has just published your home address to anyone who checks. This is the single most common real-world EXIF leak.
- The dating-app or forum photo. Sent privately, stripped by nothing. The recipient learns your phone model, the exact time you were there, and quite possibly the coordinates.
- The byline that follows you. Type your name into your camera's Artist field once and every photo that device ever takes carries it — including the ones you share anonymously.
Journalists, activists and anyone reporting from a sensitive situation have stronger reasons still: device identifiers and location data have been used to attribute photos to specific people. Guides for source protection treat EXIF stripping as a baseline step, not an extra.
What the platforms do with it
The big social platforms re-encode uploads and drop most EXIF from the copy they serve — which is why photos posted to Instagram or Twitter generally do not leak GPS. But the strip happens on their copy, not yours, and it does not cover every channel:
- Strips metadata: Instagram, Facebook, WhatsApp, Signal, most messenger apps that re-encode media
- Keeps the file intact: email attachments, AirDrop, Nearby Share, Google Drive and Dropbox shared links, USB sticks, direct downloads from cloud folders
- Varies: Discord and Telegram keep EXIF on standard uploads (Telegram only strips it if you choose "send as compressed photo"), and marketplace sites differ policy by policy
The safe assumption: any channel that delivers the original bytes delivers the metadata. Strip before sending, and the channel stops mattering.
Screenshots are the exception that proves the rule
A screenshot has no camera behind it, so it has no EXIF block — no GPS, no serial, no capture settings. It carries only file-system dates and, on some systems, a screen-recording flag. That is why "screenshot it instead" became folk wisdom for sending a photo safely: it genuinely works, at the cost of quality and resolution. For anything you did not screen-grab, the metadata is still there.
see it yourself in five seconds
Photo Metadata Remover — viewer and stripper in one
Drop a photo in and the tool lists every field it found — GPS, serial, timestamps, XMP — then removes them losslessly when you ask. It runs entirely in your browser, so the photo never leaves your device.
Open the removerFrom here
- Want to see the hidden fields on any device? Read How to View Photo Metadata on Windows, Mac, iPhone and Android.
- Ready to remove them before a send? Read How to Remove EXIF Data from Photos — every manual method and where each one fails.
faq
Frequently Asked Questions
The four questions that come up right after "what is EXIF".
Do all photos have EXIF data?
No. Camera photos and phone photos almost always do. Screenshots do not — they are re-drawn by the graphics system and carry no camera block, only file dates. And many platforms strip EXIF on upload: Instagram, Facebook, WhatsApp and Twitter remove most of it from the copy they serve, while email attachments, AirDrop, Google Drive links and direct file transfers deliver it intact.
Is EXIF data personal data under GDPR?
It can be. GPS coordinates, device serial numbers and the photographer name field can each identify a person directly or combine with other data to do so, which places them within the GDPR definition of personal data. Publishing someone's photo without stripping their location or device identifiers can therefore be a data-protection issue, not just a courtesy question.
How can I see a photo's EXIF data without installing anything?
On Windows, right-click the file, open Properties and read the Details tab. On macOS, open the file in Preview and press Command-I. On an iPhone, open the photo in Photos and swipe up; on Android, open it in Google Photos and swipe up. For the complete list including GPS and serial numbers, drop the file into a browser-based viewer that parses it locally, such as the free Photo Metadata Remover on this site.
Does converting a photo to JPEG or PNG remove EXIF?
It depends on the converter, not the format. A full re-encode through an editor usually drops the original EXIF block, which is why exporting from WhatsApp or a screenshot tool yields a clean file — but many converters copy metadata across by design to preserve copyright and camera information. Never assume a conversion cleaned the file; open the output and check, ideally with a metadata viewer.