When you take a photo on a phone, the camera writes two things into the file: the image itself, and a block of text describing it. That text is EXIF data. It records the shutter speed, the ISO, the phone model, the date and time — and, if location was enabled, the GPS coordinates of where you were standing.
Most of the time this is invisible and harmless. The problem is that it travels with the file. Send that photo by email, drop it in a shared folder, post it to a forum or hand someone a USB stick, and the coordinates go with it. People have been located at home addresses, hostels and shelters from photos posted publicly.
What is actually inside
Not every photo carries everything, but a typical phone photo can contain:
| Field | What it reveals |
|---|---|
| GPS latitude and longitude | Where the photo was taken, often within a few metres |
| GPS timestamp | When you were at that location |
| Date and time | Your routine, if several photos are compared |
| Device make and model | Which phone you own |
| Serial number | Sometimes a unique identifier for the device |
| Software and firmware | Version information that helps fingerprint the device |
| Orientation and editing history | Whether the file was edited, and with what |
Scanned documents are a separate case: a scanner can embed the device name, the operator name and sometimes the machine's network path. That is a real problem for documents sent to employers or institutions.
Who strips it, and who does not
This is where most advice goes wrong. The answer depends entirely on how the file travels.
Usually stripped for you: WhatsApp, Telegram, Instagram, Facebook, X and most chat apps re-encode images before uploading. The copy that leaves your phone has no GPS data, because the app created a new file. The original on your phone still has it.
Usually not stripped: email attachments, Google Drive, Dropbox, WeTransfer, AirDrop, Bluetooth transfer, a website upload form, and anything sent as "original quality" or "as a file". These move the bytes unchanged, so the metadata arrives intact.
The trap is the mixed case: an app that strips location but keeps the device serial number, or a mail client that strips metadata from inline images but not from attachments. You cannot tell by looking, which is why it is worth removing it yourself before anything important leaves your device.
How to remove it
Renaming the file does nothing. The metadata is inside the file structure, not in the name. You need to either rewrite the image or use a tool that explicitly deletes the metadata blocks.
- Look first. Open the photo in the EXIF viewer to see exactly what is in it. If there is no GPS entry, you already have less to worry about.
- Strip it. The EXIF remover rewrites the image without the metadata blocks. The pixels stay the same; the description is deleted. It runs in your browser, so the original file never leaves your device.
- Check the copy. Run the cleaned file back through the viewer. If GPS is gone and the photo still looks right, you are done.
Removing metadata also makes the file smaller — sometimes noticeably, because the thumbnail preview and maker notes are part of the file too.
On the phone itself
Both major phone platforms can remove location from future photos entirely, which solves the problem at the source if you do not need geotagged images:
- iPhone: Settings → Privacy & Security → Location Services → Camera → set to "Never". Existing photos keep their data; you can remove it per photo from the Photos app's info panel.
- Android: open the camera app's settings and turn off "Location tags" or "Save location". The exact wording depends on the manufacturer.
If you do want geotagged photos for your own records, leave the setting on and strip the data only from the copies you share. That is the more practical arrangement for most people.
Documents are not exempt
PDFs carry metadata too: author name, the software that created the file, sometimes the original file path and the machine's user account. If you are sending a CV, an invoice or a signed form, it is worth cleaning. The PDF metadata tool shows and removes those fields, and Sanitize PDF goes further and clears embedded scripts and hidden objects.
The short version
Assume any file you send as an attachment still contains everything it had when it was created. Social apps are the exception, not the rule. If the photo was taken at home, at a workplace or anywhere you would not publish, strip the metadata before it leaves your device — it takes a few seconds and it cannot be undone afterwards.