What photo metadata reveals: Exif, IPTC and XMP

A photo carries three separate ledgers

A JPEG is not only pixels. In front of the image data there is room for three independent metadata standards, and most tools do not clear all three at once.

• Exif: the technical ledger the camera writes. It is defined by CIPA DC-008, borrows the TIFF tag structure, and records whatever the device knew at the moment of capture.
• IPTC: the publishing ledger. Photographer name, copyright notice, caption, subject and usage rights live here, and agencies and archives run on those fields.
• XMP: the XML-based ledger Adobe introduced. Editing software stores history, applied adjustments and usually a duplicate of the IPTC fields in it.

The three can hold the same fact in different places. A tool reporting "Exif removed" says nothing about the copy sitting in the XMP packet, so any audit has to ask all three.

What is actually written

An ordinary phone photo typically carries:

• Location: GPS latitude, longitude and altitude plus a GPS timestamp. Coordinates are stored as degrees, minutes and seconds and are accurate to street level.
• Time: DateTimeOriginal gives the moment of capture. Recent devices also write OffsetTimeOriginal, so the file reveals not just when you took the shot but which time zone you were in.
• Device identity: make and model, and separate fields for body serial number and lens serial number. A serial number proves two unrelated photos came off the same camera.
• Optics and settings: lens make and model, focal length, aperture, exposure time, ISO, flash.
• Software traces: the Software tag and the XMP history show which programs touched the file and sometimes in what order.
• Embedded thumbnail: Exif carries a small preview in a separate image directory.

The thumbnail can differ from the edited image

This is the sneakiest item on the list. The embedded thumbnail is a separate image, and an editor is under no obligation to regenerate it. Crop a photo to remove someone at the edge, or paint over a region to hide it, and the old thumbnail inside the Exif block may still show the frame as it was. Visually the file looks clean, while a small copy of what you removed travels along inside it. Looking at the picture will never reveal this; you have to extract the thumbnail and inspect it separately.

The concrete risk: a reshared photo and a home address

The danger is rarely one field on its own. Someone photographs an item at home for a classified listing, a buyer downloads the file and reposts it somewhere else. Even if the first platform stripped the metadata, a copy sent through a messaging app as a document still carries the coordinates. Those coordinates are street-level and land on the front door of a specific building.

Timestamps add a second layer. Line up the coordinates and clock times of several photos the same person posted over weeks and a pattern of when they are at home falls out of it. Serial numbers then act as the joining key: if photos from two pseudonymous accounts carry the same body serial number, the two accounts can be linked on technical evidence alone.

What platforms strip, and what they leave

Rather than generalising, it is better to test, because the same platform behaves differently on different paths. Three patterns do repeat.

• Anything that re-encodes usually strips. If a site regenerates your upload at its own dimensions, the output is a new file and most fields do not survive. Your copyright and byline vanish in the same step, so stripping is not always in your favour.
• Paths that preserve the original preserve everything. Sending a file as a chat "document", as an email attachment or through a cloud link is meant to deliver the bytes intact. The metadata stays intact with them.
• Displayed is not the same as stored. An app that does not show a location in its interface has not necessarily removed the coordinates from the file. The reverse happens too: a platform can keep the full original on its servers and strip only the copy it serves out.

One rule survives all of this: clean the file before you upload it. Verify what leaves your machine rather than assuming what the platform does next.

A screenshot is not a reliable anonymiser

The usual advice is to screenshot the photo and share that instead. It does genuinely destroy the original Exif block, and it introduces three new problems.

First, a screenshot is a file too, with metadata of its own: the model of the device that took it, a creation timestamp, and on some systems screen dimensions and software version. Second, everything visible in the frame is preserved. If your photo app shows a location label, an album name or a filename along the top, the detail you thought you deleted is now baked into the pixels. Third, and most important, what usually gives away a location is not the coordinate but the picture: a street sign, a house number, the view from the window, a shop in the background. Metadata hygiene does not touch any of that.

Removing information from inside the image is a different job. The logic behind the PDF redaction tool transfers directly: covering something with a black rectangle is not the same as deleting what sits underneath. For a photo the clean answer is to actually cut the region out of the frame with the crop tool.

What happens when you clean a file

There are two ways to remove metadata and they do not produce the same result.

Dropping the blocks. Removing the Exif, IPTC and XMP segments without touching the image data. The pixel data stays identical at the bit level, nothing is re-compressed, and quality does not move. The Exif remover works this way, and the whole operation runs in the browser: reading the file, listing the fields and producing the cleaned copy involve no request to a server, and what you download is a blob the page built locally.

Re-encoding. Drawing the image onto a canvas and writing a fresh JPEG or WebP. That also drops the metadata blocks, because the new file is written from scratch, but the image is compressed again so quality shifts slightly. The image compressor and the HEIC to JPG converter take this route in the browser. Losing location fields during a HEIC conversion is a common side effect on iPhone photos, but it is a side effect, not a privacy feature to rely on.

One distinction worth knowing about this site: some image tools do their work on the server. The resize and crop flows upload the file first and process it there. If you are preparing a sensitive image, order the steps accordingly: strip the metadata in the browser first, then do the resizing.

How to verify the file is clean

File properties are not enough, because the operating system surfaces a small selection of the fields that exist. The only solid check is to read the file back.

1. Feed the cleaned file to the same reader and confirm the remaining field list is empty.
2. Check separately that the embedded thumbnail is gone; a surviving preview is the most informative leftover.
3. Ask about the XMP packet explicitly, because some tools drop Exif and leave XMP behind.
4. Compare file sizes. A drop of a few tens of kilobytes usually means the thumbnail went; no change at all suggests nothing was removed.
5. For batch exports, sample several files from the output rather than checking one.

When keeping the metadata is the right call

Wiping every photo should not be the default. For a lot of work the metadata is infrastructure rather than baggage.

• Copyright and attribution: the creator, copyright notice and contact fields in IPTC are your first evidence when an image is used without permission. Stripping them removes your own protection.
• Cataloguing: without capture date, location and keywords, an archive of tens of thousands of files stops being searchable. Digital asset management software is built on exactly those fields.
• Learning your craft: the record of aperture, ISO and focal length is the only way to review your own shooting habits later.
• Evidentiary value: for insurance, damage assessment and incident reports, time and location data strengthen the file rather than endangering it.

The right approach is therefore selective rather than total. Keep the archive copy complete and remove only location, serial numbers and software history from the copy you hand out. A tool that can strip individual categories is more useful than one that only has an all-or-nothing button.