EXIF Metadata and Photo Privacy: What Your Images Reveal and How to Strip It

The Data You Did Not Mean to Publish

A photograph of a whiteboard, posted to help a colleague, carries the office coordinates to five decimal places. A picture of a pet, shared on a forum, carries a home address in the same field. Neither was visible on screen, and neither was intentional.

Exif — Exchangeable Image File Format, standardised by CIPA and JEITA, currently at version 3.0 — is why. The camera writes a structured metadata block into the file at capture time, and every step afterwards copies it forward unless something explicitly removes it.

What you get from this guide: where the metadata physically lives, which fields matter for privacy, what platforms actually do with them, and how to strip them without recompressing the image.

Where the Metadata Lives

In a JPEG

A JPEG is a sequence of marker segments. Each begins with 0xFF followed by a marker byte:

The key structural fact: the Exif block in APP1 is not inside the compressed scan data. It is a separate segment that a parser can skip over. That is what makes lossless stripping possible.

Inside APP1, Exif uses a TIFF-style layout: a header, then Image File Directories (IFDs) of tag entries. IFD0 holds the main image tags, IFD1 the thumbnail, and pointer tags lead to the Exif sub-IFD and the GPS IFD.

The embedded thumbnail deserves its own warning: it is a separate small JPEG stored in the metadata. If you cropped a face or a document out of a photo in some editors, the thumbnail may still show the uncropped original. Stripping metadata removes the thumbnail with it.

In a PNG

PNG is a chunk-based format. Metadata appears as ancillary chunks: eXIf for an Exif block, tEXt, zTXt, and iTXt for text pairs, tIME for modification time, and iCCP for a colour profile. Screenshots and exported graphics commonly carry the software name and timestamps here rather than GPS.

The Fields That Matter

Two under-appreciated points. Serial numbers correlate: a set of “anonymous” images sharing a BodySerialNumber came from one camera, which is a strong link even without a name. And MakerNote is opaque — it is vendor-specific and undocumented, so its contents cannot be audited. Both argue for removing metadata wholesale rather than editing individual fields.

What Platforms Actually Do

Three conclusions worth internalising:

1. Platform stripping protects the audience, not you. The platform received the original, coordinates included, and its retention and internal access rules apply to that copy.
2. The “send as file” path defeats it. Choosing document instead of photo to preserve quality also preserves the entire metadata block — the most common accidental leak among people who believe they are safe because “WhatsApp strips EXIF”.
3. Self-hosted images are entirely your responsibility. No intermediary re-encodes an image you upload to your own site. Strip at build time.

Stripping Without Quality Loss

The wrong way is to open the image in an editor and re-export it: that decodes and re-encodes the pixels, adding a generation of JPEG loss for no reason. The right way copies the compressed scan data untouched and omits the metadata segments.

// Remove APP1 (Exif/XMP) and APP13 (IPTC) segments from a JPEG, byte-level.
// Scan data (from SOS onward) is copied verbatim: no recompression.
function stripJpegMetadata(bytes) {
  if (bytes[0] !== 0xff || bytes[1] !== 0xd8) throw new Error("Not a JPEG");
  const out = [0xff, 0xd8];
  let i = 2;

  while (i < bytes.length - 1) {
    if (bytes[i] !== 0xff) break;
    const marker = bytes[i + 1];

    // SOS: copy the remainder of the file unchanged and finish.
    if (marker === 0xda) { out.push(...bytes.slice(i)); break; }

    const len = (bytes[i + 2] << 8) | bytes[i + 3];   // includes the 2 length bytes
    const drop = marker === 0xe1 || marker === 0xed;  // APP1 (Exif/XMP), APP13 (IPTC)
    if (!drop) out.push(...bytes.slice(i, i + 2 + len));
    i += 2 + len;
  }
  return new Uint8Array(out);
}

Note what this deliberately keeps: APP2, the ICC colour profile. Dropping it is not a privacy win and can visibly shift colours on wide-gamut images. Strip identity, keep rendering.

Command-line equivalents:

# exiftool: remove all metadata, no pixel re-encode
exiftool -all= photo.jpg

# Remove only location, keep exposure data for a photography portfolio
exiftool -gps:all= -xmp:geotag= photo.jpg

# Verify nothing remains
exiftool -a -G1 -s photo.jpg

The verification step is not optional. Some tools clear IFD0 but leave the GPS IFD, or clear Exif but leave an XMP packet holding the same coordinates in a different syntax.

A Practical Policy

That last row is the exception that matters: for evidence, provenance metadata is the point, and stripping it destroys the file’s value. Everywhere else, removal is the default.

Step-by-Step: Auditing and Stripping with Toolbox

1. Open the tool: visit the Toolbox EXIF Viewer & Stripper and load a photo straight from your camera roll.
2. Read the GPS block first. If coordinates are present, paste them into a map to see precisely what the file discloses — this is the step that changes people’s habits.
3. Check the device fields: Make, Model, and any serial number, which are the tags that correlate separate images to one camera.
4. Strip and export. The stripped copy retains identical pixels because the compressed scan data is copied rather than re-encoded.
5. Re-load the stripped file in the same tool to confirm the GPS IFD, XMP packet, and embedded thumbnail are all gone — not just the main IFD.
6. Then compress if needed. If the image is also going to be resized or size-limited, do that after stripping using the image compression workflow.

Outcome: images you can publish without disclosing where they were taken, on what device, or when — with visual quality byte-identical to the original and a verification pass proving the metadata actually left.

Related guides: Compressing images to an exact size · Merging and splitting PDFs locally · Prompt PII and secret redaction