privacy
Does Your Photo Leak Your Home Address? How EXIF and GPS Metadata Work
What EXIF actually stores, exactly what your phone records when you take a photo, which apps strip it and which don't, and how to check and remove it without uploading the photo anywhere.
Search “does my photo have GPS location” and most results walk you through checking — then tell you to fix it by uploading the photo to some website. For a task that’s specifically about not exposing your location, handing the photo to a server is exactly backwards. Here’s how EXIF and GPS metadata actually work, and how to check and strip it without the photo ever leaving your device.
What EXIF actually is
EXIF (Exchangeable Image File Format) is a block of structured metadata embedded inside a JPEG (and, in a similar form, HEIC/TIFF) alongside the pixel data. It’s organized into IFDs — Image File Directories — each holding a set of tagged fields: camera make and model, exposure settings, orientation, timestamp, and, when available, a dedicated GPS IFD holding location data. The pixels and the metadata sit in the same file but are otherwise unrelated; you can strip every tag in the GPS IFD without touching a single pixel.
The GPS IFD isn’t one field, it’s several:
- GPSLatitude / GPSLongitude — stored as three rational numbers (degrees, minutes, seconds), not a single decimal
- GPSAltitude — elevation, when the sensor provides it
- GPSTimeStamp / GPSDateStamp — a timestamp separate from the file’s own creation date, from the GPS fix itself
- GPSImgDirection — which way the camera was pointing when the photo was taken, if the phone’s compass was active
- GPSSpeed — occasionally present if you were moving
Put together, that’s not “roughly where you were” — it’s a fix precise enough to identify a specific address, plus which direction you were facing when you took it.
How precise is “precise”
GPS coordinates in EXIF are stored with enough numeric precision to represent fractions of a second of arc, but what matters practically is decimal degrees: each additional decimal place of latitude/longitude roughly divides the location error by ten. Five decimal places gets you to about a meter; six decimal places gets you to roughly 10 centimeters — closer than “which house” down to “which window.” Most phone GPS chips don’t achieve true 10cm real-world accuracy (urban multipath and atmospheric error dominate long before the number format does), but the point stands: the file format has more than enough resolution to pin an exact address, and a phone with a good fix comes close to it.
When your phone actually records GPS — and when it doesn’t
This is the part most “does my photo have GPS” articles skip: it’s conditional, not automatic.
- Location Services must be on, per app. On iPhone, Settings → Privacy & Security → Location Services → Camera has its own toggle, independent of the system-wide switch. Same idea on Android under per-app permissions. If Camera’s location access is off, new photos simply won’t have a GPS IFD — there’s nothing to strip because nothing was recorded.
- Screenshots generally carry no GPS EXIF at all. A screenshot doesn’t come from the camera sensor pipeline — it’s a capture of the screen buffer — so there’s no GPS fix to attach. (Screenshots absolutely still carry other risks, like device model and, on some platforms, minimal capture-time metadata — just not location.)
- Airplane mode / no GPS fix at the moment of capture can mean the phone recorded a stale or missing fix rather than an accurate one.
- Downloaded or forwarded images carry whatever metadata the original capture device wrote — a photo someone sent you keeps their GPS data, not yours, until something strips it.
What social platforms strip — and what doesn’t
The common assumption is “I post photos on Instagram, so I’m fine.” Public feeds on the major platforms — Instagram, Facebook, X, TikTok — generally strip EXIF, including GPS, from the version other users can view or download. That’s genuinely true for the downloadable file. It does not mean the platform never saw the data: several of these services read GPS and other metadata at ingestion, before stripping it from the public copy, and may retain or use it internally. If your threat model includes the platform itself and not just other users, public-feed stripping doesn’t help you.
Where it gets inconsistent is everywhere that isn’t a public social feed:
- Email attachments — typically pass through untouched. Whatever EXIF was in the file when you attached it is what arrives.
- Cloud drives (Google Drive, Dropbox, iCloud Drive) — store the file as-is; metadata survives.
- Messaging apps vary by mode: sending a photo “as a document/file” (WhatsApp’s Document mode, Telegram’s File mode) typically preserves the original including metadata, while the normal “photo” send mode in many apps recompresses and strips.
- AirDrop and Signal are both commonly cited as preserving EXIF by default, since they’re built around sending the file rather than re-encoding it for a feed — worth confirming current behavior in-app since defaults do change.
The practical takeaway: the only leak you fully control is the one you strip yourself, before the photo leaves your device. Relying on “the app I’m using probably handles it” is a bet on a setting you don’t control and can’t verify from your end.
How to check GPS data natively (no upload)
You don’t need a tool to see whether a photo has location data — every major platform exposes it:
| Platform | Where to look |
|---|---|
| iPhone | Photos app → open photo → swipe up for info panel → location shown on a small map if present |
| Mac | Preview → Tools → Show Inspector → GPS tab (or Photos app → Info panel) |
| Android | Google Photos → open photo → swipe up / tap ⓘ for details → location shown if present |
| Windows | File Explorer → right-click photo → Properties → Details tab → GPS section |
That covers checking. Removing it natively is spottier — some OS-level share sheets have a “remove location” toggle buried in the share options, but it’s inconsistent across versions and doesn’t handle batches.
The no-upload way to check and strip it
For a proper look at everything a file is carrying — not just GPS, but camera make/model, lens, exposure, software tags, and any XMP/IPTC data — use the Image Metadata Viewer. Drop a photo in and see exactly what’s embedded, GPS coordinates included, entirely in your browser.
To actually remove it, use the EXIF Remover. It strips EXIF, GPS, XMP, and IPTC data from JPG, PNG, and WebP files, and for JPEG it’s lossless — the pixel data is untouched, only the metadata block is removed. Drop in a whole folder and it batch-processes the set. Because it’s a client-side tool, nothing about the fix depends on trusting a server with the exact data you’re trying to protect.
One caveat: if your photos are in HEIC (the default format on recent iPhones), run them through HEIC to JPG first — we’ve covered why iPhones default to HEIC and the tradeoffs in Why Does My iPhone Save Photos as HEIC. Once you have a JPG, the EXIF Remover strips it cleanly.
Check the pixels too
Stripping metadata handles the invisible leak. It doesn’t touch anything visible in the image itself — a face, a street sign, a screen reflection, or a password you tried to hide with a blur. If you’re cleaning up a screenshot before sharing it, read Why Blurring or Pixelating a Screenshot Doesn’t Actually Redact It before you assume a blur filter did the job. Between stripping the metadata and properly redacting the visible content, that’s the actual pair of steps — not one or the other.
Both of those are about a file you chose to share. There’s a third channel you don’t choose: the details your browser hands to every site you visit, which combine into an identifier that survives clearing your cookies. Browser fingerprinting explained covers how that works — and why adding more privacy tweaks can make you easier to track, not harder.