What Is Hidden
in Your Photos?

In December 2012, a Vice journalist photographed John McAfee - then a fugitive wanted for questioning in the murder of his neighbor in Belize - using an iPhone 4S. The published article included the photo with its original metadata intact. The GPS coordinates in the file were 15.658167, -88.992167, placing McAfee at a property near Rio Dulce in Guatemala. Within 48 hours, Guatemalan authorities had him in custody.

The journalist had no idea the photo contained that data. Most people never do.

Every photo taken on a modern smartphone contains a structured block of data called EXIF - Exchangeable Image File Format. The camera app writes it automatically at the moment of capture. You never see it. You never approve it. It travels silently with the file to whoever receives it, wherever it gets uploaded, unless something explicitly removes it before it leaves your device.

The most sensitive field is GPS. When location services are enabled for the camera, each photo gets the exact coordinates where it was taken: latitude, longitude, altitude, the speed the phone was moving at capture, the compass direction the lens was pointing, and a horizontal accuracy figure in meters. A reading of 5 meters accuracy is typical on modern iPhones. That puts the capture location in a circle you could walk across in a few seconds.

The device data is just as specific. The Make field reads Apple. The Model field reads iPhone 15 Pro or whatever hardware you use. The lens model and iOS version are recorded separately. Together, these fields create a consistent hardware fingerprint. Photos from the same phone, posted to different accounts, can be linked back to a single device.

Timestamps are logged with sub-second precision, including the timezone offset. A photo timestamped 07:32:14.482 +05:30 tells you the phone was in India, in the morning, on a specific date. The original capture time, the digitization time, and the last-modified time are each stored as separate fields. A collection of photos sent over several weeks establishes a daily routine.

Some files - particularly from older cameras and some phones - embed a thumbnail copy of the image inside the EXIF container itself. This thumbnail is generated before any editing. If someone cropped identifying content out of a photo and then sent the file, the embedded thumbnail may still show the original unedited version.

Apple's proprietary MakerNote block goes beyond the standard EXIF spec. It records the gravity vector from the phone's accelerometer at capture - three numeric values representing the phone's physical orientation in 3D space - and the bounding box for every face the neural engine detected in the frame, including a confidence score and pitch and yaw angles for each face. This data survives JPEG compression and is preserved in HEIC files, the default format on iPhones since iOS 11.

Instagram, Facebook, Twitter/X, and Snapchat all remove GPS coordinates from photos posted publicly. This became standard practice around 2012, after the McAfee incident and similar cases put metadata in headlines. For most everyday posting, those platforms are reasonably safe.

The risk is in the modes people do not think about. WhatsApp strips metadata when you send a photo normally, but if you use "Send as Document" - which some people do to avoid compression - the original file goes through untouched, GPS included. Telegram behaves the same way: photo mode compresses and strips, file mode preserves everything. Email has never stripped metadata, regardless of the provider. Google Drive, Dropbox, and OneDrive store files exactly as uploaded. AirDrop from an iPhone sends the complete original unless you manually toggle Location off in the Share Sheet each time - and if "All Photos Data" is enabled in your AirDrop settings, that toggle is greyed out.

There is also a detail most people miss about the major platforms: even when they strip EXIF before showing photos to other users, they keep the original file on their own servers. Instagram retains your full metadata internally. What gets stripped is what other accounts can download, not what the platform holds.

Law enforcement was one of the first institutions to routinely use EXIF data as evidence. In 2012, a hacker named Higinio Ochoa III - operating online as "w0rmer" - had been defacing police department websites and posting taunting photos to taunt investigators. The photos, taken on an iPhone 4, contained GPS coordinates pointing to South Wantirna, a suburb of Melbourne, Australia. The FBI traced the address to Ochoa's girlfriend via Facebook, identified him as her partner, and arrested him in Galveston, Texas. He was sentenced to 27 months in federal prison. The metadata is what broke the case.

Stalkers use geotagged photos differently. A single photo taken at someone's home gives a starting point. Multiple photos mapped over weeks establish when the person leaves, where they shop, where their children go to school. In 2016, Harvard researchers analyzing images from dark web drug marketplaces found 229 product listings where sellers had left GPS coordinates intact in their photos. Some had multiple shots from the same address, separated by just a few meters. The marketplaces had posted rules requiring metadata removal. The sellers did not know how to do it.

There are also less dramatic but more systematic uses. Forensic investigators use EXIF to establish when and where evidence photos were taken - or to challenge that claim, since the fields can be edited. Journalists verify the authenticity of images sent to newsrooms. Background check services crawl public social media, and photos with intact timestamps and device data add detail to a profile. Data brokers index public images at scale, and geotagged photos are more valuable because they attach location history to an identity.

You can check what is in a photo without any external tool. On Windows, right-click the file, select Properties, then the Details tab - every EXIF field is listed there, including GPS coordinates if present. There is also a "Remove Properties and Personal Information" link at the bottom of that panel that strips some fields. On a Mac, open the file in Preview or select it in Photos and press Command-I - the map tile at the top of the info panel shows the embedded location. On an iPhone, open any photo in the Photos app and swipe up. The location map appears below the image if coordinates are stored.

For anything where you need to be certain - sending to someone you do not know, uploading to a site you do not control, sharing a file by email - use a dedicated tool that reads and strips the full EXIF block before the file leaves your device. File X-Ray lets you inspect that data quickly in a browser-based workflow before you share the file.

Does removing EXIF affect image quality? No. The pixel data and the metadata are stored in separate blocks inside the file. Stripping the EXIF block leaves the image itself completely unchanged - same resolution, same colors, same file format.

Do screenshots contain GPS data? No. A screenshot is a new image generated from the current screen contents. It does not copy the EXIF from the original photo. If you screenshot a photo before sending it, the GPS coordinates are gone - at the cost of image quality, since the screenshot is a lower-quality copy of what was on screen.

Does iOS 13 and later strip GPS when sharing via Messages? Sometimes. When you share a photo using the iOS Share Sheet, an Options button appears at the top. Tapping it shows a Location toggle. Switch it off and the shared copy goes out without GPS. The problem: this must be done manually every single time you share, for every photo. There is no permanent system setting. And if "All Photos Data" is enabled in your AirDrop settings, the Location toggle is greyed out entirely - location data is included whether you want it or not.

Can EXIF data be faked? Yes. EXIF fields are plain text values that any metadata editor can write. The McAfee story has an ironic footnote: after his location was identified via the Vice photo, McAfee told reporters his team had deliberately planted false GPS coordinates to mislead authorities. He retracted this claim the next morning. But he was technically right that it is possible - and it matters for anyone using EXIF as evidence. Metadata tells you what a file claims. It is a starting point, not proof.