Answer
Can image metadata be faked or edited?
Yes, all of it. EXIF, IPTC and XMP are plain editable fields, and rewriting them takes seconds with freely available tools. Metadata is a claim, not evidence.
Updated
There is nothing cryptographic about ordinary image metadata. EXIF is a block of tagged values sitting in front of the compressed pixel data; IPTC and XMP are the same idea in different encodings. Any of them can be read, changed or invented with widely available command-line tools, and the file remains perfectly valid afterwards. A camera model, a timestamp, a set of coordinates — all of it can say whatever someone wants it to say.
That cuts both ways, and the second direction is the one people miss. Metadata that looks incriminating may be wrong. Camera clocks drift, and a camera whose clock was never set stamps every photo with a date from the year the firmware shipped. Time zones are recorded inconsistently, so a photo can appear to have been taken hours from when it was. A GPS fix taken indoors can land the coordinates on the wrong building, or on a cell tower some distance away.
So metadata is best read as a claim made by whatever software last wrote the file, and claims are worth exactly as much as the software making them is trustworthy. In practice it is often accurate, because most files are written by a camera doing its ordinary job and nobody bothered to alter them. But "usually accurate" is a very different standard from "proof", and it does not survive anyone with a motive to change it.
This is the gap that C2PA content credentials were designed to close: a cryptographic signature over the file and its history, so that tampering is detectable rather than invisible. That is a genuinely different mechanism from EXIF, and worth understanding separately.
None of this changes the privacy calculation. Metadata that can be faked can still be read, and the coordinates in your holiday photos are real ones that you wrote yourself.
More on this: Metadata remover, What is EXIF metadata?.
Terms used here: EXIF, IPTC, XMP, C2PA.