Is removing metadata illegal?

Short answer: no. Removing metadata from a file you own is legal in the United States, the United Kingdom, the EU and every other jurisdiction we are aware of. It is your file, and the metadata is a record about you that you did not consent to publish.

The long answer is more interesting, because there are four situations where it stops being that simple. None of them apply to the ordinary case — a person cleaning a holiday photo before posting it — but each one catches people who assumed the ordinary case covered them.

This is a description of how the rules work, not legal advice. If a specific matter turns on it, ask a lawyer.

The default: your file, your record

Metadata is data your camera wrote about you. Coordinates, a device serial number, the second of capture, sometimes your name. No law requires you to carry it, and no platform requires you to supply it. Deleting it is the same category of act as cropping the picture or renaming the file.

This is worth stating plainly because the question is usually asked nervously, as if metadata were a kind of official record. It is not. It is a byproduct of how cameras write files.

Where it gets complicated

1. Evidence and litigation

The one that actually matters. If a file is evidence in a legal proceeding — active, or one you reasonably anticipate — deleting anything about it can be spoliation of evidence. Metadata is frequently the point: it establishes when a photo was taken and by what.

The offence is not “removing metadata”. It is destroying evidence, and metadata is evidence. Sanctions run from an adverse inference instruction to dismissal, and in some circumstances to criminal liability.

If a file is or might become part of a dispute, do not clean it. Keep the original untouched and take a copy if you need one to share.

2. Copyright management information

US copyright law protects a specific category of metadata: copyright management information, or CMI, under 17 U.S.C. § 1202. Removing or altering it can carry statutory damages — but only when done knowingly and with intent to induce, enable, facilitate or conceal infringement.

The intent requirement is the whole thing. Stripping the author field from your own photograph is not covered. Stripping the author field from someone else’s photograph so you can pass it off as unattributed is exactly what the provision exists for. The EU has a parallel provision in the InfoSoc Directive.

Practical consequence: if you are handling other people’s images, do not strip the copyright fields. Our tool keeps them by default for this reason, and you have to opt in to their removal.

3. AI content disclosure

The newest one, and the reason this question is being asked far more often than it was two years ago.

C2PA Content Credentials — the signed provenance manifests written by ChatGPT, DALL·E, Adobe, Google and others — are not the same as EXIF. They exist specifically so that AI-generated content can be identified as such. The EU AI Act includes transparency obligations for synthetic content, and several platforms now require disclosure independently of any law.

Removing a Content Credential is not itself a criminal act in most places. Removing one in order to present AI-generated content as authentic — in journalism, in evidence, in a marketplace listing, in an election — is where the exposure sits, and where the rules are tightening fastest.

We built C2PA removal and we are direct about the line: it exists so you can strip the prompt text, seed and account identifiers that these manifests also carry, which are personal data with no bearing on disclosure. If you are publishing AI-generated content, disclose it in the caption. That obligation was never satisfied by an invisible field, and removing the field does not discharge it.

4. Contracts and industry rules

Not law, but enforceable. Photo agencies, stock libraries, news wires and many client contracts require IPTC credit and licensing fields to survive. Press associations treat metadata stripping as a serious matter. Breaking any of these is a contractual problem rather than a legal one, and it will cost you the relationship either way.

What is actually risky

Notice what the four exceptions have in common. In every one, the problem is not the removal — it is misrepresenting something to someone. Evidence, authorship, provenance, licensing. The metadata is incidental; the deception is the offence.

Which means the honest version of the rule is short:

Removing metadata from your own file, for your own privacy, is legal. Removing it to make something look like something it is not may not be, and that is true whether or not metadata is involved.

The one that catches people out

The most common real-world mistake in this whole area is not legal at all. It is deleting your only copy.

Metadata is often the thing that proves a photo is yours — when you took it, on what device, before anyone else published it. If you strip a file and discard the original, you have thrown away your own provenance. That matters if the image is ever disputed, stolen or scraped.

Keep the originals. Clean the copies you share. Our tool never modifies the file you drop in — it hands back a new one — and nothing is ever uploaded, so there is no version of your original sitting on a server anywhere either.