Privacy
What a single photo tells a stranger
A walk through the metadata in one ordinary phone photo, field by field, and what each one gives away.
Updated
Abstract warnings about metadata rarely land. It is more useful to look at one file.
Here is what an ordinary photo, taken on a phone and sent to someone, typically carries.
Location, to the metre
GPSLatitude 37.774983 N
GPSLongitude 122.419400 W
GPSAltitude 52 m
GPSImgDirection 291.4°Not a city. A point, with an altitude that implies a floor, and a bearing that says which way the camera was facing.
Three or four photos taken over a fortnight are usually enough to distinguish a home from a workplace from a gym, purely from which coordinates repeat and at what times of day.
A device fingerprint
Make Apple
Model iPhone 15 Pro
LensModel iPhone 15 Pro back triple camera 6.86mm f/1.78
BodySerialNumber ...The model narrows you to millions of people, which is fine. The serial number does not. It is unique, it is written into every photo that camera takes, and it links them all together — including across accounts that have no other connection to each other.
Photographers are more exposed here than phone users. A camera body’s serial number is stamped into every frame, and it appears in public work, in files sent to clients, and in anything uploaded to a stock library.
A preview of what you removed
ThumbnailImage (7.8 kB binary)This is the field people find most surprising. Cameras store a small preview inside the EXIF block. Some editors regenerate it when you edit; others do not.
If you cropped someone out of a photo, or blurred a document, and the thumbnail was not regenerated, the original framing is still sitting in the file. This has embarrassed people in public ways.
Your name
Artist Jane Photographer
Copyright (c) 2026 Jane Photographer
CreatorTool Adobe Photoshop 25.0Usually not deliberate. Editing software asks for a name once, during setup, and writes it into everything thereafter.
The edit history
xmpMM:DocumentID xmp.did:8f2e...
xmpMM:History created / saved / converted ...XMP records a document identifier that persists across saves, plus a chain of what happened to the file. Two images that look unrelated can be tied to the same original by that identifier.
Timestamps
DateTimeOriginal 2026:03:14 09:26:53
OffsetTime -07:00Individually meaningless. Across a set, they describe when you wake, when you commute, and when your home is empty.
The reasonable response
Not paranoia. Just a default.
Most of this exists for good reasons — exposure data teaches photographers, copyright fields support licensing, orientation stops photos appearing sideways. The problem is that all of it is on by default and invisible by design, so it gets shared by people who have no idea it is there.
So: know what is in the file, remove what identifies you, keep what makes the file work. That is why rotation and colour profile survive by default here, and location, serial numbers and names do not.
You can look at one of your own photos without uploading it anywhere. It is usually more persuasive than reading about it.