Your "Original" Photos May Expose Your Home Address: A Look at EXIF Privacy in Images

Not long ago I saw a post: someone posted a landscape photo taken from a window at home on a social platform, tagged "straight out of camera". In the comments, someone used the photo's EXIF data to obtain the latitude and longitude of the shooting location, then mapped it to a specific residential complex.

This is no joke. As long as you take photos with a phone, the photo records the shooting location by default (provided you've given the camera app location permission). This information lives in the photo's EXIF data, and many people never notice it when sharing images.

What's in EXIF

EXIF (Exchangeable Image File Format) is a piece of metadata embedded in JPEG and TIFF files. When you take a photo with a phone, EXIF typically records:

• Shooting date and time
• Camera/phone model
• Aperture, shutter speed, ISO, and other shooting parameters
• GPS latitude and longitude (if location is enabled)
• Photo orientation (landscape or portrait)
• Sometimes a thumbnail

On macOS, open a photo in Preview, press Cmd+I to view details, and the GPS tab shows the coordinates. On Windows, right-click the file → Properties → Details shows a portion as well.

For photographers, EXIF is a great thing: you can review shooting parameters and learn from others' settings. For ordinary users, EXIF is more like an invisible leak point.

Scenarios to watch

Sharing originals on social media. WeChat, Weibo, and Twitter compress images during upload, and EXIF is usually stripped in that process. So posting to Moments is fine. But if you send an "original" image, such as via email attachment, cloud link, or platforms that don't compress (Telegram sends originals by default), the EXIF goes with it.

Second-hand transactions. Selling something on Xianyu, taking a photo of the home environment as background. If the original is uploaded, a buyer could theoretically extract your address from the photo.

Work documents. Some company internal systems upload files without EXIF cleaning. You take a picture of a whiteboard and upload to a project management system; the photo may contain the precise location of the office.

News and PR. Media has reported that some official photos carried the editor's computer username and software serial number in EXIF. Not location data, but still information that shouldn't be exposed.

How to remove EXIF

There are several methods, depending on your use case.

Batch processing with command line

If you're comfortable with terminal, ExifTool is the most capable tool:

# Remove all EXIF from a single photo
exiftool -all= photo.jpg

# Batch remove from all photos in a directory
exiftool -all= -overwrite_original ./photos/

# Remove only GPS info, keep shooting parameters
exiftool -gps:all= photo.jpg

On macOS you can install with brew install exiftool; Linux distros have it in their package managers.

Processing with a Python script

If you need to strip EXIF automatically in business logic (for example when users upload avatars), Python's Pillow library can do this:

from PIL import Image

def strip_exif(input_path, output_path):
    img = Image.open(input_path)
    data = list(img.getdata())
    clean_img = Image.new(img.mode, img.size)
    clean_img.putdata(data)
    clean_img.save(output_path)

This method works by creating a new Image object that only copies pixel data, without metadata. Simple and crude, but effective.

Online tools

If you don't want to install software, online tools work too. I personally use glazlo.com/remove-metadata. It processes locally in the browser: you select the file, EXIF is removed in the browser, and the processed file is never uploaded anywhere.

The reason I chose it is simple: some photos I need to clean contain sensitive content (internal product screenshots), and I'm not comfortable uploading them to a third-party server. Browser-side processing avoids that problem.

Usage is simple: drag the file in, click, download the processed file. If the photo's orientation is correct (the EXIF orientation tag matches the actual pixels), it doesn't recompress the image, only strips metadata. If the orientation is off (some phones rely on the EXIF orientation tag to correct display), it first rotates the pixels to the correct direction, then removes EXIF. This detail is handled well; some tools strip EXIF and leave the photo sideways.

Mobile processing

On iOS, when sharing a photo you can choose "Exclude Location" (in the option at the top of the share menu). On Android, different brand photo apps handle it differently, some support it, some don't.

If you often share originals, consider installing a dedicated EXIF cleaning app and run photos through it before sharing.

A few easy-to-miss points

PNG has no EXIF, but has other metadata. PNG uses tEXt and iTXt chunks to store metadata. Not as rich as EXIF (no GPS), but it may contain software name, creation time, etc. If you're sharing screenshots, PNG is generally safer than JPEG, but not completely.

WebP and HEIC have metadata too. Both formats support embedded EXIF. Don't assume a newer format is immune.

Thumbnail leaks. Some cameras embed a small thumbnail in EXIF. Even if you crop the sensitive content out of the main image, the thumbnail in EXIF may still show the original composition. To clean thoroughly, remove the thumbnail as well.

"Straight out of camera" is not just a photography term. Any image you share online that isn't passed through platform compression (which usually strips metadata) can carry EXIF. Work photos sent to colleagues, sample images sent to clients, all may contain information you didn't intend to share.

A suggestion

Build a habit: before sharing photos to a public place, clean the metadata. Not every time: photos sent to family and friends are fine, platforms handle it. But if a photo contains any potentially sensitive scene (home, office, child's school), spend a few seconds removing EXIF. It costs little.

Privacy isn't only important after it's leaked.