Learn

284 articlesCategory: All
Metadata

EXIF and GPS checks before publishing photos

Before publishing a photo, check not only what is visible in the image, but also the information stored inside the file.

A typical example is EXIF.

EXIF may include the date and time the photo was taken, camera or smartphone model, lens information, orientation, editing software, and in some cases GPS location information.

When posting photos anonymously, even if faces or names are hidden, location information or the date and time left in EXIF can reveal a daily activity area or activity time.

This article organizes how to check EXIF, GPS, the date and time a photo was taken, and visible clues before publishing photos.

The basics of EXIF and GPS themselves are covered in "Basics of EXIF and GPS information."

What is EXIF?

EXIF is information about how and when a photo was taken, stored inside the photo file.

Images taken with smartphones or digital cameras may have technical information about the shot attached.

InformationContentAnonymity caution
Date and time takenWhen the photo was takenConnects with activity time or posting time
Model nameSmartphone, camera, lensBecomes a clue to the device owned
GPSLatitude, longitude, altitudeDirectly shows shooting location or daily activity area
Orientation and sizeImage orientation, resolutionBecomes a clue to editing or shooting environment
Editing softwareApp used for processingBecomes a clue to work environment or device

Not every image has EXIF.

Social media and messaging apps may remove some metadata on upload.

However, which information is removed differs by service and settings.

Do not assume "this service should remove it." Check it yourself before publication.

GPS information is an especially strong clue

Among EXIF information, GPS information is an especially strong clue.

Latitude and longitude directly show the shooting location.

If GPS remains in photos taken at home, at work, at school, at frequently visited shops, hospitals, stations, event venues, and similar places, your daily activity area may become visible directly.

Shooting locationWhat may become visible
Around homeResidential area or daily activity area
Workplace or schoolAffiliation or commute destination
Hospital or consultation locationPersonal circumstances
Event venueActivity participated in and time
Travel destinationMovement history or inferred companions

GPS does not disappear through vague wording in the text.

Even if the body text says "somewhere in Tokyo," that is meaningless if exact coordinates remain in the image file.

The date and time taken are also used for correlation

Even without GPS, the date and time a photo was taken matter.

The date and time connect with posting time, travel time, event time, work hours, school events, and similar information.

For example, suppose someone posts a photo from an event anonymously.

If the date and time remain in the image, the posting time is close, and part of the venue appears in the background, it becomes material for narrowing who was there.

EXIF does not always identify a person by itself.

However, it becomes stronger when combined with the photo background, post content, account, and posting time.

Visual clues remain even if EXIF is removed

Removing EXIF or GPS does not make a photo safe.

The appearance of the photo itself also contains clues.

Visual clueExample
BackgroundSigns, buildings, stations, shop names, outside a window
ReflectionsMirrors, glass, metal, screen reflections
PeopleFaces, clothing, name tags, uniforms, belongings
TextDocuments, notifications, whiteboards, shipping labels
Videos, Live Photos, and similar mediaAudio, environmental sound, movement before and after, place names

Removing metadata is necessary.

However, it is one part of photo checking.

For anonymity, check both "information inside the file" and "information visible in the image."

What to check before publication

Before publishing a photo, check in the following order.

OrderWhat to checkReason
1Whether EXIF existsCheck whether information about the shot remains
2GPS informationCheck whether shooting location remains
3Shooting date and timeCheck whether it connects with posting time or activity time
4Model nameCheck whether owned devices or work environment are exposed
5Image appearanceCheck background, reflections, text, and people
6Recheck after removalCheck whether processing succeeded

What matters is checking not only before removal but also after removal.

Depending on the tool or app, only some information may be removed.

Also, editing or resaving may add different metadata.

Common photo publication failures

EXIF and GPS failures do not necessarily happen through special attacks.

They can happen simply by posting a photo taken with a smartphone without checking it.

FailureWhat happens
Posting a photo taken at home without checking itGPS or background reveals daily activity area
Posting a photo immediately after an eventShooting date/time and posting time reveal participation
Sharing a photo taken at work or schoolAffiliation or activity range is inferred
Not checking after image editingEditing software name or update time remains
Assuming social media will remove itThe removal scope for each service is not checked

For example, suppose someone posts a photo from an anonymous account as "a view I found today."

The body text does not include a place name.

However, if GPS remains, the location where the photo was taken is visible. Even if GPS is gone, the date and time, background signs, buildings, station names, brightness of the sky, and posting time can combine to narrow the place and time considerably.

For anonymity, look not at whether one piece of information was removed, but at how much the remaining information can combine.

Do not overtrust automatic removal by services

Social media and messaging apps may remove metadata on upload.

This is convenient, but anonymity should not be entrusted to it completely.

What to watchExplanation
Removal scope differs by serviceGPS may disappear while other information remains
Specifications changeInformation that was removed before is not guaranteed to always be removed
You hand it over before upload processingThe original file may reach the service side
It is hard to check after publicationCopies and saves spread after posting
Visual information does not disappearBackgrounds, reflections, text, and people remain

For low-risk everyday posts, automatic processing by the service may be enough in some situations.

However, for anonymous activity, source protection, whistleblowing, and posts you do not want family or a workplace to know about, check locally before upload.

Official tool for checking

ExifTool is a representative local tool for checking EXIF and GPS.

ExifTool is a tool that can check metadata in many file formats, including images. On the official site, you can check supported formats, tag lists, usage, and update information.

URL : https://exiftool.org/

From the perspective of anonymity, what matters is that it can check locally rather than requiring you to upload a file to an external site.

However, using ExifTool does not automatically make a file safe.

You need to read the displayed information, remove unnecessary information, and recheck after removal.

For high-risk photos, not publishing is also a choice

Photos are media with a large amount of information.

EXIF, GPS, backgrounds, reflections, people, belongings, clothing, shadows, weather, shooting angle, and image quality can all contain various clues.

Processing and removal can reduce risk, but not every clue can necessarily be removed safely.

For photos involving sources, whistleblowing, protest activity, household circumstances, children, workplaces, or schools, deciding not to publish is also a countermeasure.

For anonymity, think not only about "how to remove it," but also about "whether it is better not to release it."

Summary

EXIF is information about how and when a photo was taken that can remain in photo files.

It may include the date and time, model name, editing software, GPS information, and similar data.

GPS information in particular is a strong clue that directly shows the shooting location or daily activity area.

When publishing photos anonymously, even if you remove place names from the body text, anonymity becomes weaker if coordinates remain in the image file.

However, removing EXIF does not remove information left in the visible appearance of the photo.

Check backgrounds, reflections, signs, faces, clothing, text, and notifications too.

Before publishing a photo, check EXIF, GPS, the date and time, appearance, and recheck after removal as a set.

Related tools

Reverse image search

Google Lens

An external resource related to this article. Open it only when it fits your situation and threat model.

Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.

URL : https://lens.google/

Open external site
Metadata inspection

ExifTool

An external resource related to this article. Open it only when it fits your situation and threat model.

Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.

URL : https://exiftool.org/

Open external site
Metadata removal

MAT2

An external resource related to this article. Open it only when it fits your situation and threat model.

Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.

URL : https://0xacab.org/jvoisin/mat2

Open external site

Related articles