EXIF and GPS checks before publishing photos
Before publishing photos, check EXIF, GPS, the date and time, visible clues, and the result after metadata removal.
Before publishing a photo, check not only what is visible in the image, but also the information stored inside the file.
A typical example is EXIF.
EXIF may include the date and time the photo was taken, camera or smartphone model, lens information, orientation, editing software, and in some cases GPS location information.
When posting photos anonymously, even if faces or names are hidden, location information or the date and time left in EXIF can reveal routine places or activity time.
This article organizes how to check EXIF, GPS, the date and time a photo was taken, and visible clues before publishing photos.
The basics of EXIF and GPS themselves are covered in "Basics of EXIF and GPS information."
What is EXIF?
EXIF is information about how and when a photo was taken, stored inside the photo file.
Images taken with smartphones or digital cameras may have technical information about the shot attached.
| Information | Content | Anonymity caution |
|---|---|---|
| Date and time taken | When the photo was taken | Connects with activity time or posting time |
| Model name | Smartphone, camera, lens | Becomes a clue to the device owned |
| GPS | Latitude, longitude, altitude | Directly shows shooting location or routine places |
| Orientation and size | Image orientation, resolution | Becomes a clue to editing or shooting environment |
| Editing software | App used for processing | Becomes a clue to work environment or device |
Not every image has EXIF.
Social media and messaging apps may remove some metadata on upload.
However, which information is removed differs by service and settings.
Do not assume "this service should remove it." Check it yourself before publication.
GPS information is an especially strong clue
Among EXIF information, GPS information is an especially strong clue.
Latitude and longitude directly show the shooting location.
If GPS remains in photos taken at home, at work, at school, at frequently visited shops, hospitals, stations, event venues, and similar places, your routine places may become directly visible.
| Shooting location | What may become visible |
|---|---|
| Around home | Residential area or routine places |
| Workplace or school | Affiliation or commute destination |
| Hospital or consultation location | Personal circumstances |
| Event venue | Activity participated in and time |
| Travel destination | Movement history or inferred companions |
GPS does not disappear through vague wording in the text.
Even if the body text says "somewhere in Tokyo," that is meaningless if exact coordinates remain in the image file.
The date and time taken are also used for correlation
Even without GPS, the date and time a photo was taken matter.
The date and time connect with posting time, travel time, event time, work hours, school events, and similar information.
For example, suppose someone posts a photo from an event anonymously.
If the date and time remain in the image, the posting time is close, and part of the venue appears in the background, it becomes material for narrowing who was there.
EXIF does not always identify a person by itself.
However, it becomes stronger when combined with the photo background, post content, account, and posting time.
Visual clues remain even if EXIF is removed
Removing EXIF or GPS does not make a photo safe.
The appearance of the photo itself also contains clues.
| Visual clue | Example |
|---|---|
| Background | Signs, buildings, stations, shop names, outside a window |
| Reflections | Mirrors, glass, metal, screen reflections |
| People | Faces, clothing, name tags, uniforms, belongings |
| Text | Documents, notifications, whiteboards, shipping labels |
| Videos, Live Photos, and similar media | Audio, environmental sound, movement before and after, place names |
Removing metadata is necessary.
However, it is one part of photo checking.
For anonymity, check both "information inside the file" and "information visible in the image."
What to check before publication
Before publishing a photo, check in the following order.
| Order | What to check | Reason |
|---|---|---|
| 1 | Whether EXIF exists | Check whether information about the shot remains |
| 2 | GPS information | Check whether shooting location remains |
| 3 | Shooting date and time | Check whether it connects with posting time or activity time |
| 4 | Model name | Check whether owned devices or work environment are exposed |
| 5 | Image appearance | Check background, reflections, text, and people |
| 6 | Recheck after removal | Check whether processing succeeded |
What matters is checking not only before removal but also after removal.
Depending on the tool or app, only some information may be removed.
Also, editing or resaving may add different metadata.
Common photo publication failures
EXIF and GPS failures do not necessarily happen through special attacks.
They can happen simply by posting a photo taken with a smartphone without checking it.
| Failure | What happens |
|---|---|
| Posting a photo taken at home without checking it | GPS or background reveals routine places |
| Posting a photo immediately after an event | Shooting date/time and posting time reveal participation |
| Sharing a photo taken at work or school | Affiliation or activity range is inferred |
| Not checking after image editing | Editing software name or update time remains |
| Assuming social media will remove it | The removal scope for each service is not checked |
For example, suppose someone posts a photo from an anonymous account as "a view I found today."
The body text does not include a place name.
However, if GPS remains, the location where the photo was taken is visible. Even if GPS is gone, the date and time, background signs, buildings, station names, brightness of the sky, and posting time can combine to narrow the place and time considerably.
For anonymity, look not at whether one piece of information was removed, but at how much the remaining information can combine.
Do not overtrust automatic removal by services
Social media and messaging apps may remove metadata on upload.
This is convenient, but anonymity should not be entrusted to it completely.
| What to watch | Explanation |
|---|---|
| Removal scope differs by service | GPS may disappear while other information remains |
| Specifications change | Information that was removed before is not guaranteed to always be removed |
| You hand it over before upload processing | The original file may reach the service side |
| It is hard to check after publication | Copies and saves spread after posting |
| Visual information does not disappear | Backgrounds, reflections, text, and people remain |
For low-risk everyday posts, automatic processing by the service may be enough in some situations.
However, for anonymous activity, source protection, whistleblowing, and posts you do not want family or a workplace to know about, check locally before upload.
Official tool for checking
ExifTool is a representative local tool for checking EXIF and GPS.
ExifTool is a tool that can check metadata in many file formats, including images. On the official site, you can check supported formats, tag lists, usage, and update information.
URL : https://exiftool.org/
From the perspective of anonymity, what matters is that it can check locally rather than requiring you to upload a file to an external site.
However, using ExifTool does not automatically make a file safe.
You need to read the displayed information, remove unnecessary information, and recheck after removal.
For high-risk photos, not publishing is also a choice
Photos are media with a large amount of information.
EXIF, GPS, backgrounds, reflections, people, belongings, clothing, shadows, weather, shooting angle, and image quality can all contain various clues.
Processing and removal can reduce risk, but not every clue can necessarily be removed safely.
For photos involving sources, whistleblowing, protest activity, household circumstances, children, workplaces, or schools, deciding not to publish is also a countermeasure.
For anonymity, think not only about "how to remove it," but also about "whether it is better not to release it."
Summary
EXIF is information about how and when a photo was taken that can remain in photo files.
It may include the date and time, model name, editing software, GPS information, and similar data.
GPS information in particular is a strong clue that directly shows the shooting location or routine places.
When publishing photos anonymously, even if you remove place names from the body text, anonymity becomes weaker if coordinates remain in the image file.
However, removing EXIF does not remove information left in the visible appearance of the photo.
Check backgrounds, reflections, signs, faces, clothing, text, and notifications too.
Before publishing a photo, check EXIF, GPS, the date and time, appearance, and recheck after removal as a set.
Related tools
Google Lens
An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.
URL : https://lens.google/
ExifTool
An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.
URL : https://exiftool.org/
MAT2
An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.