I was asked this question recently, and it is a good one — because it is exactly the question we ask ourselves, and one I have given a great deal of thought to.
What interests me is the metadata inside photos, and what it exposes in terms of privacy, tracking, identification, online safety and copyright. That same information can serve forensic purposes too.
Privacy concerns, metadata and photo analysis
It is well known by now that photos contain more than image data. When that extra information is used in a way it was never intended for, reasonable privacy questions follow.
The metadata in a photo may reveal:
- The date and time the photo was taken.
- The location. This matters if you intended to keep that private — the photo may have been taken at your workplace or your home.
- Personal details such as your name, a serial number, a hardware identifier or device information, any of which can support tracking or forensic work.
- The camera and hardware used.
- Thumbnails held in various metadata sections. These matter enormously if you blacked out part of a photo but left the thumbnails intact, because the original content can often be recovered from them.
- Photo signatures — trait analysis of the image itself to judge the likelihood that two photos came from the same scene or the same camera.
- Metadata generated by analysis rather than by the camera, such as face detection or text extracted from the image.
- Whether the image contains faces, text or other detail that deep pattern analysis can surface.
Hidden metadata beyond EXIF
The question mentioned EXIF specifically, but identifiable information is not limited to EXIF. Plenty of other sections can expose or leak information: XMP, MPF (which may itself contain further EXIF), IPTC, Photoshop, Adobe, XAP and XAP-Ext, along with proprietary blocks.
Some cameras and devices embed serial numbers or unique references that can be used for tracking. Copyright fields are sometimes added automatically, which may include your name. That is entirely reasonable if it was your intention — but it also provides a means to identify you, your company, your brand or the name you operate under.
Different camera models and phones favour different metadata types, and some embed proprietary content whose contents are not disclosed at all. You can see a breakdown of which sections popular cameras and phones write at snapWONDERS devices.
So can I just delete the metadata and be safe?
You can certainly remove metadata, and doing so helps prevent tracking and identification. But “delete the metadata and there is no problem” is not quite true. It depends on two things: how you shared the photo, and what is in the picture itself.
How you share it
Nothing stops an app or a website you upload to from adding its own metadata, used in ways you never see. Attaching a unique reference to content and associating it with a person — through an account or a device — is a mechanism for learning patterns, inferring relationships and building behavioural profiles.
And an absence of visible metadata does not guarantee an absence of tracking. Steganography, the practice of concealing a message or file inside another file, can carry information in the image data itself.
What is in the picture
The technology to detect faces, perform recognition, and extract text from images is not speculative — it is in routine use. Which means a photo stripped of metadata can later be analysed and have new metadata generated from its contents.
Picture several photos of you shared across different sites. Analysis of each generates two or three keywords from the content. Statistically, your photo is now associated with those keywords. Go further and it becomes possible to infer names, locations and other identifying detail. The more media that exists, the more relationships can be drawn between it.
Metadata, in other words, can be reconstructed after it has been deleted.
What to do about it
The practical answer is to look at your own files rather than assume. You can run a photo through the snapWONDERS analysis tool for a report on the privacy, tracking, hidden metadata and copyright concerns it carries.