Your holiday photo knows where your house is. So does the picture of the sofa you listed for sale, the snapshot you sent a stranger on a forum, and the one you attached to an insurance claim. None of them look like they carry an address, and all of them might.
EXIF data is the block of information a camera writes into every photo it takes. Coordinates, the exact second the shutter fired, the camera body's serial number, the lens, the exposure settings and often the name of whoever set the camera up. It travels inside the file, invisible in every viewer, and it goes wherever the file goes.
What is EXIF data, in one paragraph
EXIF stands for Exchangeable Image File Format. It is a standard for storing structured information inside an image file, alongside the picture but separate from it. Your camera writes it, editing software adds to it, and most viewers ignore it completely.
The practical version: a photo is two things stuck together. There is the picture, which is what you see, and there is a small database describing how the picture came to exist. Deleting one does not touch the other, which is why removing the metadata leaves the image untouched.
EXIF meaning explained, field by field
The list is longer than most people expect. Here is what a typical phone photo actually contains.
- GPS coordinates — latitude and longitude accurate to a few metres, plus altitude and a separate satellite timestamp in UTC.
- Camera make and model — the manufacturer and the specific body or phone.
- Serial number — many interchangeable-lens cameras write the body's own serial into every frame.
- Three timestamps — when the shutter fired, when the image was digitised, and when the file was last written.
- Exposure settings — shutter speed, aperture, ISO, focal length, metering mode, white balance, flash state.
- Orientation — a flag telling viewers which way up to display pixels that were saved sideways.
- Software — the name and version of whatever last edited the file.
- Artist and copyright — free text fields that cameras will happily fill with your full legal name.
You can see all of this for a photo of your own in our EXIF viewer, which reads the file inside your browser rather than uploading it. Most people are surprised by the serial number and the artist field rather than by the GPS, which they have at least heard of.
Why cameras store metadata at all
Not to spy on you. The format was designed in the mid-1990s to solve an ordinary problem: film photographers had notebooks, and digital photographers had nothing.
Before EXIF, working out why one frame came out sharp and the next did not meant remembering what you did. Recording the settings in the file made a photographer's workflow enormously easier, and it still does. Culling a shoot by aperture, checking which focal length you actually use, discovering that your hand-holding limit is slower than you assumed — all of that comes free because the camera wrote it down.
Location tagging arrived later, driven by phones, and it was added for the same reason: your photo library becomes searchable by place. That feature is genuinely good, and it is also the single field most likely to cause you harm. Both things are true, which is why the honest advice is to keep the data and control where the file goes, rather than to treat the camera as the enemy.
The IPTC and XMP difference, without the standards jargon
Three metadata systems can coexist in one file, and they overlap confusingly.
EXIF is written by the camera and describes the act of taking the photo. It is technical and mostly automatic.
IPTC came from the news industry and describes the content: caption, keywords, the photographer, the agency, usage rights. A press photo carries IPTC because a picture desk needs to know what it shows and who to pay.
XMP is Adobe's format and is essentially a flexible container that can hold both of the above plus anything an application invents. Lightroom stores your edit history in it. It is XML, so it can carry arbitrary structure, and it is often where the surprises hide.
The catch is duplication. The same photographer's name can sit in an EXIF artist field, an IPTC byline and an XMP creator property simultaneously, written by three different programs at three different times. A cleaner that only understands EXIF removes one of the three and leaves you feeling safe. Any tool worth using removes all of them, which is why our stripper drops XMP and IPTC records alongside the EXIF block.
Which fields identify you, ranked honestly
Not all metadata is equally sensitive, and treating it as one undifferentiated blob leads people to either panic or ignore it.
Genuinely identifying. GPS coordinates come first by a wide margin — they turn a photo of a room into a street address. The camera body serial number comes second and is underrated: model tells someone you own a common camera, while a serial number links every photo you have ever posted under any name to one physical device. Artist and copyright fields carrying your real name are third.
Contextually revealing. Timestamps establish a pattern of life if someone collects enough of them. Software fields say which tools you own. Lens and body together suggest what your kit is worth, which matters if a listing photo shows the outside of your house.
Harmless. Aperture, shutter speed, ISO, metering mode, white balance. Nobody has ever been found from an f-stop.
The awkward part is that these live in the same block. There is no format-level way to publish the exposure record and withhold the coordinates — you either keep the block or you drop it. Our photo GPS lookup exists because location is the field most people want to check on its own.
How the data gets lost, and why that confuses people
Metadata is fragile in ways that have nothing to do with privacy settings.
Every re-encode is a chance to drop fields. Messaging apps rewrite images and lose most of the block. Social platforms strip on upload. Some editors preserve everything, others quietly discard anything they do not understand, and email clients vary by client and by whether the image was inlined or attached.
This is why two copies of the same photo can show different metadata, and the one with more fields is simply the one that travelled a shorter path. It is also why an empty result is ambiguous rather than reassuring: the camera may never have written anything, or something along the way may have removed it, or the file may use a container the reader could not parse. We cover which platforms remove what in our test of social media metadata stripping.
What EXIF cannot do for you
It is not evidence. This gets said too rarely by people who build metadata tools.
Every field described above can be rewritten in seconds with freely available software. A timestamp can be moved, a camera model invented, coordinates copied from a completely different photo. AI-generated images typically carry almost no metadata, and nothing stops someone pasting convincing camera fields onto one after the fact.
So a rich and internally consistent metadata block is weak supporting evidence, and a missing one proves nothing whatsoever. Treat it as corroboration for a story you already have from elsewhere. We work through what actually holds up in whether EXIF data can be trusted.
The short version
Knowing what is EXIF data changes one habit, and it is a small one. Before a photo goes somewhere public — a listing, an advert, a profile, a forum — look at what is inside it, and decide deliberately instead of by default.
Most of the time the answer is that nothing needs doing. When it does, the checklist for cleaning a photo before posting takes about a minute, and turning tagging off at source using your camera's location settings means you rarely have to think about it again.