privacy
exif
security

EXIF metadata and privacy, and why GPS data should never reach your users

Phone photos can carry GPS coordinates in their EXIF metadata. Learn what the tags hold, how to check your own images, and how to strip them before delivery.

By Focal team 21 September 2026 5 min read

A phone photo can carry the exact place where someone took it, hidden inside the file. If your site serves that file unchanged, anyone who downloads it can read the location. This post explains what Exchangeable image file format (EXIF) metadata is, which tags hold location data, how to check your own images, and how to strip the data without breaking orientation or colour.

What EXIF is

EXIF is a standard block of metadata that cameras and phones write into image files. The Camera & Imaging Products Association (CIPA) publishes it as the CIPA DC-008 specification. JPEG files carry EXIF in an APP1 segment. EXIF is not limited to JPEG. The WebP container defines an optional EXIF chunk, and the PNG specification defines an eXIf chunk that holds the same EXIF structure.

The tag list in ExifTool’s documentation shows what a typical camera file can record:

Make and Model, the camera or phone that took the photo
SerialNumber, which the EXIF specification calls the body serial number
DateTimeOriginal, when the photo was taken
Orientation, how the camera was held
Artist, a free-text name field
GPSInfo, a pointer to a separate block of Global Positioning System (GPS) tags

What the GPS tags hold

ExifTool documents the GPS tags as a separate image file directory (IFD) inside the EXIF data. The tags that matter most for privacy are these:

GPSLatitude and GPSLongitude, the coordinates, with GPSLatitudeRef and GPSLongitudeRef for north, south, east and west
GPSAltitude, the height above sea level
GPSDateStamp and GPSTimeStamp, the date and the Coordinated Universal Time (UTC) of the fix
GPSImgDirection, the direction the camera faced
GPSHPositioningError, the horizontal accuracy of the fix

Apple’s personal safety guide explains where this data comes from on an iPhone. When Location Services is on for the Camera app, the phone uses cellular, Wi-Fi, GPS and Bluetooth information to record the coordinates where each photo is taken.

A public example

In December 2012, Vice published a photo of John McAfee, who was then wanted for questioning in Belize. NPR reported that the magazine posted a picture taken with an iPhone and forgot to remove the location metadata. The Next Web read the GPS coordinates and placed the photo in Guatemala, near the Belize border. McAfee confirmed the next day, in a post on his website, that he was in Guatemala.

The same exposure happens whenever a site publishes a phone photo without removing its metadata.

Where this matters for a store or app

Location data reaches a site through ordinary workflows:

Customers upload photos with product reviews.
Sellers on a marketplace photograph items at home.
Staff photograph stock in a warehouse or a home office.
Users set a profile photo taken on their phone.

In each case the uploader may not know the file contains a location. If the site stores the original and serves it as it is, every visitor can download the file and read the tags.

How to check an image

ExifTool reads every tag in a group when you pass the group name with All. This command prints all GPS tags in a file:

exiftool -gps:all photo.jpg

An empty result means the file has no GPS tags in the EXIF GPS block. Coordinates can also live in Extensible Metadata Platform (XMP) metadata. ExifTool’s geotagging feature writes EXIF by default and updates XMP tags that already exist. Run exiftool photo.jpg without options to see every tag in the file.

How to strip it

ExifTool’s documentation gives the commands:

# Delete all metadata from the file
exiftool -all= photo.jpg

# Delete only the GPS tags
exiftool -gps:all= photo.jpg

The documentation warns against deleting all metadata from RAW camera files, other than Digital Negative (DNG) files, because proprietary RAW formats keep information in the maker notes that is needed to convert the image. That warning is about RAW files, not the JPEG, PNG or WebP files a site delivers.

By default ExifTool keeps a backup of each file it edits, named with an _original suffix, such as photo.jpg_original. That backup still holds the GPS tags. Delete it, or pass -overwrite_original when you already have separate backups.

Running these commands by hand misses files. Put the step in the upload pipeline, so the pipeline cleans every file without anyone remembering to do it.

Two things to keep when you strip

The Orientation tag matters for display. Browsers rotate images according to their EXIF orientation by default. MDN documents the CSS image-orientation property, whose initial value from-image uses the EXIF data to rotate the image. A pipeline that deletes the tag without first rotating the pixels can make a portrait phone photo show sideways. ExifTool can put a single tag back after a full delete with its -tagsfromfile option. Its documentation shows the pattern, and this command applies it to the orientation tag:

exiftool -all= -tagsfromfile @ -orientation photo.jpg

The colour profile is the other one. An ICC profile, named after the International Color Consortium, is not EXIF data. It tells the browser how to interpret the colour values. Focal’s strip_icc() filter removes the profile. The file gets smaller, but the colours can shift.

Strip at delivery and at upload

Stripping at delivery cleans every image a visitor receives, including files uploaded years ago. Stripping at upload cleans the stored original. You need both when the originals are reachable. An image service that reads from a public bucket leaves the untouched originals at their public URLs, and anyone who finds those URLs can download the full metadata.

How Focal handles EXIF

Focal removes EXIF metadata from every image it delivers, whether or not the URL asks for it. Focal keeps the colour profile unless the URL includes strip_icc(). Focal reads from an origin that must be publicly readable over HTTPS, so your originals stay reachable at their own URLs. Strip GPS tags at upload as well. The Focal docs list the filters.

To test your own pipeline, take a portrait photo on a phone with location turned on and upload it the way a customer would. Download the delivered image and the stored original, then run exiftool -gps:all on both. Both should print nothing, and the delivered image should display upright.