What a photo knows about you
A picture taken on a phone carries where it was taken, when, on what device and sometimes with which serial number. Most of that survives being emailed. Some of it survives being posted.
Every camera and every phone writes a block of descriptive data into each file it produces. For photos it is called EXIF, and it lives inside the JPEG or HEIC. For video it is the metadata in the MP4 or MOV container, and for phone footage it follows the same conventions. The data was designed for photographers, so they could see later what lens and exposure they had used. It was not designed with the thought that the file would be sent to strangers, and it is not removed when it is.
What is in there
A photo from a current phone typically carries:
- Location. Latitude, longitude, altitude, and the direction the camera was pointing, to within a few metres. This is the one that matters. A photo of a cat on a sofa, posted with its EXIF intact, is a map to the sofa.
- Time. The moment of capture to the second, including the time zone on newer devices.
- Device. Make and model, and the operating system version. On dedicated cameras, often the body's serial number, which ties every photo from that camera to every other.
- Settings. Exposure, aperture, focal length, flash, white balance. Harmless, but part of a fingerprint.
- Software. What edited the file last, and sometimes when.
- An embedded thumbnail. A small copy of the image stored inside the file for fast previews. Some editors regenerate it when you crop; some do not, which has in the past left the uncropped original visible inside a photo the owner believed they had cropped.
A video from a phone carries the equivalent: a creation time, the device, the encoder, and, on iPhones and most Android phones with location enabled, a location tag in the ISO 6709 format that reads like +51.5074-000.1278/. It also often carries the orientation the phone was held at, which is why a clip that looks right in one player plays sideways in another that ignores the tag.
You can see all of it, for any file, with the metadata viewer. The file does not leave your machine to be read, which for a tool whose whole purpose is showing you what a file reveals seems like the minimum.
What survives sharing
This is the part people get wrong in both directions. The large social platforms, Facebook, Instagram, X and the like, strip EXIF from photos on upload and re-encode the image. A photo posted there does not carry its location to the people who see it. (It carried it to the platform, which keeps it.) Messaging apps vary: WhatsApp and Signal strip metadata from images sent as photos, but a file sent "as a document" goes through untouched, and that option exists precisely to preserve quality. Email preserves everything. Cloud storage links preserve everything. A marketplace listing, a forum attachment, a file added to a shared drive, a photo sent to a tradesperson or a landlord: everything.
Video is worse, because platforms are less consistent about re-muxing it and because the location field sits in a part of the container that generic tools do not touch.
So the rule is simple. Assume metadata survives unless you know the specific path strips it, and if the file is going anywhere that is not a major social network's photo uploader, deal with it yourself.
Stripping it
For a photo, the metadata remover decodes the picture and writes it out again without its EXIF, XMP and IPTC blocks, including the embedded thumbnail. That is a re-encode, because a JPEG cannot be copied byte for byte with one block removed by the tool underneath, so the page has a quality control and defaults it high enough that the difference is not visible. For video, it copies the streams unchanged into a new container with the metadata and chapters dropped, so there is no re-encoding and no quality loss. In FFmpeg terms that is -map_metadata -1 -map_chapters -1 -c copy.
There is one subtlety worth knowing about, because it shows how metadata leaks in unexpected ways. FFmpeg itself writes a tag naming its own version into every file it produces. It is harmless, but it is metadata you did not choose, and a file that says "Lavf60.16.100" in its encoder field tells anyone who looks that it was processed. The tool here adds -fflags +bitexact by default, which suppresses that tag and leaves the file with nothing in the field at all.
Check the result. Run the output through the viewer and confirm the location and device fields are gone. A strip tool that silently leaves the location tag in a MOV because it only knew about JPEG EXIF is not hypothetical; it is common.
What stripping does not do
Metadata is what the file says about itself. Removing it does not change what the file shows, and the picture is usually more revealing than the tags.
- A street sign, a shop front, a reflection in a window, a view from a balcony: any of these locates a photo without coordinates, and people are remarkably good at it.
- Faces locate and identify people. If that is the concern, the face blur tool covers them, and it does so in the pixels, which is the only place it counts.
- Sensor noise is unique to a camera. With enough photos known to be from one device, a new photo can be matched to it by its noise pattern alone. This is forensic-grade work and not something a casual viewer does, but it exists, and no amount of EXIF removal touches it.
- A screenshot of a photo carries the screenshotting device's metadata, not the camera's. People use this as a stripping technique and it works, at the cost of quality and of whatever was in the status bar at the top.
A reasonable habit
Turn off location tagging in the camera app if you never want it; both iOS and Android have a per-app switch for it. Leave it on if you like having your own photos mapped, and strip before sending instead. Either way, before a photo or video goes to anyone outside a platform that you know strips it, look at it once in the viewer and run it through the remover. It takes four seconds, it happens on your own machine, and it means the file that leaves is the picture and nothing else.