The Hidden Privacy Risk in Your Photos: GPS Metadata
September 15, 2026
Most people know a photo shows what was in front of the camera. Fewer know it can also say, precisely, where the camera was standing — sometimes down to a few metres — invisibly, unless you know to check.
What's actually in there
If location services were turned on when a photo was taken, the camera can write GPS coordinates directly into the file's EXIF metadata — latitude and longitude accurate to within a few metres, sitting quietly in the file alongside the capture date and camera model. It isn't visible when you look at the photo. It isn't mentioned anywhere in a typical sharing flow. It's simply there, readable by anyone who knows to look, using nothing more exotic than a right-click and "Properties," or any of dozens of free EXIF viewer tools.
The practical risk is straightforward once you say it plainly: a photo taken inside or immediately outside your home carries your home address. A photo from your regular coffee shop carries a location you visit predictably. String together a handful of photos shared over time and you've built a rough map of somewhere's daily movements, without that person ever having stated their address to anyone.
A real, well-documented case
In December 2012, Vice published a photo of the fugitive tech entrepreneur John McAfee, taken with an iPhone while he was hiding from Belizean authorities during a murder investigation into his neighbour's death. The photo's EXIF data still contained GPS coordinates, spotted by a Twitter user shortly after publication, which placed McAfee near Rio Dulce in Guatemala. McAfee initially claimed he'd faked the coordinates himself as a decoy; security researchers were quickly unconvinced, and by the next day he had confirmed he was, in fact, in Guatemala.
The specifics matter here because this isn't a hypothetical scare story — it's a single photo, published by a major outlet, that ended a person's attempt to conceal his location, entirely because of a metadata field nobody thought to check before publishing. The mechanism is exactly the one described above: nothing more sophisticated than reading a field that was already sitting in the file.
Which apps actually strip it — and which don't
Behaviour varies more than people assume, and it's worth knowing before you assume a platform has protected you automatically:
- Instagram, Facebook — strip GPS and other EXIF fields from photos posted publicly to feeds, Stories and Reels.
- WhatsApp — strips most EXIF data, including GPS, when you send a photo the normal way (tapping the photo/camera attachment). But if you instead attach it as a Document, WhatsApp sends the original file completely untouched — metadata and all. This distinction is easy to miss and easy to get wrong under time pressure.
- Signal — strips EXIF metadata from photos by default before sending, consistent with its general privacy-first design.
- Gmail — does not strip EXIF data. A photo attached to an email carries its full metadata to the recipient, and to anyone else who later gets hold of that email.
- Discord — generally strips EXIF from JPEG uploads, but behaviour is less consistent for PNG files and can vary by how the file is sent.
The pattern worth remembering isn't a specific list that will inevitably go stale — it's that stripping is a deliberate feature some platforms built and others didn't, and the safest assumption for anything not on a confirmed-strips list is that your metadata is travelling with the file.
What to actually do about it
Two straightforward options, depending on the situation:
- Turn off location tagging for your camera app if you don't specifically need it — on iPhone, Settings → Privacy & Security → Location Services → Camera → Never. This stops the problem at the source rather than requiring you to remember to clean every photo afterward.
- Strip metadata before sharing a specific photo you're unsure about, particularly over email, direct file transfer, or any platform not confirmed to strip it. Converting the image — through this site's own image compressor or any of the format converters, with the "Keep photo metadata" option switched off — produces a file with the metadata deliberately removed rather than accidentally retained.
Worth noting explicitly: this is the one case on this entire site where our default of preserving metadata is the wrong setting for the job. Preservation is right for your own archive; stripping is right for anything leaving your hands. The toggle exists precisely because the correct answer depends on where the photo is going, not on some universal rule.
Related
Common questions
How do I check if a photo of mine has GPS data in it?
On Windows, right-click the file → Properties → Details, and scroll to the GPS section. On Mac, open it in Preview and use Tools → Show Inspector. If coordinates are listed, the photo is carrying your location.
Does converting a photo's format automatically remove GPS data?
Not necessarily — it depends entirely on the converter. Many strip all metadata as an accidental side effect of how they work (see our piece on what EXIF data is), which does remove GPS data along with everything else. This site's converters preserve metadata by default but let you switch it off deliberately when you want a clean file.
If I turn off location for my camera, do old photos still have GPS data?
Yes — turning off location services only affects photos taken afterward. Any photo already tagged keeps its existing GPS data until you specifically strip it.
Is GPS the only privacy-sensitive thing in a photo's metadata?
It's the most direct one, but camera serial numbers and precise timestamps can also be used to correlate photos across accounts or establish exactly when and with what device an image was taken, which matters in some threat models even without location data attached.