What your photos share without you

I nearly listed a spare server on a local marketplace with an electricity bill sitting on the table behind it, in focus, address line readable at full zoom.

The location tag on that photo had already been removed. I had a script for that part. The bill was in the pixels, and no script has ever looked at pixels.

That is the whole subject in one listing.

The warning that expired

Your Instagram photos do not carry the coordinates of your house. They have not for years.

The large platforms rebuild every image on upload, mostly to cut the file size, and the metadata block does not survive the rebuild. Facebook does it. X does it. So does every service that pays to deliver the same picture a million times.

Nobody made that call for your benefit. It fell out of a bandwidth decision and privacy was the by product.

The awkward result is that anyone who tested the old warning found it false and wrote off the whole topic. Which is a shame, because the version that replaced it is harder to fix.

Which paths still carry the tags

Stripping happens at the platform. Skip the platform and nothing gets stripped.

Send the photo as an attachment on an email and the bytes arrive exactly as they left your phone. Same for a messenger where you choose send as file over send as photo, which people pick deliberately to avoid the compression. Same for a link to a file on a shared drive.

Then there is the long tail of the web. A forum. A classifieds board. A club site with an upload form somebody wrote in 2014. None of those are paying a delivery bill large enough to justify an image pipeline, so the file goes onto disk untouched and comes back out untouched.

Your own site belongs in that group. If you drag photos into a blog editor, whatever your camera wrote is now published, and you will not find out unless you check.

Cloud photo backup is the fourth case and the odd one. Nothing is stripped there because nothing is being published. That is deliberate, and it is what lets you search your own library for a beach in 2019. It also means the complete unedited record of everywhere you have been sits behind one password, which makes that password the most load bearing one you own.

The block says more than where

Coordinates get the headlines. The rest of the block does more work.

There is a timestamp accurate to the second, normally with the offset from UTC attached, so it says what timezone the camera thought it was in. There is the device model in plain words. There are the settings: exposure, aperture, focal length, ISO, the software build, which of the phone’s lenses fired, whether the flash went off.

Individually that is trivia. Collectively it groups photographs.

I watched this play out on a hardware forum where three accounts were selling suspiciously similar gear. Somebody downloaded a dozen listing photos and read the blocks. Same model, same software build, same lens, same handful of quirks in how that manufacturer writes the tags. One camera, three sellers.

It named nobody. It did not have to. The useful finding was that accounts presented as unconnected were connected, and the photo files gave that up without anybody doing anything clever.

Nothing strips the picture

Platforms take the tags. They keep the image, and the image is doing most of the talking.

Look at what ends up in frame without being invited:

• Street signs, block numbers, bus stop codes, a shopfront across the road with its name legible
• Reflections in a window, a monitor, a kettle, a pair of glasses, sometimes with the photographer in them
• A school uniform, which in Singapore identifies a specific school and therefore a neighbourhood
• Paperwork on a desk, sharp because phone cameras hold deep focus and you were not looking at the desk
• A parcel label on the box, carrying a full delivery address and a tracking number that opens the rest
• The view out of the window, giving away a height, a direction and a skyline together

All of it survives stripping, recompression, and being screenshotted twice.

And locating a place from an image stopped being specialist work. Reverse image search handles shopfronts. Street level mapping lets somebody walk a road from a desk in another country. The current image models will read vegetation, road markings, power pole design and the angle of the light out of a photo with no landmark in it at all, then hand back a short list of candidates.

I fed one of my own window shots into that pipeline to see how bad it had become. No text in the frame, nothing I would have called identifying. It returned the correct district. A person with a free afternoon closes the gap from there.

Looking at a file yourself

Do this once and it stops being theoretical.

On Windows: right click, Properties, Details. Everything is listed, and the remove properties link at the bottom of that panel strips it.

On a Mac: open in Preview, show the Inspector.

On an iPhone: open a photo, swipe up or tap the info button. A map means coordinates are attached, no map means they are not.

On Android: the same panel lives in Photos under details.

For the raw block rather than the tidy version, exiftool is free and runs on everything.

The habit worth more than any of those tools: check the file you are about to send, not the copy in your library. Some apps strip on the way out and some do not. Mail one to yourself and open what actually arrives.

When it is worth doing

Not every time. Advice that says every time gets ignored entirely.

Sending a photo to family, skip it. They know where you live.

Selling something bulky that a stranger collects from your home, strip the tags and study the background before you post the listing.

Posting under a name that is not yours, where you would rather nobody joined the two identities, strip it and look at the picture again.

Publishing anything of your home under your real name, strip it, because the cost is fifteen seconds.

The blunt method that always works: screenshot the photo and post the screenshot. A screenshot is a new file that inherits nothing, so every tag is gone. You lose a bit of quality and it takes four seconds. The tidier method on an iPhone is the share sheet, Options at the top, location off. On Android it is the photo’s details panel, remove location.

Children, and how a file gets built

This is where the pixels beat the metadata by a wide margin, and it is the point I will argue about.

A child photographed publicly each birthday hands over a date, a face at every age, and usually a first name from the caption. The uniform adds the school. The parents posting their own week adds the routine.

No single photo does any damage. The damage is cumulative, assembled over ten years, on somebody who was never asked and could not have answered.

So: ask the parent before posting somebody else’s kid, which costs ten seconds. And when a child is in a frame you are about to publish, read the uniform, the school bag, the name tag and the street behind them first.

Screenshots leak a different set

Screenshots have no coordinates in them. People conclude screenshots are safe, which is the wrong lesson.

A screenshot captures your interface, and your interface is covered in you. The status bar carries the carrier name and the wifi network you are joined to. The clock. The battery. A notification banner that landed at the worst possible second.

A chat screenshot shows the sidebar, which is a list of who else you talk to and how recently each of them wrote to you.

A browser screenshot shows the tabs, the bookmarks bar and half a URL.

Cropping is also less final than it appears. A phone screenshot editor a few years ago wrote the cropped image back into the original file without shrinking that file, leaving the discarded part readable at the end of it. Thousands of screenshots that people had trimmed on purpose turned out to be fully recoverable.

That bug is patched. The lesson is not about that bug. Where you can, crop the source and screenshot the crop, so the part you wanted gone never gets written to a file.

The half I automated

For roughly three years my entire position on photo privacy was a script in the deploy path that stripped EXIF from every image before it reached any of my sites. It worked. I checked it. I was pleased with myself in the way you are when a small tool does its job.

Then somebody pointed at a rack photo on one of my own pages and mentioned that a modem label was readable in it, next to a sticky note I had left on the shelf.

Clean tags. A picture that said more than the tags ever had.

I had solved the half that could be solved with code and quietly treated that as the whole job. It is worth watching for, because the measurable half always wins the attention.

What replaced it is slower and has no automation in it. Corners, reflections, background, anything with writing on it. Then strip the tags, which is the part that needs no thought.

The checks I run on an image before it goes public, in order, are here.