What Metadata Do Your Photos Actually Contain?

The core EXIF fields are the ones with the most privacy weight. GPS latitude and longitude place the shot on a map; the make and model identify your exact camera or phone; DateTimeOriginal records the moment down to the second. Together these three answer where, with what, and when — a compact but revealing profile of a single moment in your life.

Written out, the list is plainer than it sounds. GPSLatitude, GPSLongitude and GPSAltitude give the position; DateTimeOriginal, DateTimeDigitized and SubSecTime give the instant; Make and Model name the body, LensModel the lens, BodySerialNumber the individual unit. Software records whatever last wrote the file, Artist and Copyright hold whatever you once typed into a camera menu, and Orientation says how the picture should be rotated. Any viewer that reads EXIF will show them under exactly these names.

Alongside them sit the technical settings — ISO, aperture, shutter speed, focal length, lens model, orientation and flash state. These are mostly harmless and genuinely useful to photographers, but the lens and body combination can still act as a fingerprint that links photos back to one owner across accounts.

Beyond EXIF, editing and cataloguing software adds its own layers. IPTC fields, born in the news industry, hold captions, keywords, the creator's name, city and copyright terms. XMP is a flexible, XML-based block that programs like Lightroom and Photoshop use to store edit histories, ratings, keywords and author details. If you have ever tagged or captioned a photo in a photo manager, some of that text may be riding along inside the file.

These blocks are easy to forget because you added them deliberately for your own organisation, not for the public. But they travel with the file just like GPS does, so a keyword you used privately or your real name in a copyright field can surface wherever the photo lands.

Inside EXIF there is a tag called MakerNote, and it is a law unto itself. Manufacturers use it to store whatever they like in their own private format, and Canon, Nikon, Sony, Fujifilm and Apple all fill it differently. Depending on the device it can hold focus points, burst and image-stack identifiers, shooting-mode details, lens correction data, internal temperature readings and, on many cameras, the serial number again.

Because the format is proprietary, general-purpose tools often display it as an opaque blob, which makes it easy to assume there is nothing in there. There usually is. A cleaner that deletes only the fields it recognises can leave a MakerNote behind intact — one more argument for clearing metadata wholesale rather than tag by tag.

One of the least-known items is the embedded thumbnail. EXIF can store a small preview image inside the file, generated when the photo was taken. Notoriously, this thumbnail is not always updated when you edit the main image — there have been real cases where someone cropped sensitive content out of a photo, but the original, uncropped scene survived in the tiny embedded preview.

Thumbnails are not a single thing, either. In a JPEG the classic preview sits in IFD1, the second directory of the EXIF block. HEIC and AVIF containers can hold a separate, larger preview item as a sibling of the full image, and camera raw files often embed a full-size JPEG rendering so the camera's screen has something to display. Each of these is a copy of the picture at some earlier stage, and any of them can outlive an edit applied only to the main image.

This is exactly why a whole-file approach beats deleting fields one by one. When MetaCleanse re-encodes an image from its decoded pixels, every one of these layers — EXIF, IPTC, XMP, MakerNote and any embedded thumbnail — is left behind at once, because the clean copy is built only from what you actually see. Drop a photo in to inventory what it holds, then download a copy that holds nothing but the picture.