A photo file carries more than the picture. Open the properties of almost any JPEG straight off a phone and you will find the camera model, the lens, the exposure settings, sometimes a serial number, and very often a pair of GPS coordinates accurate enough to find a front door. Images that came out of a generator or an editing app can carry a different set of records: an XMP block naming the software, an IPTC field describing how the image was made, or a C2PA manifest that records its edit history.
None of this is visible when you look at the image. All of it travels with the file when you email it, drop it in a shared folder, or upload it somewhere that keeps the original.
This post walks through what those layers actually are, what to expect when you post to the big platforms, and a simple routine for cleaning files before they leave your machine.
What is actually hiding inside an image file
It helps to think of metadata as several separate layers rather than one blob. Different tools write different layers, and a cleaner that handles one may leave another untouched.
EXIF. This is the oldest and most familiar layer. Cameras and phones write it at capture time: make and model, lens, focal length, shutter speed, ISO, the time the shot was taken, orientation, and, if location services were on, GPS latitude and longitude. Some cameras also store a body serial number and a shutter count. For most people, the GPS fields are the real privacy concern. A photo of a new couch posted to a marketplace listing can quietly point at your home.
XMP. Adobe's Extensible Metadata Platform is a flexible, XML-based layer. Editing apps use it to record the software that touched a file, edit settings, ratings, and keywords. Image generators and AI-assisted editors often write XMP fields that name the tool or describe how the image was produced.
IPTC. Originally built for news photography, IPTC fields hold captions, credits, copyright notices, and keywords. One field matters more than it used to: DigitalSourceType, which can state that an image was created or altered by a generative model. Several platforms read it.
C2PA / Content Credentials. This is the newest layer. A C2PA manifest is a signed record attached to a file that describes where it came from and what was done to it. Some cameras, editing suites, and AI image tools write one. It is designed to be verifiable, which is exactly why some people want to keep it and others need to remove it before sharing a draft, a client file, or a personal photo.
There is one more category worth naming because people often confuse it with metadata: pixel-level watermarks. Some generators embed an invisible signal into the image itself rather than into a tag. Removing metadata does not touch those. If a tool tells you otherwise, be sceptical. A metadata cleaner rewrites the file's tags; it does not alter the picture, and it cannot promise that no system will ever classify an image.
So when someone says they want to "strip metadata," it is worth asking which layer they mean. Location privacy is an EXIF problem. A stray generator tag is usually XMP, IPTC, or C2PA. Each needs to be checked separately.
What platforms keep, strip, or read
Here is where a lot of confusion starts. People assume that because a big platform "strips metadata," their file is clean. In practice, platforms re-encode uploads in different ways, change their pipelines without much notice, and may read certain fields (especially AI-related ones) before discarding them. The table below is a cautious summary of what is widely reported. Treat it as a starting point, not a guarantee, and test with your own files.
| Platform | EXIF / GPS on the public copy | AI-related fields (IPTC / C2PA) | What to keep in mind |
|---|---|---|---|
| Generally removed from the image people download | May be read at upload and used for an AI label | A label is applied to the post; cleaning the file later does not remove it from a live post | |
| Generally removed from the public copy | May be read at upload, similar to Instagram | The original file may still be stored on the platform's side | |
| X (Twitter) | Generally removed from photos | Handling of C2PA is not clearly documented | Files sent another way, such as attachments, may not be re-encoded |
| Behaviour varies by upload type | Some posts show Content Credentials information | Documents and native images may be handled differently | |
| Generally re-encoded | May read AI-related fields for labelling | Pins saved from elsewhere carry whatever the source kept | |
| Email, cloud drives, chat file transfers | Usually preserved exactly | Usually preserved exactly | This is where most accidental location leaks happen |
The last row matters most. Social feeds tend to re-encode, which removes a lot of EXIF as a side effect. Email attachments, shared drive links, messaging apps sending "as file," and marketplace or forum uploads frequently hand over the original bytes untouched. If you only clean files "before social media," you are protecting the channel that needed it least.
Two other points are worth keeping in mind. First, a platform reading an AI field at upload means the label decision happens then. If a post already has a label, editing the file you have on your laptop changes nothing about the live post; you would need to delete it and upload a cleaned file. Second, platforms do not only look at tags. A clean file can still be labelled if a platform detects a pixel watermark or the uploader self-discloses. Honest expectations save a lot of frustration.
A simple cleaning routine before you share
The good news is that cleaning a file properly takes less than a minute once it is a habit. Here is the routine I use.
1. Inspect before you strip. Open the file in a metadata viewer and see what is actually there. You may find GPS on a photo you assumed was clean, or a generator tag on an image you only lightly edited. Knowing what is present tells you which mode you need.
2. Pick the right scope. If you are sharing a personal photo and only care about location and camera details, you want to delete EXIF data, specifically GPS and device fields, while leaving everything else as it is. If you are working with generated or AI-edited images and need the provenance records gone before a draft goes to a client, you want to remove AI metadata: the C2PA manifest, the IPTC DigitalSourceType value, and generator XMP. If you want a fully bare file, strip everything.
3. Clean locally where you can. A browser-based cleaner that processes the file on your own device means the photo never has to be uploaded to someone else's server. That is worth checking for any tool you use, especially with personal photos. Command-line tools such as ExifTool are excellent if you are comfortable in a terminal; they give fine control, though C2PA manifests and some XMP blocks need the right flags.
4. Verify after cleaning. This step is the one most people skip. Reopen the cleaned file and confirm the fields you cared about are gone. A good cleaner shows you a before-and-after list. If the GPS row is still there, the job is not done.
5. Keep your originals. Cleaning should produce a new file, not overwrite your archive. You may want the original capture date and camera data later for your own records. Only the shared copy needs to be bare.
6. Re-upload rather than edit, if a post already exists. If a platform has already labelled or stored a file, the clean version only helps when it replaces the original upload.
For my own workflow I use this metadata remover, which runs in the browser tab, shows the before-and-after field report, and lets me choose between EXIF/GPS only, AI provenance only, or everything. It clears embedded XMP, C2PA, IPTC, and GPS metadata from JPEG, PNG, and WebP files, and it leaves the pixels alone. One file is free to try; unlimited files and batch ZIP downloads are a one-time $9.99 rather than a subscription. Other tools work too. What matters is that you inspect, clean the right layer, and verify.
A few practical habits round this out:
- Turn off location tagging in your phone's camera app if you rarely need it. Prevention is easier than cleanup.
- Be careful with "send as file" or "original quality" options in chat apps. They usually keep everything.
- Remember that screenshots carry their own metadata, often the device model and time, even if they drop the original photo's GPS.
- For batches, such as a product shoot or a set of carousel slides, clean them together so none slips through.
Metadata is not sinister on its own. It is useful for organising your library, proving authorship, and documenting edits. The problem is only that it travels further than most people expect. A short inspect, clean, and verify routine keeps the useful parts in your archive and the private parts out of other people's hands.
Top comments (0)