What A Photo Still Remembers After You Post It
The file inside the file
A JPEG is not just pixels. Tucked into the header of that file, before any image data even starts, sits a block called EXIF (Exchangeable Image File Format). It was built in the 1990s so cameras could store shutter speed, aperture, and focal length alongside the shot, useful for photographers reviewing their own work later. Nobody designing that spec was thinking about smartphones, GPS chips, or the idea that billions of people would upload personal photos to strangers’ servers every day. But the format stuck, and every camera and phone since has kept stuffing more into it.
Open the metadata panel on a photo straight off a modern phone and it typically holds: the exact GPS coordinates where the shot was taken (often accurate to a few meters), the date and time down to the second, the camera make and model, sometimes the phone’s serial number or a device fingerprint, the software version, exposure settings, and occasionally a thumbnail preview embedded separately from the main image, a smaller copy that can survive even if the visible photo gets cropped or edited.
That thumbnail quirk has bitten people before. Crop a face out of a photo in a basic editor, and the EXIF thumbnail sometimes still contains the original uncropped frame, sitting there un-cropped inside the file’s metadata. Anyone who knows to look, and viewing EXIF data requires no special tools, just a browser extension or a right-click menu, gets the version the poster thought they’d deleted.
Where the GPS tag actually comes from
The location data isn’t a guess. Phones write it using GPS, Wi-Fi positioning, or cell tower triangulation, whichever combination the device can get a fix from at the moment of capture. iOS and Android both request location permission specifically for the camera app, and once granted, every photo taken gets tagged unless the user has gone into settings and turned it off for that app specifically, not just for location services in general.
This is why photos of the same living room, posted over months, can build an accurate profile of someone’s home address for anyone who bothers to extract the coordinates from a handful of images. It’s also why photos taken during supposedly anonymous activity (a rideshare, a hookup, a protest) have deanonymized people who assumed the picture itself was the only thing being shared. The coordinates ride along silently, readable by anyone with the raw file.
Device fingerprinting research treats EXIF as one input among many. A camera’s sensor has fixed-pattern noise unique to that individual unit, a kind of optical fingerprint that can link photos to a specific physical device even with metadata stripped. EXIF is the loud, obvious layer; sensor noise is the quiet one underneath it. Both get used in the same investigations, just at different levels of effort.
What platforms actually do with it
Here’s where a lot of assumptions turn out wrong. Most major platforms strip visible GPS and device data from photos before they’re served to other users. Facebook, Instagram, and X all run photos through processing pipelines that re-encode the image and drop most EXIF fields in the copy the public sees. This isn’t a privacy favor so much as a side effect of image optimization: recompressing to multiple sizes for different screens naturally sheds metadata that isn’t needed for display.
But “stripped from the public copy” and “deleted” are not the same thing. The original upload, EXIF intact, typically sits in the platform’s storage and gets retained per that company’s data retention policy, which is usually years, not days. That original file is what shows up in response to law enforcement requests, subpoenas, or internal investigations. A photo’s visible public version might be metadata-clean while the version sitting in a server somewhere still has the coordinates, the device ID, the timestamp.
Messaging apps vary more. Signal strips EXIF by default before sending. WhatsApp compresses images in a way that typically removes most metadata but has had inconsistent behavior across versions and file types, particularly with documents sent as files rather than compressed images, which often pass through untouched. Email attachments are the least reliable of all: an original photo sent as an attachment usually keeps every field, because email clients generally don’t touch the file at all.
Cloud storage and photo backup services are their own category. Google Photos and iCloud keep full EXIF on stored originals since the whole point is preserving the photo for the owner, but sharing a link to an album can leak more than the owner intends if permissions or link settings aren’t understood correctly.
The forensic side: how metadata gets used to catch people out
Investigators, journalists, and researchers use EXIF as a starting point, not a magic answer. A single photo with GPS data narrows a search to a specific building or block. Combine that with the camera model and any visible landmarks in the frame, and open source investigators have geolocated images that the poster never intended to be traceable, sometimes confirming a claimed location, sometimes disproving one.
This cuts both ways in adversarial contexts. Fraud investigators reviewing insurance claims or marketplace listings check EXIF timestamps against claimed dates, since inconsistencies (a photo supposedly taken yesterday with metadata showing it’s eight months old) are an easy tell. On the flip side, this is also why sophisticated fakes rarely rely on faked EXIF alone: metadata is trivial to strip or forge with basic tools, so anyone relying on it as the sole signal of authenticity is standing on thin ice. Serious verification work cross-references EXIF against other signals: shadow angles and sun position for the claimed time and place, weather records, visible landmarks, reverse image search for prior appearances of the same file.
Platforms fighting coordinated inauthentic behavior look at EXIF too, among many other signals. A batch of “different” accounts posting photos that all carry the same camera serial number, or a burst of uploads with timestamps clustered in a way that doesn’t match the claimed posting pattern, is one thread among several that gets pulled when a platform’s trust and safety team investigates a network rather than a single account. It is rarely, on its own, the reason an account gets flagged; it’s corroborating evidence sitting alongside behavioral and network signals.
Why “just strip the metadata” isn’t the whole story
It’s tempting to think of EXIF removal as a solved problem: strip it before posting, done. Several operating systems now strip location data with a single tap before sharing, and that genuinely closes the most common leak. But it doesn’t address a few things. Sensor noise fingerprinting doesn’t touch EXIF at all, it works on the pixel data itself, so removing metadata does nothing against it. Reposted images (screenshots of screenshots, photos re-saved through multiple apps) usually lose their metadata anyway through the re-encoding process, but that same process also destroys the evidentiary value the original photographer might have wanted to keep, like proof of when and where a photo was actually taken. And the platform-side original, the one still sitting in storage with full metadata even after the public copy was cleaned, isn’t something the poster controls at all once the upload is complete.
The honest picture is layered: some leakage gets closed by platform processing, some persists in storage nobody but the platform can see, some lives in a different technical layer entirely that metadata stripping can’t touch, and none of it is airtight in either direction. A photo that looks clean in the browser might not be clean in the archive. A photo that looks anonymous might still carry a device fingerprint nobody thought to check for.
Understanding what a file actually contains, rather than what it appears to show, is the same instinct that runs through most of this corner of the internet: the visible layer and the actual mechanism underneath it are rarely the same thing, and the gap between them is where most of the interesting problems live.
For more on how platforms build and use hidden signals like this, check out the rest of what we cover at The Hidden Internet.
Get new guides and videos first — join the Telegram channel.