A photograph taken on a phone is not just pixels. Wrapped around them is a block of EXIF metadata the camera wrote without being asked, and if you serve the original file you publish all of it. Most of it is harmless. Some of it is a home address.

What is actually in there

The tags vary by device, but the ones worth knowing about are consistent:

  • GPS coordinates. Latitude, longitude, and often altitude, to several decimal places. On a photo taken indoors that is a building.
  • A timestamp, usually with the camera's timezone offset.
  • Camera make, model and serial number. The serial is stable across every photograph that device has ever taken.
  • Lens data, exposure settings, and the software that last touched the file — which quietly names the editing tools your team uses.
  • Thumbnails. An embedded preview that is not regenerated when the image is edited. Crop somebody out of a picture and the thumbnail can still show them.

None of this is exotic. It is the default behaviour of consumer hardware, and it survives every copy, upload and re-encode that does not deliberately remove it.

The user-generated content problem

If your users upload photographs — profile pictures, listings, review images — you are the one publishing their metadata. They took the photo; you put it on a CDN with a public URL. Anyone can fetch it and read the GPS tag with a two-line script.

The correct default is to strip metadata on the way out, at the point of delivery, so it does not matter what got uploaded or what a future upload path forgets to sanitise.

Two tags you must not blindly discard

"Strip everything" is nearly right, and the two exceptions are both visible to the user if you get them wrong.

Orientation

Phones do not rotate the sensor data. They store the pixels as captured and set an Orientation tag saying which way up the result should be. Strip that tag without acting on it and every portrait photograph arrives sideways.

The order matters: apply the rotation to the pixels first, then strip. After that the image is genuinely the right way up and the tag has nothing left to say.

The colour profile

An ICC profile describes what the numbers in the file mean. A photograph in Display P3 with its profile removed is not untagged — it is reinterpreted as sRGB, and every saturated colour shifts. Reds go flat, greens go muddy, and the change is large enough that people notice without knowing why.

Convert to sRGB and then strip, or keep the profile. Dropping it and hoping is the one option that is always wrong.

The bytes are a real bonus

Metadata is a fixed cost, which makes it a rounding error on a large image and a meaningful share of a small one. A few kilobytes of EXIF matters little on a 400 KB hero. On a 48 × 48 avatar that has been compressed down to a couple of kilobytes, the metadata can be larger than the picture.

That is worth doing the arithmetic on for your own smallest renditions: fetch one, check its size, then strip it and check again. The ratio is usually more lopsided than people expect.

The short version

  1. Rotate according to Orientation, then discard the tag.
  2. Handle the colour profile deliberately — convert or keep, never silently drop.
  3. Remove everything else, on delivery, by default.

Nobody has ever complained that a delivered image lacked the camera's serial number.