EXIF stands for Exchangeable Image File Format. The metadata standard embedded in JPEG, TIFF, and most other photo formats. Captures: GPS coordinates of where the photo was taken, timestamp accurate to the second, camera make and model, lens, exposure settings, sometimes the camera serial number, sometimes the photographer name (if set in the camera). Written automatically by every phone camera and most digital cameras unless explicitly disabled.
What it means in practice
The EXIF GPS field is the most operationally consequential. Every photo your phone takes carries the latitude and longitude of where you stood, often within meters. The data persists when you upload to most platforms (Twitter strips, Facebook strips visible-to-others but retains, Instagram strips, but the original you sent to a friend over Signal does not). The 2012 John McAfee case (located in Guatemala by Vice journalists who published a phone photo with GPS metadata intact) is the textbook example. The 2018 Strava heatmap incident (showing US military forward operating base layouts) was a different category of metadata leak (aggregated workout routes) but the same operational lesson: the data you leak is rarely the data you intended to communicate.
Where it shows up
Embedded in: every photo from every modern phone (iPhone, Android), every photo from every modern camera with GPS enabled, screenshots that include the timestamp metadata, video files (similar EXIF-equivalent fields), some PDF files. Stripped or transformed by: most major social platforms before public display, but not always before storage. Preserved by: direct file shares (Signal, AirDrop, email attachment, USB transfer). The recurring failure is sending a photo directly to a journalist or activist over a “secure” channel that preserves the file integrity (which is the point of a secure channel) and therefore preserves the EXIF the file was carrying.
What you can change today
Two settings and one workflow. iPhone: Settings, Privacy and Security, Location Services, Camera, set to “Never” (you can re-enable per-shot if needed). Android: open Camera app, Settings, Save Location off. Workflow: install ExifTool (exiftool.org) on Mac, Linux, or Windows; before sending any sensitive photo to anyone, run `exiftool -all= -overwrite_original photo.jpg`. Alternative no-CLI options: ObscuraCam (Android, Guardian Project), Image Privacy (iOS), or the built-in “Remove Properties” right-click option on Windows. For sources sending material to journalists, the discipline is: assume the file you send carries everything your camera could record, and strip before transmission, not after.
Related articles
- Client confidentiality in the digital age: the tools lawyers actually need.
- Digital security for journalists in 2026: the complete operational guide.
- A journalist was arrested in Kuwait for reposting a CNN video. The law used to charge him didn’t exist yet when he posted it.
- Border agents can search your laptop without a warrant.