A photograph is not only an image. Embedded in the file is the date and time it was taken, the camera or phone model, the settings used, and — frequently — the precise coordinates where you were standing.
A word processing document is not only text. It carries the author name, the organisation, when it was created, how long it was edited, comments, and revision history that may include text someone deleted before sending.
None of that is visible when you open the file, and all of it travels with it.
What changed in 2026
- Platform stripping became more common and stayed inconsistent. Major social platforms generally remove location data; messaging apps and email frequently do not.
- Awareness improved after high-profile incidents. Cases where metadata revealed something unintended kept the issue visible.
- Removal tooling got easier. Built-in options in operating systems reduced the need for separate software.
- AI-generated content added provenance metadata. New categories of embedded information appeared.
What files carry
| File type |
Common metadata |
| Photograph |
Location, date, device model, camera settings |
| Video |
Location, date, device, sometimes editing history |
| Word processing document |
Author, organisation, editing time, revisions, comments |
| Spreadsheet |
Author, hidden sheets, formulas revealing sources |
| PDF |
Author, creating software, sometimes layers and prior text |
| Audio |
Recording device, date, sometimes location |
Two categories cause most real problems.
Photo location data. A picture taken at home carries your home coordinates. Posting one from a holiday reveals you are away. Selling something online with a photo taken in your living room shares where you live with everyone who sees the listing.
Document revision history. Text deleted before sending may still be recoverable from the file. Comments intended for internal discussion may travel with a document sent externally. This has produced genuinely consequential disclosures in professional contexts, and it is entirely invisible to the sender.
Platform behaviour varies
Some services strip metadata on upload; others preserve it entirely.
Major social platforms generally remove location data from photos, partly for privacy and partly because they re-encode images anyway. That is helpful and it is not a guarantee, and it varies by platform and by upload path.
Messaging apps differ. Sending a photo as an image may strip metadata while sending the same photo as a file attachment preserves everything. That distinction catches people out.
Email generally preserves attachments exactly as sent, including all metadata.
Cloud storage links share the original file with everything intact.
The safe assumption is that metadata travels unless you removed it, rather than relying on a platform to handle it.
Removing it
Operating system file properties typically offer a way to remove personal information from a file's properties, which handles the common cases without additional software.
Photo apps frequently allow sharing without location data, which is worth finding once and using thereafter.
Screenshots of a document are a crude and effective way to share visual content with no embedded history, at the cost of quality and searchability.
PDF export from a document generally drops revision history and comments, though it retains author information that should be removed separately.
Dedicated tools handle bulk removal where you are sharing many files.
The broader habit worth adopting: for anything shared publicly, or with people you do not know, strip metadata as a matter of course. For files staying within a trusted context, it rarely matters.
Common mistakes
- Assuming the platform strips it. Behaviour varies by platform and upload method.
- Sending as a file attachment rather than an image. Preserves everything.
- Sharing documents with revision history intact. Deleted text may be recoverable.
- Posting photos taken at home. Reveals your address.
- Forgetting comments in shared documents. Internal discussion sent externally.
- Ignoring hidden content in spreadsheets. Hidden sheets and formulas reveal sources.
- Only worrying about photos. Documents carry more consequential metadata.
FAQ
Should I disable location on my camera entirely?
It is a reasonable default if you rarely need it, and location data is genuinely useful for organising a photo library. Stripping on share rather than never recording is the better balance for most people.
Does editing a photo remove metadata?
Depends on the editor — some preserve it, some strip it, some add their own. Do not assume.
What about AI-generated content?
Increasingly carries provenance information indicating how it was produced. That is generally a feature rather than a privacy concern, and it is worth knowing it is there.
Can metadata be recovered after removal?
Properly removed, no. Some methods only hide it rather than deleting it, which is why using a real removal tool matters for anything sensitive — see secure deletion explained.
Where to go next
For the messaging context where this matters, read encrypted messaging explained. For removing data properly, secure deletion explained, and for reducing your broader data footprint, data broker opt-out.