Every photo your phone or camera produces carries a block of data describing how it was made. It is called EXIF — Exchangeable Image File Format — and it travels inside the JPEG or HEIC file itself, invisible unless you go looking.
Most of it is genuinely useful. One part of it is a privacy problem that people share publicly without realising.
Two of those deserve their own sections, because they cause real problems in opposite directions.
Cameras do not physically rotate the image when you turn them sideways. They record the picture as the sensor saw it and write an orientation tag saying “display this rotated 90 degrees”.
Software that reads the tag shows the photo correctly. Software that ignores it shows the original sensor orientation — which is why a photo that looked fine on your phone arrives sideways somewhere else. The image data is identical; only the instruction was dropped.
If location services are enabled for the camera, every photo records where it was taken to within a few metres.
For your own library this is excellent — it is what lets you search photos by place and see them on a map. The problem is what happens when the file leaves your control.
A photo posted with its GPS intact tells anyone who looks exactly where you were and when. A set of photos tells them where you live, where your children go to school, and when you are away from home. This is not hypothetical; it is the ordinary consequence of sharing an unmodified camera file.
The practical position worth knowing:
If you are unsure what a file contains, read its information before sending it. It takes a moment and the answer is unambiguous.
Stripping metadata is straightforward, and there is one thing to be careful about.
A blanket “remove all metadata” takes the colour profile with everything else. That profile is what tells software whether the numbers in the file mean sRGB or Display P3 — and without it, a photo from a modern phone is rendered oversaturated by anything that assumes sRGB.
So the useful instruction is: remove GPS, camera identifiers and timestamps; keep the colour profile and the orientation tag. Most tools that offer metadata removal for the web do exactly this by default. Tools that offer a single aggressive switch often do not.
The other common surprise: on some files, editing software leaves the original thumbnail embedded in the EXIF. Crop a photo, and the small preview inside it may still show the uncropped original. Re-saving through a tool that regenerates the thumbnail removes this; simply cropping does not always.
EXIF is not something to delete reflexively. It is the only record of how a photograph was made.
The sensible arrangement is to keep full EXIF on your originals and strip the sensitive fields only from the copies you publish. Deleting it from the master is irreversible, and nothing reconstructs it.