Online Privacy
Metadata and Privacy: What Your Files Reveal
Every photo you take, every message you send, every document you save carries a hidden label: when it was made, with what device, sometimes exactly where. Encryption hides the content. It does not hide the label. This guide explains metadata — and how to strip it before you share.
What metadata is
Metadata is data about data — the information quietly attached to a file. A photo carries the date and time it was taken, the phone or camera model, the lens and settings, and — if location is switched on — GPS coordinates accurate to a few metres. A document carries the author's name, the software that made it, the creation and edit dates, and sometimes the full edit history. An email carries the sender, the recipients, the time, the servers it passed through, and the device that sent it. You never see any of this; it travels with the file wherever it goes, and anyone who receives the file can read it with a free tool.
Encrypted does not mean private
This is the most important sentence in this guide. Encryption hides the content of a message or a file. It does not hide who sent it, who received it, when, how large it was, or how often they talk. A messaging app with end-to-end encryption still knows who messaged whom and when — its servers need that information to deliver the message. A government that cannot read your encrypted messages can still build a complete map of your contacts from the metadata, and that map is often more revealing than any single message. The same applies to email: encrypting the body does not hide the sender, the recipients, or the subject line on many systems. If you care about privacy, protect the metadata too — not just the content.
What your photos reveal
Photos are the worst offenders, because they are shared so freely. A single holiday photo posted publicly can reveal the exact location, the date, and the phone model — enough to place you at a place and time. A photo of a child can reveal their school or home through the background and the GPS coordinates embedded in the file. A photo of a document can reveal the author's name and edit history from the file itself. Social media sites usually strip some metadata from uploaded photos — but not all, and not reliably, and the original file on your phone keeps everything until you remove it. Never assume a platform cleaned a file for you.
Check your own photo
Pick a photo on your phone, open its details or info view, and look: most phones show the date, time and location on a map. That is the metadata. If you can see it, anyone you send the file to can see it — unless you strip it first.
What your documents reveal
Word processor and PDF files carry their own metadata: the author's name, the software and version, creation and modification dates, and — in collaborative documents — the names of every editor and sometimes deleted text. A leaked document has identified its source more than once in history through exactly this information. Before sharing a document outside your organisation, check its properties and remove personal information: every major office suite has an "inspect document" or "remove personal information" option built in. It takes seconds.
How to strip metadata
- Turn off location tagging in your camera. In your phone's camera and privacy settings, switch off location for photos. Existing photos keep their coordinates; this stops new ones collecting them.
- Strip before sharing. Use your phone or computer's built-in share option that removes location data, or a free metadata-removal tool. Make it a habit: strip first, post second.
- Clean documents before sending. Use the document inspector in your office suite to remove author names and edit history before a file leaves your hands.
- Check messaging app settings. Turn off location sharing, review what the app stores, and prefer apps that keep as little metadata as possible. Read the privacy policy — it lists what is stored and for how long.
- Think about the trail. Even stripped files reveal patterns: who you message, when, how often. No tool removes that. Our digital footprint guide shows how to check what is already out there, and our how internet surveillance works guide explains who can see the trail.
Metadata in messaging and email
Messages carry metadata too, and it is often more revealing than the message itself. An email header records the sender, every recipient, the time it was sent, and the servers it passed through. A messaging app records who talked to whom, when, how often, and for how long — even when the messages themselves are encrypted end to end. That pattern is the metadata, and it can map a person's whole social circle without reading a single word. Group chats, read receipts and "last seen" times add more. You cannot remove messaging metadata — the service needs it to deliver your messages — but you can shrink it: turn off read receipts and last-seen where the app allows, avoid location sharing in chats, and think twice before joining a group whose members you do not know. The content is yours; the conversation map belongs to the service.
Before you post a photo of a child, check the metadata. A photo's GPS coordinates can reveal a home address or a school. Strip location data before sharing any photo publicly, and never post a photo that shows a child's school name, uniform details or home in the background. See our sharenting guide for the full checklist.
The rule to remember is short: your files talk about you even when you say nothing. Content is the message; metadata is the envelope — and the envelope carries your name, your address and your movements. Encryption seals the letter. It does not blank the envelope. Strip it before you share.
Sources
- Electronic Frontier Foundation — surveillance and privacy explainers (eff.org). Last checked: 14 November 2026.
- Learn Dark Web Editorial Policy — how this site researches and checks its guides (2026).
Last checked: 14 November 2026.
Frequently asked questions
What is metadata?
Data about your data: the information attached to a photo, message or file — when it was created, with which device, where it was taken, who sent it to whom. You never see it, but it travels with the file wherever it goes.
Does encryption hide metadata?
No. Encryption hides the content of a message or file, not the metadata around it. An encrypted message still reveals who sent it, who received it, when, and how large it was. That is why “encrypted” and “private” are not the same thing.
Can a photo reveal my location?
Yes, if location data is embedded in it. Many phones store GPS coordinates in every photo by default. Shared online, the photo can reveal where — and when — it was taken, to anyone who reads the metadata.
How do I remove metadata from a photo?
Turn off location tagging in your camera settings, and strip metadata before sharing: most phones and computers have a built-in option, and free tools exist for the job. Always strip before posting a photo publicly.
What metadata do messaging apps collect?
At minimum, who messaged whom and when, and often device and network details. Even apps with end-to-end encryption collect this, because their servers need it to deliver messages. Check the app’s privacy policy for what it stores and for how long.