Digital Privacy: What Your Files Reveal Without You Knowing

What Metadata Is (and Isn't)

Metadata is data embedded in a file that describes the file itself—not the visible content, but everything around it. It's automatically written by the software or device that created the file. Most of it is useful for organizing and processing files. Some of it is a privacy liability.

The important thing to understand: metadata is not a separate file. It lives inside the same file as your photo or document. When you email a JPEG or share a PDF link, the metadata travels with it.

EXIF in Photos: What Your Camera Records

EXIF (Exchangeable Image File Format) data is written into every photo by your camera or phone at the moment of capture. On a modern smartphone, a single JPEG can carry 50–100 metadata fields. Most are harmless camera settings. A few are significant privacy risks.

What your phone embeds

The embedded thumbnail issue

Many JPEG files contain a small thumbnail of the original image embedded in the EXIF data. If you crop a photo to remove something, the EXIF thumbnail often still shows the uncropped version. Tools that only strip GPS may leave the thumbnail intact. Always verify with an EXIF viewer that checks the thumbnail, not just the main image fields.

EXIF support by format

EXIF, IPTC, and XMP Explained

There are actually three separate metadata systems that can coexist in the same photo file. Most tools show you all of them together, but they serve different purposes.

EXIF — Exchangeable Image File Format

Written by cameras at capture time. Technical fields: GPS, timestamps, camera settings, device identification. Stored in a binary tag structure within the JPEG APP1 marker. This is what cameras write; most of the privacy-sensitive data lives here.

IPTC — International Press Telecommunications Council

Designed for news photos and professional publishing. Fields include: caption, photographer credit, copyright notice, location names (city, country—as text, not GPS), keywords, and editorial instructions. Written by photo editing software, not cameras. A journalist adds IPTC data before submitting to a wire service.

XMP — Extensible Metadata Platform

Adobe's XML-based standard that extends both EXIF and IPTC. Stores edit history, Lightroom adjustments, color profiles, and custom fields. The XMP block in a JPEG is a readable XML document embedded in the file—you can open it with a text editor if you know where to look. Photoshop, Lightroom, and Capture One all write XMP data.

When you remove metadata, you want to strip all three. Most tools that say "remove EXIF" do remove all three, but verify with a tool that explicitly shows IPTC and XMP sections.

Documents: The Hidden Revision History

Office documents—DOCX, XLSX, PPTX—are ZIP archives containing XML files. The metadata lives in docProps/core.xml and docProps/app.xml inside that ZIP. Open any DOCX in a ZIP extractor and you can read these files directly.

What Word documents record

• Author: The name from your Windows or macOS account at the time of creation—often your full name
• Last Modified By: The account name of whoever last saved it
• Company: Your organization name from Office settings
• Manager: Your manager's name if set in Office profile
• Total Editing Time: Accumulated seconds the document was open—can reveal work patterns
• Revision Number: How many times it's been saved
• Template: The name of the .dotx template it was based on—sometimes reveals internal template names

The revision history trap

Things you think you removed that may still be there:

- Track Changes: Even "accepted" changes leave history
  in the document XML until you explicitly clear it
- Comments: Deleted comments sometimes persist as
  empty comment markers with author attribution
- Hidden text: Text marked as hidden is still in the file
- Deleted slides: PowerPoint can retain deleted slides
- Hidden rows/columns: Excel hides them, doesn't delete them
- Previous versions: Windows stores shadow copies automatically

The only reliable way to sanitize a Word document is to run the built-in Document Inspector (File > Info > Check for Issues > Inspect Document) and explicitly remove all flagged categories. Even then, do a final check by unzipping the DOCX and inspecting the XML.

Other formats

PDFs: More Than You Think

PDFs store metadata in two places: the document information dictionary (basic fields) and an XMP metadata stream (extended XML fields). Both are readable with a text editor or PDF analysis tool.

Standard PDF metadata fields

• Author: Often your computer username or Office profile name
• Creator: The application that created the original (e.g., "Microsoft Word for Microsoft 365")
• Producer: The software that converted to PDF (e.g., "Adobe PDF Library 21.0")
• CreationDate: When the PDF was first generated
• ModDate: Last modification date
• Title, Subject, Keywords: Optional descriptive fields, often containing document titles or internal tags

Embedded content you might not know about

• Embedded files: A PDF can contain attachments—other PDFs, images, or any file type—embedded inside it
• Annotations and comments: Sticky notes and review comments from editors, even ones that appear deleted in some viewers
• Form field data: If a PDF form was filled out and saved, the values are embedded even if the fields look empty
• JavaScript: PDFs can execute JavaScript. Mostly used for form validation, occasionally used maliciously
• Incremental updates: PDF supports appending edits without rewriting the file. Older versions of content can be recovered by reading the file structure

Proper PDF sanitization

Re-rasterizing (converting to images and back) removes all text and structure. Ghostscript's PDF reprocesing re-renders the content and strips incremental updates, embedded files, and JavaScript. The cleanest approach is: print to PDF (which creates a fresh file), then use a metadata removal tool to strip the information dictionary and XMP block.

Screenshots Are Safer, But Not Safe

A screenshot is a fresh raster image generated by the OS, not a camera capture. It carries no GPS, no camera model, no lens data. For sharing sensitive content, screenshots are almost always the right choice over the original file.

What screenshots do record:

• Creation timestamp: The exact date and time the screenshot was taken
• Screen dimensions: Can identify the device type (a 2560×1440 screenshot suggests a specific monitor or laptop)
• Software info: On some platforms, the screenshot tool name is embedded
• Color profile: Display ICC profile, which can narrow down the hardware

For most purposes, these fields are not sensitive. If you're sharing content where even the timestamp needs to be hidden—whistleblowing, sensitive testimony, anything that could be used to establish a timeline—screenshot and then strip the remaining metadata before sharing.

One practical issue: screenshots of code or documents often appear as PNG files. PNG metadata (tEXt chunks) is less standardized than JPEG EXIF, and some tools only strip EXIF without touching PNG metadata. Check with a tool that explicitly shows PNG chunks.

What Social Platforms Actually Do

The assumption that social media "strips your metadata" is mostly true for what other users can access, but incomplete as a privacy statement.

The practical takeaway: don't rely on platforms to protect you. Strip metadata before uploading if the content is sensitive. For email, cloud storage, or direct file sharing, assume nothing is stripped.

Forensic Implications

Metadata has real legal and investigative consequences. These aren't hypothetical edge cases.

Document fraud detection

Courts and investigators routinely examine metadata to verify documents. Common findings: a document claimed to be from 1998 was created with Word 2010; a "handwritten" contract was typed with a metadata-stamped date of the day before the lawsuit; an email attachment was supposedly written by one person but the Author field shows another. The European Court of Human Rights has cited metadata inconsistencies in judgments.

Whistleblower identification

Several high-profile cases involved leakers identified through document metadata. In 2012, John McAfee's location was revealed when a journalist posted a photo with embedded GPS coordinates. Printer forensics (yellow tracking dots) and metadata together have been used to identify sources. If you're handling sensitive documents, strip everything before passing them on.

Stalking and harassment

The most common real-world harm. Photos posted to social media, forums, or classified ad sites with GPS intact have let harassers locate targets' homes and workplaces. This is not rare—it's documented in hundreds of restraining order cases and police reports. If you sell things online with photos taken at home, strip GPS before posting.

Business intelligence

Competitors can extract organizational structure from proposal PDFs (Author fields reveal who wrote them), technology stack from Creator fields (reveals what software you use), and timeline information from creation and modification dates. Sanitize metadata before sharing anything externally.

How to Remove Metadata

Images — command line (ExifTool)

ExifTool is the most reliable option. It handles EXIF, IPTC, and XMP simultaneously and supports batch processing.

# Install:
# macOS: brew install exiftool
# Linux: sudo apt install libimage-exiftool-perl
# Windows: download from exiftool.org

# Remove all metadata from one file (creates backup as photo.jpg_original)
exiftool -all= photo.jpg

# Remove all metadata, no backup
exiftool -all= -overwrite_original photo.jpg

# Remove all metadata from an entire directory
exiftool -all= -overwrite_original /path/to/photos/

# Remove only GPS data, keep everything else
exiftool -gps:all= photo.jpg

# View all metadata first
exiftool -a -u -g1 photo.jpg

# Verify metadata is gone
exiftool -GPS:all photo.jpg  # Should return nothing

Images — OS built-in tools

# Windows (right-click method):
1. Right-click image → Properties → Details tab
2. Click "Remove Properties and Personal Information"
3. Choose "Create a copy with all possible properties removed"

# macOS Preview:
# Doesn't strip EXIF directly—use sips or ExifTool instead
sips --deleteProperty all photo.jpg  # Removes many but not all tags

PDFs — Ghostscript

# Re-render the PDF, stripping metadata and embedded files
gs -dBATCH -dNOPAUSE -sDEVICE=pdfwrite \
   -dCompatibilityLevel=1.4 \
   -dPrinted=false \
   -sOutputFile=clean.pdf original.pdf

# This re-processes the whole PDF, removing:
# - Document information dictionary
# - XMP metadata
# - Embedded files
# - JavaScript
# - Incremental update history

Office documents — Document Inspector

Microsoft Word / Excel / PowerPoint:
1. File → Info → Check for Issues → Inspect Document
2. Check all categories:
   - Comments, revisions, versions, annotations
   - Document properties and personal info
   - Hidden text
   - Invisible content
3. Click Inspect
4. Click "Remove All" for each flagged category
5. Save the cleaned file

Important: Save as a new file name after cleaning.
The original retains the history in the filesystem.

Batch processing images — Python

import subprocess
import os
from pathlib import Path

def strip_metadata(directory):
    """Strip all EXIF/IPTC/XMP from all JPEGs in a directory."""
    path = Path(directory)
    files = list(path.glob('**/*.jpg')) + list(path.glob('**/*.jpeg'))

    for file in files:
        result = subprocess.run(
            ['exiftool', '-all=', '-overwrite_original', str(file)],
            capture_output=True, text=True
        )
        if result.returncode == 0:
            print(f'Cleaned: {file.name}')
        else:
            print(f'Failed: {file.name} — {result.stderr}')

strip_metadata('/path/to/photos')

Privacy Best Practices

Phone settings (prevent GPS at capture)

iPhone:
Settings → Privacy & Security → Location Services → Camera → Never

Android (Samsung):
Camera → Settings gear → Location tags → Off

Android (Pixel):
Camera → Settings → Save location → Off

Windows Camera app:
Settings → Privacy → Location → disable for Camera app

This stops future photos from embedding GPS. It won't retroactively remove GPS from existing photos.

Before sharing any file

1. Check the metadata first—view it in an EXIF viewer or ExifTool before deciding what to do
2. For photos you plan to post publicly, strip all metadata
3. For documents going to external parties, run Document Inspector and save a clean copy
4. For PDFs, use Ghostscript or a dedicated metadata scrubber
5. Consider whether a screenshot of the content would serve the purpose—it carries far less metadata
6. After stripping, verify with the same tool you used to check metadata originally

High-risk scenarios

Tools

All ToolsDock tools process files locally in your browser—nothing is uploaded to any server.