Short answer: before you post a photo, check seven things: the GPS location, the date and time, the device details, the hidden preview thumbnail, edit history and content credentials, what is visible in the frame, and the file name. The first five live in the file's metadata, and a free photo privacy checker shows them in seconds without uploading your photo. The last two you check with your own eyes.
Use this list when you sell something from home, post to a public group, send photos to strangers or share pictures of children. It takes about two minutes per photo.
Why a checklist helps
A photo can give away more than you meant to share in two ways. Some of it is hidden in the file as metadata. Some of it is right there in the picture. Most people only think about one of the two.
Platforms do not protect you in a consistent way. Some remove metadata on upload. Email, cloud links and "send as file" options usually pass the original along. See which apps strip EXIF data for the details. A checklist means you do not have to remember which app does what.
1. GPS location
What it gives away: the latitude and longitude where the photo was taken, sometimes with altitude and the direction the camera was pointing. A photo taken at home can point to your home.
How to check: drop the photo into the photo privacy checker. It looks for GPS latitude and longitude, altitude and camera direction, and shows any coordinates on a map.
How to fix: strip the location from a copy with Remove GPS from Photo, then post the copy. To stop new photos from recording location, turn off location for your camera app. For the wider picture, read can someone track you from a photo.
2. Date and time
What it gives away: the exact moment the photo was taken. On its own that is minor. With a location, it shows where you were and when. Across several photos it can show a routine, such as when you leave home.
How to check: the checker reports the timestamp of when the photo was taken.
How to fix: removing metadata from a copy drops the timestamp along with the rest. If you post in real time, consider waiting until you have left a place.
3. Device model and serial number
What it gives away: the make and model of your phone or camera. Some cameras also write a serial number. That can link photos to the same device, even across accounts that are not in your name.
How to check: the checker lists the camera make and model. It does not show a serial number, so to look for one use a full metadata reader such as ExifTool. Many phones do not write one.
How to fix: stripping metadata removes these fields from the copy.
4. Thumbnail leftovers
What it gives away: many photos carry a small preview image inside the metadata. If you crop out something private and the editing app does not update the preview, a small version of the uncropped picture can still be inside the file.
How to check: after you strip a photo, the privacy receipt shows whether an embedded thumbnail was found and removed. If you cropped or covered something, take this one seriously.
How to fix: stripping metadata removes the embedded thumbnail from the copy. After that, the only picture left in the file is the one you see.
See what your photo is actually revealing
Drop a photo to view its GPS location and full EXIF. Everything runs in your browser — the file never leaves your device.
Read in your browser. Your photo is not uploaded or stored.
5. Edit history and content credentials
What it gives away: the Software field can name the app that last saved the photo. Editing apps can also store edit details in XMP. Some cameras and AI tools add content credentials (C2PA), which record where an image came from and how it was changed. That record can include more than you expect.
How to check: the checker lists the software used to edit the photo. The EXIF viewer shows the same Software field. Neither tool shows a full edit history.
How to fix: the strip option removes metadata including content credentials from the copy. If credentials are your only concern, there is a separate tool to remove AI content credentials. Background reading: content credentials in cameras.
Note that content credentials can be useful. If you want to prove a photo is yours or show it is not AI-made, think before you remove them.
6. What is visible in the frame
What it gives away: no metadata tool can see this one, including ours. Look for:
- House or flat numbers, street signs and shop names.
- Parcels, letters or labels with your address.
- Car number plates.
- School logos or uniforms.
- Reflections in windows, mirrors, sunglasses and screens.
- The view from a window, which can match a known building or skyline.
- Screens showing messages, maps or account details.
How to check: zoom in and look at the edges and background, not only the subject. Reflections are easy to miss at normal size.
How to fix: crop, blur or cover the detail with a solid box, or take the photo again from a different angle. After cropping, go back to item 4, because the old thumbnail may still show what you cut out. Stripping metadata does not change the pixels, so it cannot fix anything in this item.
7. The file name
What it gives away: some file names include the date and time, a device name, or words you typed yourself, such as a street or a person's name. When you upload a file, many sites keep or show the name.
How to check: look at the name before you upload. Our tools check the metadata inside the file, not the file name, so this one is on you.
How to fix: rename the file to something neutral before you share it.
Run the whole checklist in two minutes
- Open the photo privacy checker and choose your photo. JPEG, PNG, HEIC, WebP and AVIF are accepted.
- Read the results for items 1 to 5: GPS, time, device, thumbnail and software.
- If anything shows up that you do not want to share, strip the metadata and download the clean copy. The original on your device stays as it is.
- Open the clean copy in the checker again to confirm the fields are gone.
- Zoom through the picture for item 6.
- Rename the file for item 7.
- Post the clean, renamed copy.
The photo is read in your browser and is not uploaded. The strip tools can also give you a privacy receipt: a record of what was found in each original and what is left in each cleaned copy.
Limits of this checklist
- A metadata reader only finds fields it knows how to read. Unusual or brand-specific formats can be missed.
- Item 6 depends on you. No tool here looks at faces, signs or landmarks.
- Copies you already shared, and cloud backups of the original, keep whatever they had.
- Removing metadata does not stop someone from working out a place from the picture. See do screenshots have location data for why a screenshot is not a full fix either.
- A clean result from the checker describes the file you checked. If you post a different copy, check that one.
For a step-by-step guide on removing location on each device, see how to remove location from photos.
Quick summary
- Five items live in the file: GPS, time, device, thumbnail, edit history and credentials.
- Two you check yourself: what is in the frame and the file name.
- Check, strip, check again, then post the copy.
- Start now with the free photo privacy checker.