The answer might surprise you. More importantly, you need to understand it before you share your next photo.
What social media platforms actually do
The truth is straightforward but inconsistent. Most major platforms strip GPS coordinates and camera details from your photos when you upload them. Facebook removes location data. Instagram does the same. Twitter strips GPS coordinates from images.
But here's where it gets complicated: they don't always remove everything, and the data they do remove doesn't always disappear completely.
Research from the International Press Telecommunications Council tested 15 major social media sites in 2016 and found that whilst many platforms strip metadata from public-facing images, the results were inconsistent. Some platforms removed data during display but preserved it on download. Others deleted everything. A few kept nearly all metadata intact.
The only platform that scored perfectly? Behance, which preserved and displayed all rights-relevant metadata fields. Facebook, Instagram, Twitter, and others? They all failed to retain complete information.
Why platforms strip metadata (and what they keep)
There are legitimate reasons for removing metadata. GPS coordinates in every photo you share would be a privacy disaster. Imagine posting a photo from your kitchen and accidentally broadcasting your home address to the entire internet.
But platforms have other motivations too. When Facebook strips metadata, it doesn't necessarily delete the information. It stores original files with full metadata internally. The data gets removed from the version other people see, but Facebook keeps it in their database.
That means Facebook knows where your photos were taken, even if your friends don't. They use this information for their own purposes: content analysis, recommendation algorithms, targeted advertising.
The problem with inconsistent policies
The bigger issue is that you cannot rely on platforms to protect your privacy consistently. Platform policies change. Processing systems vary. What gets stripped today might not be stripped tomorrow.
A 2025 test of major platforms confirmed this pattern. Instagram, Facebook, and Twitter all remove sensitive metadata like GPS coordinates and camera information from downloaded images. But the test also found that platforms embed their own metadata, including processing information and server identifiers.
Third-party apps compound the problem. If you upload photos through unofficial apps or share images to platforms via different methods, the metadata handling can be completely different.
When metadata leaks matter
In December 2012, Vice Magazine was following John McAfee, the antivirus software founder who was on the run from police in Belize. They published a photo taken with an iPhone 4S. The problem? They forgot to remove the location metadata.
The GPS coordinates embedded in the photo revealed McAfee's exact location: 15°39'29.4"N, 88°59'31.8"W, at a swimming pool outside the Rachon Mary Restaurant in Guatemala's Parque Nacional Rio Dulce. He was arrested for illegally entering Guatemala shortly after.
This wasn't theoretical. A fugitive's location was exposed because a professional publication forgot to check photo metadata before publishing.
Other cases demonstrate the same risk. In 2016, Harvard students used GPS coordinates from photos posted on the dark web to identify 229 drug dealers. In 2017, metadata timestamps from a performance review proved a company had fabricated the document, leading to a £10.8 million payout in a whistleblower case.
What metadata actually contains
Photo metadata falls into three categories:
System metadata includes file creation dates, timestamps, camera make and model, and technical settings like aperture and ISO. This information gets generated automatically when you take a photo.
Substantive metadata captures GPS coordinates, orientation data, and sometimes even altitude. If location services are enabled on your phone, this gets embedded in every photo you take.
Descriptive metadata includes any information you add manually: copyright notices, keywords, captions, or creator information.
All of this information sits invisibly inside your image file. You cannot see it by looking at the photo, but it's there.
Why you shouldn't trust platforms to protect you
Platform policies are not legally binding privacy guarantees. They're business decisions that can change at any time. A platform might strip metadata today and preserve it tomorrow. You'd probably never know the difference.
Some platforms only strip metadata when images are processed in specific ways. Testing shows that if an image isn't resized or re-compressed, metadata sometimes gets preserved even on platforms that claim to strip it.
There's also the problem of who sees your data before it gets stripped. Platforms process your original image file, complete with all metadata, before removing anything. That means the platform itself has access to everything: your location, your device, your complete photo history.
What you should do instead
The only reliable approach is to strip metadata yourself before uploading to any platform. This means taking control of your privacy instead of hoping platforms will protect you.
You need to check what's in your photos before you share them. Most phones don't make this easy, but the information is definitely there.
For images you're about to share, remove location data, camera information, and any other personal details you don't want exposed. This is particularly important for photos of your home, your workplace, or anywhere else you visit regularly.
The solution is simple: clean your files before they leave your device. That way, it doesn't matter what the platform does with metadata. There's nothing sensitive left to leak.
The reality check
Social media platforms handle metadata inconsistently. Most strip GPS data and camera details from public-facing images, but they often keep the original files with complete metadata in their own databases. Platform policies change. Processing varies. Third-party apps behave differently.
You cannot rely on platforms to protect your privacy. The only dependable approach is to remove sensitive metadata yourself before uploading anything.
Every photo contains information you probably don't want to share. Take control of it before someone else does.
