Can someone find your location from a photo you sent?

What can someone actually learn from your photo?

If the GPS block survived, they get coordinates, altitude, the compass bearing the lens faced, and how fast you were moving, plus a field stating the fix's own accuracy in metres. Berkeley researchers matched geotagged photos against Street View imagery to within roughly one metre.

They also get the things people forget are in there: your exact handset, your iOS version, the second you pressed the shutter, and your timezone offset. On an iPhone, Apple's private tags add how long the phone had been awake and the tilt of your hand at the moment of capture.

Precision is what makes this different from an approximate guess. A photo file does not just claim a location; GPSHPositioningError grades its own confidence. An iPhone SE sample reported 5 metres. That is a building, not a neighbourhood.

Has photo metadata ever really located someone?

Twice, famously. In both cases the folklore overstates what the metadata did. It has destroyed alibis and corroborated identifications. Finding a documented case where EXIF alone led investigators to a person who was otherwise unknown to them is considerably harder than the retellings suggest.

John McAfee, December 2012

Vice published "We Are With John McAfee Right Now, Suckers" on 3 December 2012. The photo was taken on an iPhone 4S and still carried its GPS block: 15.658167, -88.992167, near Río Dulce, in Guatemala's Izabal department. The security researcher Mark Loveless spotted it within hours.

McAfee first insisted he had falsified the coordinates deliberately, then admitted the truth on 4 December. He was arrested in Guatemala City on 5 December, for illegal entry.

What the metadata actually did: it proved he was lying about being in Belize. It did not lead police to him; he surfaced publicly himself, gave press interviews and sought asylum. "Metadata exposed his cover story" is accurate. "Metadata led to his capture" is not.

Higinio Ochoa III, March 2012

The FBI's affidavit is public, and it does not say what the headlines said. A photo posted alongside a hack carried iPhone 4 GPS coordinates pointing to a suburb east of Melbourne, Australia, where the girlfriend who appeared in it lived.

Two details are routinely mangled. The photo had been edited in Photoshop, and the GPS survived that edit. And the EXIF was corroborating rather than decisive: the affidavit's identification chain rests on a screenshot Ochoa had tweeted showing his own desktop with Skype logged in as anonw0rmer and an IRC client logged in as @higochoa; both identities, one machine; plus subscriber records from a subpoena. He was arrested in Galveston, Texas, on 20 March 2012.

Which famous metadata stories are misremembered?

Four of the most-cited "photo metadata" cautionary tales are not about photo metadata at all, and a fifth rests on a single officer's recollection. They get repeated because they are vivid. Knowing which is which is the difference between understanding the risk and performing it.

The Apache story deserves its own paragraph, because it is probably the single most-cited geotagging anecdote in existence. The primary source is a US Army article, "Geotagging poses security risks," published 7 March 2012, in which an officer recalls that in 2007 soldiers photographed newly arrived helicopters on a flightline in Iraq, uploads let the enemy locate them, and a mortar attack destroyed four AH-64s.

It may well be true. But note what the source does not say: it never specifies the device. The widely-repeated "insurgents used cell phone geotags" headline is an embellishment, and an anachronistic one. The original 2007 iPhone had no GPS at all. It is one officer's recollection, five years later, in an operational-security awareness piece, with no unit, date or incident report attached. Cite it to the Army or leave it alone.

How likely is your photo to carry a location at all?

Roughly 2% of scraped web images carry geolocation EXIF, according to Clearview AI's own estimate in a 2025 UK tribunal judgment. A Berkeley study put geotagged Flickr uploads at 4.3%. Platforms recompress on upload, and recompression drops EXIF as a side effect.

Those numbers deserve to be said out loud, because this genre of article almost never says them.

Separate studies, separate populations, separate years, reported individually rather than plotted on a shared axis, because they do not measure the same thing. An earlier 10% figure from Clearview's CEO was given, the tribunal records, without any search being run.

So the panic framing is wrong. The complacent framing is also wrong, for three reasons that survive the arithmetic:

1. Two per cent of three billion is sixty million photographs. As the Berkeley authors put it, "even a seemingly small fraction like 1% can already translate into several hundred relevant cases."
2. Stripping is a side effect, not a promise. Platforms drop EXIF because they recompress, not because they undertook to protect you. Flickr publishes GPS deliberately.
3. Direct paths bypass all of it. AirDrop, email, WhatsApp document mode, a USB copy: none re-encode, so none strip. The photo you send a person you know is far likelier to carry GPS than the one you post publicly.

That last point inverts the usual advice. Your public Instagram post is probably clean. The original you AirDropped to a colleague is probably not.

Can they find you from the picture itself?

Frequently, and this is the exposure that stripping metadata does nothing about. Signage, architecture, vegetation, skyline and reflections all locate a photo. In 2019 a stalker in Japan identified a singer's train station from the reflection in her pupil, then followed her home.

The Ena Matsuoka case is the one to remember precisely because it is unglamorous: no metadata, no hacking, just a high-resolution selfie, a zoom, and Street View. She had also posted photos from her apartment where the view from the window was identifiable.

Machine vision has made this cheaper every year. A photo carries readable text, recognisable logos, QR codes with URLs inside them, and faces, all extractable in seconds. Removing EXIF does not make a photo anonymous. It removes one channel of several, and often not the widest one.

What should you actually do about it?

Strip location at the share sheet rather than trusting a platform, verify the result on the file you actually sent, and stop assuming airplane mode helps. The FBI's Portland field office recommends exactly one operational step: use an EXIF viewer to confirm the removal worked.

1. Remove location when it matters. Share sheet, Options, Location off. Apple's own method, about five seconds.
2. Verify rather than assume. Send it to yourself through the real path and read the received file.
3. Do not rely on airplane mode. The FBI states that "devices in airplane mode can still capture geo-location information". GPS reception is passive.
4. Do not rely on shrinking the image. Per the same notice, "EXIF data and image quality have no correlation."
5. Look at the picture, not just the file. The window view, the street sign and the reflection outlast every metadata strip.

"Use an EXIF viewer to verify that you were successful in stripping the personal data from the photos before sharing." (FBI Portland, 17 November 2020)