What is EXIF data in a photo?

What exactly is the EXIF standard?

EXIF is jointly formulated by the Camera & Imaging Products Association and JEITA, published under dual numbering as CIPA DC-008 and JEITA CP-3451. It dates to October 1995 and reached version 3.1 on 30 January 2026. It specifies which tags a camera writes and exactly where in the file they sit.

The standard's own front matter is unambiguous about the joint authorship: CIPA and JEITA "jointly formulated this standard." It originated with JEIDA, JEITA's predecessor organisation. Anyone telling you EXIF is a Kodak or Adobe format is repeating a mix-up.

Version history matters more than it sounds, because it explains why location is in there at all. GPS was not part of the original design. It arrived in Exif 2.0 in November 1997, described in CIPA's own overview as adding "GPS Info IFD provisions that record GPS (location) information." Everything since has been refinement.

Dates from CIPA's own standards history. Most articles describing "the current EXIF spec" are citing 2.3, which is sixteen years old.

How is EXIF stored inside a photo file?

EXIF lives in a TIFF-structured header near the start of the file, organised into directories called IFDs. A main directory holds camera identity, a sub-directory holds exposure detail, and two optional pointers lead to the GPS block and to the manufacturer's private MakerNote section.

The layout matters because it explains a behaviour people find surprising: metadata survives independently of the picture. Cropping an image, rotating it, or adjusting its colour rewrites pixels while leaving the IFDs untouched. That is why an edited photo can still carry the coordinates of where the original was shot.

One consequence worth internalising: XMP, IPTC and the ICC profile are not EXIF. They are separate metadata containers in the same file. A tool that promises to "remove EXIF" may leave them entirely intact, and GPS coordinates can live in XMP too.

Which EXIF fields does an iPhone write by default?

An iPhone writes camera identity, the iOS version, a precise lens description, exposure settings, a timestamp with its timezone offset, and, if Location Services is enabled for Camera, a full GPS block that states its own accuracy in metres. The values below come from real files.

Values observed in real dumps from an iPhone 6 (iOS 9.2), iPhone SE (iOS 13.4.1) and iPhone 12 Pro (iOS 16.6). Tag IDs per CIPA DC-008.

Note GPSHPositioningError in particular. The file does not merely claim a location; it grades its own confidence. An iPhone 6 sample reported 25 metres of horizontal error, an iPhone SE sample 5 metres. That single field is the difference between "somewhere on this block" and "this doorway."

What are Apple's private MakerNote tags?

MakerNote is a section of EXIF the standard leaves entirely to the manufacturer. Apple uses it to record things no photography workflow needs: how long the phone had been awake, the tilt of your hand at the shutter, whether a person was detected in frame, and how far away the subject was.

None of this is documented by Apple. What is known comes from Phil Harvey's reverse-engineering in ExifTool's Apple tag table, the reference every other tool derives its names from. Three tags deserve individual attention.

0x0003, RunTime: your phone's uptime

Tag 0x0003 holds a binary property list containing a CMTime structure. ExifTool documents it as "the amount of time the phone has been running since the last boot, not including standby time." The scale is typically 1000000000, nanoseconds. A real iPhone 6 sample decodes to 1 days 12:26:53.

Consider what that enables. Two photos from the same power session have run-times whose difference is real elapsed active time. That orders your shots and clusters them to one device and one boot session, even if every timestamp has been stripped or forged. It is a correlation handle that survives the obvious countermeasures.

0x0008, AccelerationVector: how you were holding it

Three signed rationals, described verbatim as "XYZ coordinates of the acceleration vector in units of g. As viewed from the front of the phone, positive X is toward the left side, positive Y is toward the bottom, and positive Z points into the face of the phone."

A phone at rest measures only gravity, so this vector is the tilt of your hand at the instant of capture. Work an example: the sample (-0.0285, -0.8718, 0.4932) has a magnitude of 1.002 g, confirming near-stillness, and resolves to roughly 29.5° back from vertical. A phone held upright in portrait, leaned back, camera angled slightly downward. That is a posture, reconstructed from a photo, years later.

Harvey notes the axes are "contrary to the Apple documentation (which have the signs of all axes reversed)," producing a left-handed coordinate system. Apple's CoreMotion reports the negation of what the file stores.

0x0011, ContentIdentifier: the Live Photo join key

A UUID string linking a Live Photo's still to its paired video. The same identifier appears in the MOV as com.apple.quicktime.content.identifier, and ExifTool notes it is "called MediaGroupUUID when it appears as an XAttr." Tag 0x0011 is decimal 17, the same key Apple exposes publicly as index 17 of its MakerApple dictionary.

It is a durable cross-file join. Send the still to one person and the video to another, months apart, through different apps, and the UUID still ties them to each other and to the burst they came from.

Per ExifTool's Apple.pm. Harvey flags several further tags with question marks in his own source; those are omitted here rather than reported as fact.

How many photos actually carry GPS coordinates?

Fewer than the alarm suggests. Clearview AI estimated that 2% of three billion scraped images carried geolocation EXIF, and a Berkeley study found 4.3% of Flickr uploads geotagged. The reason is mundane: platforms re-encode on upload, which drops EXIF as a side effect.

The honest numbers are worth stating plainly, because most writing on this subject implies your photos are constantly broadcasting your position. Two independent measurements say otherwise.

Different studies, different populations, different years, shown as separate figures rather than plotted together, because they are not measurements of the same thing.

• Berkeley, 2010. Friedland and Sommer examined all 158 million images uploaded to Flickr in the first four months of 2010: about 4.3% geotagged, down from a 9.3% peak in late 2006. YouTube ran near 3%.
• Craigslist, same study. Of 68,729 images, about 48% retained some EXIF but only 1.3% had GPS, because Craigslist recodes direct uploads.
• Clearview AI, 2022. In ICO v Clearview [2025] UKUT 319, Clearview stated that a search of three billion images found geolocation EXIF on about 2%, "because EXIF data is usually stripped away in the uploading process." An earlier 10% figure from its CEO was, the tribunal records, given without any search.

So why care about a 2% problem? Three reasons, and they survive the arithmetic.

1. The minority that leaks is not random. Friedland's own conclusion: "even a seemingly small fraction like 1% can already translate into several hundred relevant cases." Two per cent of three billion is sixty million photographs.
2. Stripping is a side effect, not a promise. Platforms drop EXIF because they recompress, not because they committed to protecting you. Flickr publishes GPS deliberately. Pipelines change without notice.
3. Direct paths bypass all of it. AirDrop, email attachments, WhatsApp document mode and a USB copy hand over your original file. None of them re-encode, so none of them strip.

The precision is the point rather than the frequency. Friedland's team matched geotagged photos against Street View imagery to within about one metre. A fix that lands in the right doorway does not need to be common to matter.

How do you read the EXIF data in your own photos?

On a desktop, Phil Harvey's ExifTool is the reference implementation and the source most other tools inherit their tag names from. On an iPhone, Image Inspector reads the whole block, including the Apple MakerNote, on the device, with no cloud upload and nothing retained.

The FBI's Portland field office made the operational case in a November 2020 public notice, and it applies directly:

"Use an EXIF viewer to verify that you were successful in stripping the personal data from the photos before sharing," advised FBI Portland on 17 November 2020.

Two more findings from that same notice are worth carrying with you. "EXIF data and image quality have no correlation. Lower quality images still contain EXIF data." So shrinking a photo does not clean it. And "devices in airplane mode can still capture geo-location information." Flight mode is not a geotagging control.

Reading your own files once is genuinely clarifying. Most people have never seen the record their phone keeps, and it is difficult to make a good decision about sharing a photo while you are unaware of what the photo says.