Checklist

Photo privacy checklist — 7 steps before you share

A short, repeatable checklist that catches what most people miss: GPS, device fingerprints, edit history, thumbnails, and three less-obvious leaks. Takes under a minute per photo.

The 7-point pre-share photo privacy checklist

Run through this every time you are about to post, send or upload a photo of yourself, your home, your kids, your workplace or anything you cannot un-share.

1. GPS coordinates — are they in the EXIF block? 2. Camera serial number / device fingerprint — would two photos from different accounts trace back to the same body? 3. Capture timestamp — does it reveal when you were where? 4. Editing software signature — does the photo broadcast it was retouched in Lightroom or Photoshop? 5. Embedded thumbnail — is the pre-crop original still hiding inside? 6. XMP / IPTC author and copyright fields — is your real name in there? 7. ICC color profile — does it name your monitor, your studio or your editing tool?

A clean photo passes all seven. Most photos out of an iPhone or DSLR fail the first three by default.

What each check catches

GPS is the most famous leak — coordinates accurate enough to pinpoint a hotel room. Camera serial number is the quiet one: two photos shared under different aliases can be tied back to the same body, defeating pseudonymity. Capture timestamps combined with GPS form a behavioural profile.

Editing software signatures (the "Software" field) are usually low-risk — but in a journalism or trust-and-safety context, they can imply manipulation. Embedded thumbnails are the most overlooked: many editors crop the visible pixels but leave the original thumbnail unchanged, so the "before" version travels with the file.

XMP and IPTC fields can hold your full legal name and a copyright string that your camera or editor injected without asking. ICC color profiles can name a specific monitor model or a paid Adobe profile that fingerprints your editing setup.

Special cases: travel, real estate, kids

Travel photos: turn off camera-app location services before the trip, or strip every photo before posting. GPS in a vacation photo names the hotel and floor; combined with the capture timestamp it tells anyone watching exactly when you are not home.

Real estate photos (sold by an owner or shared on a marketplace): home interior photos are uniquely valuable to bad actors. Strip GPS (the house address is implicit, do not confirm it) and strip the camera serial — the same body may show up in your other listings.

Photos of kids: the bar is highest. Strip everything, every time. Treat the embedded thumbnail check as mandatory — many editors that "blur faces" do not blur the EXIF thumbnail, defeating the whole point.

Run the checklist on a photo →

Frequently asked questions

Do I need to do this for every photo?
For photos of identifiable people, locations or interiors — yes. For abstract images, sunsets or stock-style photos with no personal context — the risk is lower, but the cleanup still takes seconds. A good habit is to strip everything by default and only keep metadata when you have a reason (portfolio attribution, journalistic provenance, sale receipts).
What about old photos already shared?
Anything already shared on a platform that strips EXIF (Instagram feed, Twitter posts) is usually safe — those platforms re-encode and drop metadata. Photos shared via Messages, email, AirDrop, WhatsApp originals, Telegram "send as file", or downloaded copies retain the original metadata. You cannot unsend, but you can stop the leak going forward.
How do I batch-process my photo library?
ExifSweep supports batch upload (1 file/batch on the free tier, 3 on Pro, 10 on Plus). You can drop a folder or ZIP. For 10,000+ photos, the Plus HTTP API and a small script is faster than the UI.
Should I worry about photos of my home interior?
More than most people think. Interior photos reveal layout, security setup, valuables and the floor plan to anyone who sees them. Combined with the metadata leak (GPS, serial number) they become a high-quality target package. Strip aggressively before sharing on real-estate sites, marketplaces or social posts.
What about photos with children?
Highest sensitivity. Strip GPS first (school location, home location), strip the camera serial (so the photo cannot be linked across accounts), and verify the EXIF thumbnail is gone (some editors leave the pre-blur thumbnail intact). If in doubt, do not share — there is no privacy-recoverable version of a child photo on the internet.