The Off-Key Bard
Technology

What Is Metadata, and How Much Does a Photo Know About You?

Or: the information hiding around the information you can actually see. The picture tells one story. Sometimes the file quietly tells another.

Or: The Information Hiding Around the Information You Can Actually See

Take a photo with your phone and look at the image. You see the obvious information — the people, objects, buildings, or landscape in front of the camera. From your perspective, that's the photo. But the file can know considerably more than what appears in the picture. It may know when the image was created, which phone or camera took it, whether the flash fired, what focal length was used, how the device was oriented, and sometimes exactly where on Earth the shutter button was pressed. None of that has to appear visibly in the image. It's stored alongside it, in something called metadata — and metadata exists almost everywhere in computing, not just inside photos.

Data About Data

The simplest definition is right there in the name: metadata is data about other data. A photograph is data; its creation date is metadata describing that photograph. A music file is data; the artist, album, and track number are metadata describing the music. A document contains the words you wrote, while its metadata may describe the author, creation date, and revision history. Even an ordinary file on your computer carries metadata — filename, size, creation time, modification time, permissions — none of which is the content itself.

A useful comparison is a shipping label on a cardboard box. The object inside is the main content, but the box also carries a label with the sender, destination, tracking number, and routing codes — details that aren't the thing you ordered, but information describing it and helping systems manage it. And just as a shipping label can reveal more about a package's origin than people expect, metadata can sometimes reveal more about a file than its owner realizes.

Why Photos Carry So Much of It

Digital photography created an enormous need for metadata, because a modern camera doesn't simply record pixels — it makes decisions about exposure, focus, white balance, and lens behavior that photographers and software both want access to later. The standard built for this is EXIF, Exchangeable Image File Format, and as Wikipedia's entry on the standard describes, it's used to embed exactly this kind of technical metadata inside an image file: camera manufacturer and model, lens information, exposure time, aperture, ISO sensitivity, focal length, flash status, and dimensions. For a photographer, that's genuinely useful — compare two similar shots and the metadata can tell you the successful one used a faster shutter speed, rather than relying on memory. Photo software can also search and organize an entire library using those fields, turning a folder of pictures into structured information.

Smartphones go further, because they combine a camera with GPS, a clock, motion sensors, and network connections, letting them attach even more context to a photo. The most significant addition is location: if location tagging is enabled, the file may contain GPS coordinates precise enough to place the shot on a map later — which is genuinely convenient for remembering a trip, and genuinely risky the moment you share the original file. A perfectly innocent photo of your cat on the couch can carry the coordinates of your living room, so the recipient isn't just seeing what your cat looks like — they may have enough information to know where the couch is. Plenty of platforms strip some of that metadata automatically, but the broader lesson holds regardless: what you see in a file isn't necessarily everything the file contains.

More Than One Clock Inside a Single File

Location gets most of the attention because the implication is obvious, but it's only one category. A single photo can carry its capture date, device orientation, flash status, and editing software history, and individually those details might seem harmless — combined, they build context a single field never would. Timestamps in particular are more complicated than they look: a photo can carry a date it was originally captured, a separate date the file itself was created on a given storage system, and yet another date it was last modified, and those three don't have to agree. Copy a photo to a new device and the filesystem's creation date may change while the embedded EXIF capture date stays untouched; edit the image and the modification date changes again. So when someone says a file "was created Tuesday," the real question is which timestamp they mean, because computers routinely keep several different notions of time running in parallel — and this is exactly why metadata is treated as evidence rather than proof in digital forensics: clocks can be wrong, fields can be edited, and copies can rewrite values, so an important conclusion should rarely rest on one easily modified timestamp alone.

The Same File Can Use Different Metadata Systems

Not every format stores this information the same way. Photos and other media can carry metadata through several different schemas layered into a single container: EXIF for hardware capture details, IPTC for editorial information like captions and copyright, and XMP — Extensible Metadata Platform, a standard Adobe documents and maintains as a file-labeling technology for embedding titles, descriptions, keywords, and authorship directly into a file as it moves through an editing workflow. The technical details differ, but the idea is the same across all of them: structured fields describing the content, which software can read automatically rather than having to inspect every file visually. That's also how an image can know it should display rotated correctly — an orientation tag tells a viewer how to render the pixels, rather than the pixels themselves being rearranged, which is why the same photo sometimes appears right-side up on one device and sideways on another: the pixels are identical, only the interpretation of the tag differs.

Editing a photo can quietly rewrite this layer, too. Open an image in editing software and save it, and the application may preserve some fields, drop others, or add new ones identifying itself as the software that last touched the file — whether GPS data survives often comes down to the specific export settings used, not some universal rule about edited photos.

Where Metadata Hides Beyond the File Itself

Metadata isn't confined to the file you're holding. Take a screenshot of a photo and you get an entirely new image, containing the pixels visible on screen rather than the original's EXIF structure — the camera and GPS metadata generally doesn't carry over, though the screenshot picks up its own new metadata describing when it was created. Upload a photo to a social network, and the service typically reprocesses it — resizing, compressing, generating thumbnails, and often stripping EXIF fields including GPS data from the public-facing copy. That doesn't necessarily mean the information vanishes everywhere: a platform can read the metadata during upload, retain it internally, and only strip it from what other users can download. Metadata embedded in a file and metadata recorded by a platform are two separate things, and removing one doesn't remove the other. A service can also generate its own metadata that never touched the file at all — upload time, account, IP address, device type, and who interacted with the post — which is why "I removed the metadata" is often an incomplete sentence; the real question is which metadata, held by which system.

This pattern repeats everywhere. Email headers carry metadata about which mail servers handled a message and when, useful for diagnosing delivery problems or investigating phishing even when the visible sender name is faked. Documents can carry author names, template information, and revision history that a public release never intended to disclose — and tracked changes or comments can preserve content that looks deleted on the page but isn't actually gone from the file, the same lesson PDF redaction runs into when a black rectangle covers text that's still selectable underneath. Filesystems track their own layer regardless of what's inside a file, and cloud storage adds yet another: a photo can plausibly say it was captured in 2018, show a local creation date in 2024, and report an upload date in 2026 — all three correct, because they're each describing a different event.

Why This Matters More as Images Get Harder to Trust

Because metadata is usually editable, it isn't automatically more truthful than the content it describes — a camera's clock can be set wrong, fields can be rewritten by software, and a file copied between systems can pick up inconsistencies along the way. That's a real limitation, but it points toward a more useful idea than simply deleting everything: cryptographically verifiable provenance. The Coalition for Content Provenance and Authenticity, or C2PA, is an industry effort built around exactly this gap — rather than metadata that just claims a file came from a particular camera or wasn't touched by AI, the coalition's Content Credentials standard aims to make that history verifiable, tying a record of a file's origin and edits to the file in a way that's far harder to quietly rewrite than an ordinary metadata field. As synthetic and AI-edited images become harder to distinguish by eye, that kind of verifiable history becomes more valuable than metadata that simply asserts something and hopes to be believed.

The privacy side of the same coin has nothing to do with authenticity and everything to do with aggregation. The Electronic Frontier Foundation's widely cited piece on the subject argues that metadata can reveal patterns even when every individual fact looks harmless on its own — timing, location, and frequency, without a single word of actual content, can still expose relationships, routines, and behavior over time. One photo's timestamp tells you little. Years of timestamps and coordinates together can describe where someone works, where they travel, and when they're away from home — which is precisely why metadata earns a reputation as sensitive even though, taken one field at a time, it rarely looks like anything worth hiding.

It's Infrastructure, Not a Conspiracy

None of this makes metadata inherently sinister. Most of it exists because computers need context to function at all: a music player needs to know which album a song belongs to, a camera needs to record orientation to display correctly, an operating system needs to know when a file last changed, an email server needs routing information to deliver a message. Deleting metadata indiscriminately can destroy real value — photographers depend on EXIF, archives depend on descriptive fields, and search systems depend on structured data to organize anything at scale. The actual privacy question was never whether metadata exists; it's what information is being recorded, who can see it, and whether that matters in the specific situation a file is heading into. A camera model is rarely sensitive. The GPS coordinates of a private home can be. The same field can be harmless in one context and genuinely risky in another, which is why "always strip everything" is about as useful as "never strip anything" — neither one engages with what the file is actually about to do.

The Bard's Take

Metadata is one of computing's quietest technologies, because when everything works correctly, almost nobody notices it. You take a photograph and see a photograph; the file itself may carry a creation time, camera model, exposure settings, orientation, software history, and GPS coordinates. You play a song and hear music; the player sees a file tagged with artist, album, and track number. You open a document and read the words; the file may also know who wrote it, when it was last touched, and what revisions never made it onto the visible page.

That's what turns raw information into organized information — it's how a computer knows what something is, when it happened, where it came from, and how it should be handled. The privacy lesson was never that metadata is secretly malicious or that every file needs to be scrubbed before it leaves your hands. It's that invisible information is still information, and it's worth a moment, before sharing something sensitive, to ask what the file might know that you can't see just by looking at it. Sometimes the answer is nothing that matters. Sometimes it's exactly where you were standing. And sometimes the most interesting thing about a photograph was never in the pixels at all — the picture tells one story, and the metadata quietly tells another.

Sources

← Back to the Desk — Technology