What is EXIF data, exactly?

Exif (Exchangeable image file format) is a published standard — currently Exif 3.1, published by CIPA in January 2026 (3.0 was the May 2023 revision) — for metadata written inside image files. Typical fields include GPS coordinates and altitude, the exact capture timestamp, camera make and model, lens and body serial numbers, editing software and exposure settings. In a JPEG it lives in an application marker segment inside the same file as the picture, so it survives cropping, renaming and redaction of the visible image.

Can ChatGPT or Claude read the EXIF data in a photo I upload?

Two separate questions. The file itself, metadata included, is uploaded in full; there's no upload that sends only pixels. Whether the model is shown the metadata is different: a vision pipeline normally decodes the image and hands the model pixels, so a chatbot will often say it can't see Exif, and that's accurate about its input. With a code or file-analysis tool in the session, the raw bytes can be read directly. Treat "the model didn't mention it" as unrelated to "it wasn't sent".

Does cropping or blurring a photo remove its location data?

Usually not, and never rely on it. Whether metadata survives cropping, blurring or re-exporting depends entirely on the application, the format and the export settings — some editors preserve the block, some rewrite it, some drop it. Renaming alone changes nothing embedded. The Exif block is a separate part of the file and is normally rewritten untouched. You need an explicit strip — Windows' "Remove Properties and Personal Information", macOS Preview, ExifTool, or re-exporting to a new file. A screenshot of the image also drops it, since the screenshot is a new file with no camera data.

Do PDFs and Word documents carry hidden data too?

Yes, and often more consequentially than photos. PDFs carry a document information dictionary with Title, Author, Subject, Keywords, Creator, Producer and timestamps. Word and Excel files keep author, "last modified by", revision count, company, total editing time, comments and tracked changes, which is why Microsoft ships a Document Inspector to remove them. Anonymising the visible text doesn't touch any of it.

What happens to a photo's metadata if I send it to the AI Council?

It's stripped exactly as it's anywhere else in the app. The cleaning happens before the picture goes anywhere, so every model on the panel receives the same cleaned copy. The difference is arithmetic rather than technical: a council puts one question to several models from different companies at once, so that copy reaches several providers instead of one, which matters for the part no stripping tool can fix, the content of the picture itself. Two practical notes: PDFs can't be attached to a council panel at all, and the free pair takes no images either, because one of its two models is text-only. The branded panels do accept them.

Does Secret Chat AI strip metadata from files I attach?

Yes, by default and unconditionally. Every attached image is re-encoded with its metadata stripped, after the orientation flag is baked into the pixels so the picture stays upright; every PDF is rebuilt with Title, Author, Subject, Keywords and Creator blanked, including on the rasterised fallback path. There's no setting and no file that skips it. Two honest limits: the cleaning happens on our servers rather than in your browser (the intermediate copy is deleted once the result is collected, with an hourly sweep), and stripping metadata isn't redacting content — visible text and visible images reach the model exactly as they are.

EXIF: What AI Providers See in Your Files

Published August 5, 2026 · Updated August 18, 2026 · Facts last verified August 18, 2026

This article is general information, not legal advice. For advice about your own situation, consult a qualified lawyer.

You crop the photo so the street sign is out of frame. You black out the client's name in the PDF. You look at the file on screen, and what you see is exactly what you meant to send.

What you see isn't what you send.

Image and document formats all make room for a second compartment: a block of machine-written fields that no viewer shows you by default, describing where the file was made, when, by what hardware, with which software, and sometimes by whom. Not every file carries one, and no single field is guaranteed, but when it's there it rides inside the same bytes as the picture, it can survive cropping and redacting depending on the tool, renaming never touches it, because none of those operations touch it. And when you attach the file to an AI chat, it goes with it.

This article is about that compartment: what is actually in it, who receives it, what the difference is between "the provider has it" and "the model read it", and what to do about it, including the part that stripping metadata can't fix.

The Compartment You Have Never Opened

The format is called Exif (Exchangeable image file format), and it's a real published standard, not a vendor quirk. It's maintained by Japan's Camera & Imaging Products Association; the current edition is Exif 3.0 (CIPA DC-008), released in May 2023, whose headline change was UTF-8 support so that non-Latin scripts could finally be written into the fields. In a JPEG, the block lives in an application marker segment alongside the compressed pixels. It's part of the file in the same way the picture is.

Photographs commonly carry up to three overlapping metadata systems: Exif for camera data, IPTC for editorial fields such as creator and copyright, and XMP, Adobe's XML-based container that editing software writes. A file that has been through a phone and then a photo editor can carry all three, saying slightly different things.

The fields that matter for privacy are the mundane ones:

GPS latitude, longitude and altitude, plus a GPS timestamp — written by phones when the camera has location permission. This is the field that ends careers.
DateTimeOriginal — the instant the shutter fired, to the second, distinct from the file's modification date. It tells anyone reading it when you were somewhere, not when you sent the picture.
Make, Model and LensModel — the device. "iPhone 17 Pro" narrows a population; combined with anything else it narrows it a lot.
Body and lens serial numbers — written by many interchangeable-lens cameras. A serial number is a durable identifier that links every photograph one body has ever taken, which is why press photographers and leak investigators both care about it.
Software — the OS build or the editor that last wrote the file, including whether it was retouched and with what.
Orientation, exposure, ISO, focal length — harmless individually, and a decent fingerprint collectively.

None of this is hidden in a sinister sense. It's documented, standardised, and mostly there for good reasons: your photo app sorts by capture date and shows a map because these fields exist. The problem isn't that they're secret. It's that they're invisible at exactly the moment you decide what to share.

The Canonical Demonstration

In December 2012 the software magnate John McAfee was a fugitive, publicly insisting he was still in Belize. Vice published an exclusive from the road, illustrated with a photograph of him taken on a reporter's iPhone 4S. The photograph had not been stripped.

Readers pulled the Exif block within hours. It contained GPS coordinates placing the shot at a location in Guatemala, near Río Dulce, not Belize. McAfee first claimed on his blog that he had faked the coordinates to mislead police; by the following morning he had posted again, admitting the metadata was accurate. He was picked up by Guatemalan authorities days later.

Nobody hacked anything. Nobody read a private message. A magazine published a picture, and the picture said where it was taken. That's the entire failure mode, and it hasn't changed in fourteen years, only the number of places people upload photographs has.

Look Inside Your Own File in Thirty Seconds

Do this once with a photo from your own phone; it's more persuasive than any paragraph.

Windows — right-click the file → Properties → Details. Scroll. The same dialog has "Remove Properties and Personal Information" at the bottom, which will write you a cleaned copy.
macOS — open in Preview → Tools → Show Inspector → the (i) tab, then the GPS tab if one appears. A GPS tab appearing at all is your answer.
Anything, thoroughly — ExifTool, the reference command-line utility, which reads every block including the ones the OS dialogs don't surface.

One caution: the built-in viewers show a curated subset. A blank Details tab is weak evidence of a clean file; it means Windows found nothing it displays, not that there's nothing there. Verify with a tool that dumps everything, or with the "strip everything" approach below, which doesn't require you to be right about what is present.

It Is Not Only Photographs

Images are the famous case. They aren't the most damaging one, because the documents people attach to AI chats tend to be the documents that matter.

PDFs carry a document information dictionary: Title, Author, Subject, Keywords, Creator, Producer, and creation and modification timestamps — often duplicated in an XMP packet. "Creator" is the application the original was written in; "Producer" is what converted it to PDF. Author is usually populated from the account name of whoever made the file, which on a work machine is a real person's real name, sometimes with their employer alongside it in a company field.

Word and Excel files are worse, because they keep a history rather than a snapshot. A.docx is a zip archive, and inside it docProps/core.xml holds the creator, the "last modified by" name and a revision count, while app.xml can hold a company name and the total editing time. Microsoft's own guidance is explicit that Office documents carry hidden data and personal information — author names, comments, tracked changes, and the email addresses attached to those changes — which is precisely why Word ships a Document Inspector to remove it.

The failure pattern here's specific and extremely common. Someone carefully anonymises a contract: names replaced, figures generalised, the visible text scrubbed. Then they upload it with the client's real firm still sitting in the company property and their own full name in "last modified by". The text was redacted. The envelope wasn't, and the envelope is the part nobody proofreads.

Scans inherit the scanner's make and model, sometimes with an operator or department string. Screenshots are the thin ones: a screenshot is usually born clean of GPS and camera data, which is why "send a screenshot instead of the file" is decent advice. But a screenshot has a different exposure: everything else that was on your screen. Browser tabs, a name in a title bar, a notification banner, the corner of another document. The metadata risk drops to nearly zero and the visual risk goes up, so crop deliberately rather than assuming a screenshot is inherently safe.

What Actually Happens When You Attach It

Three different questions get collapsed into one here, and separating them is most of the clarity available on this topic.

1. What travels? The whole file as you selected it. There's no such thing as an upload that sends "just the pixels", because the pixels are encoded inside the container that holds the metadata. (A client or service may convert, resize or sanitise on the way, but that's something done to your file after you hand it over, not a reason to assume less was sent.) If you attached a JPEG, the Exif block went with it. If you attached a PDF, its author field went with it. Whatever else is uncertain, this isn't.

2. What does the model see? Usually not the metadata, and this is where most of the confusion lives. A vision pipeline typically decodes the image to pixels and hands the model an array of pixels, the Exif block isn't part of what the model is shown. OpenAI documents this directly for ChatGPT image analysis: images are resized and the model doesn't process filenames or metadata. Note the carve-out, though — ChatGPT's document and file analysis, which runs tools rather than a vision pass, can extract metadata. So if you ask a chatbot where a photo was taken, you will often be told it has no access to metadata, and that answer is honest about the model's input. It isn't a statement about the server. Attach a file to a session with a code or file-analysis tool available and the bytes can be read directly, metadata included. "The model didn't mention my GPS" and "my GPS was not uploaded" are entirely different claims.

3. What is kept? Whatever the provider's terms and configuration say, on the provider's clock. Your file is now a file in someone else's system, subject to their retention, their logging, their subprocessors and their legal obligations, exactly like any other document you send to any other company. Providers document how they treat conversation content; the metadata inside an attachment isn't usually addressed as a separate category, because to them it isn't one; it's part of a file you sent.

The productive mental model isn't "can the AI read my Exif". It is: I uploaded this document to a company. Everything in the document went. Behave accordingly.

The Inversion: Metadata They Add

Traffic runs both ways. Images generated by AI increasingly arrive carrying provenance metadata, deliberately attached.

OpenAI began attaching C2PA Content Credentials to images created and edited by DALL·E 3 in ChatGPT and the API, a signed manifest recording the tool that made the image and the actions applied to it, and joined the C2PA steering committee in 2024. Google's SynthID takes a complementary approach with an invisible watermark in the pixels, which survives operations that destroy metadata.

This is a good development, and it has two consequences worth holding at once. If you download an AI-generated image and post it, it may carry a machine-readable statement about how it was made. And in the other direction: the absence of Content Credentials proves nothing whatsoever about an image, since metadata is trivially removed — by stripping tools, by format conversion, by a screenshot, and by many platforms as a matter of routine. Provenance metadata is evidence when present and silence when absent. Never read it as a negative test.

Stripping Is Necessary. It Is No Longer Sufficient.

Here's the part that changed recently, and it's the reason this article doesn't end with "install an Exif cleaner and relax".

In April 2025, OpenAI's o3 and o4-mini brought visual reasoning that could crop, rotate and zoom into an uploaded image as part of working through it, and pair that with web search. Within days people had discovered these models were formidable at deducing where a photograph was taken (cities, landmarks, individual restaurants and bars) from vegetation, architecture, road markings, signage, light and shadow. TechCrunch, reporting the trend, noted that in many cases the models didn't appear to be drawing on Exif data at all. They were reading the picture.

So the boundary has moved. Metadata is the part of a file you can remove. The photograph is the part you can't. A stripped, cropped, screenshotted image of your street still shows your street, and a competent model may well name it, which matters most for exactly the people who most need it not to: journalists protecting a location, activists, anyone photographing something they shouldn't be near.

The honest conclusion is unglamorous. Strip metadata, because it's free, certain and removes the easiest attack. Then decide separately whether the visible content is safe to send, because that's a judgement no tool makes for you.

A Short Note on the Law

Under the GDPR, "personal data" is defined in Article 4(1) as information relating to an identified or identifiable natural person, and the definition expressly names location data and online identifiers among the factors that can make a person identifiable. A geotagged photograph of an identifiable person is therefore doing two things at once, and a device serial number embedded in a file is the kind of durable identifier that definition contemplates.

The practical consequence is about responsibility rather than penalties. If you upload a file containing someone else's personal data — a colleague's name in a revision history, a patient's face in a scan, a client's address in a document property — that disclosure is yours. It isn't made lawful by the recipient being a machine, and no chatbot's privacy policy transfers your obligation to the company you sent it to. This is the same principle that runs through our writing on what the right to erasure actually gets you: rights and duties follow the data, and the data went where you sent it.

What Actually Helps

Turn off location tagging at the camera. The most reliable fix isn't writing the coordinates in the first place — iOS: Settings → Privacy & Security → Location Services → Camera → Never; Android: the camera app's own location toggle. Nothing to remember later.
On iPhone, use the share sheet's Options. Open the photo → Share → Options at the top → turn Location off. Know its limit: that switch removes location and editing data for that share, not the entire Exif block. It's a good habit, not a full strip.
On Android, there is no single universal switch — the behaviour depends on the OEM, the gallery app and the Android version. Google Photos can share without location; otherwise use a metadata-removal app or strip on a computer.
Strip everything on a desktop — Windows' "Remove Properties and Personal Information", or exiftool -all= file.jpg, but read the manual before trusting it: by default ExifTool writes a _original backup alongside the stripped file, it removes the Orientation tag (so rotate the pixels first or the image may display sideways), it can drop the colour profile, it isn't a safe blanket command for RAW or TIFF, and ExifTool itself warns that complete removal isn't guaranteed for every format. It's exhaustive rather than selective. Selective is where mistakes live.
Run Office files through the Document Inspector (File → Info → Check for Issues → Inspect Document) before they go anywhere, and use your PDF tool's sanitise/remove-hidden-data function.
Re-export rather than trusting a viewer. Opening a file, exporting it to a new one and sending that copy discards most of what was riding along, and doesn't depend on you having correctly identified what was there.
Prefer a screenshot of the relevant part to the source document, and crop it deliberately. You lose the file's whole history; you gain responsibility for what else was on screen.
Check before, never after. An upload can't be recalled. Deleting the conversation afterwards doesn't un-send the file, and on most services it doesn't reach the copies the file spawned on the way in.

How Secret Chat AI Handles Attachments

This is one of the few items on the list a service can genuinely fix for you, because the metadata sits in known places in known formats. On Secret Chat AI it's fixed by default, on every file, with no setting to find.

Every image is stripped. Attachments are re-encoded through ImageMagick with its strip operation applied, but only after the Exif orientation flag has been baked into the pixels, so a phone photo still arrives the right way up. Everything else goes: GPS coordinates, capture timestamp, camera make and model, body serial number where present, editing software, the lot. There's no format that takes a shortcut past it and no size below which it's skipped.
Every PDF is rebuilt with its document information blanked. Ghostscript writes a new file with Title, Author, Subject, Keywords and Creator emptied. When a document has to take the fallback path and be rasterised instead, the result is a brand-new file, and the library that assembles it's explicitly told to blank the author, creator and title strings it would otherwise stamp on, so that route leaks nothing either.

One case is worth spelling out, because it multiplies the recipients rather than the risk in any one of them. The AI Council — the app's way of putting one question to several models from different companies at the same time, with a referee comparing their answers claim by claim — cleans an attached image exactly as described above, and then sends that cleaned copy to every model on the panel instead of to one. Documents don't go there at all: no council panel accepts a PDF, and the free pair takes no images either, because one of its two models can't read pictures. The stripping is unchanged; what changes is how many providers receive the picture, which is one more reason to look hard at what is visible in it before attaching.

Three limits, stated plainly, because a page about hidden data is a poor place to hide any.

The cleaning happens on our servers, not in your browser. The original file does leave your device with its metadata intact, is cleaned on our compression service, and only the cleaned version travels onward to the model. That intermediate copy is deleted as soon as the result is collected, with an hourly sweep for anything a closed tab orphaned. It's a real trade-off and we would rather you knew about it than discovered it.

Stripping metadata is not redacting content. Secret Chat AI removes you from your queries; it doesn't remove the data from your messages. If the visible text of that PDF names your client, that text reaches the model exactly as written. If the photograph shows the front of your house, the model sees the front of your house. We clean the envelope; the letter is yours to write, and redacting identifying details before sending remains your responsibility.

And what the provider does see is not you. Your prompt reaches the model through our gateway under our credentials, from our servers: no IP address of yours, no browser, no device, no account, no payment identity. Registration takes an email, but it's used only for account access and payment, never stored against your prompts or associated with them. Retention may still apply at the provider; your query simply arrives anonymized, so a cleaned file lands in an aggregate stream rather than in a file about you. We build no profile of you, no conversation is ever associated with you, and queries are never used for training. You use the model as a stranger.

Frequently Asked Questions

What is EXIF data, exactly?
Exif (Exchangeable image file format) is a published standard — currently Exif 3.1, published by CIPA in January 2026 (3.0 was the May 2023 revision) — for metadata written inside image files. Typical fields include GPS coordinates and altitude, the exact capture timestamp, camera make and model, lens and body serial numbers, editing software and exposure settings. In a JPEG it lives in an application marker segment inside the same file as the picture, so it survives cropping, renaming and redaction of the visible image.
Can ChatGPT or Claude read the EXIF data in a photo I upload?
Two separate questions. The file itself, metadata included, is uploaded in full; there's no upload that sends only pixels. Whether the model is shown the metadata is different: a vision pipeline normally decodes the image and hands the model pixels, so a chatbot will often say it can't see Exif, and that's accurate about its input. With a code or file-analysis tool in the session, the raw bytes can be read directly. Treat "the model didn't mention it" as unrelated to "it wasn't sent".
Does cropping or blurring a photo remove its location data?
Usually not, and never rely on it. Whether metadata survives cropping, blurring or re-exporting depends entirely on the application, the format and the export settings — some editors preserve the block, some rewrite it, some drop it. Renaming alone changes nothing embedded. The Exif block is a separate part of the file and is normally rewritten untouched. You need an explicit strip — Windows' "Remove Properties and Personal Information", macOS Preview, ExifTool, or re-exporting to a new file. A screenshot of the image also drops it, since the screenshot is a new file with no camera data.
Do PDFs and Word documents carry hidden data too?
Yes, and often more consequentially than photos. PDFs carry a document information dictionary with Title, Author, Subject, Keywords, Creator, Producer and timestamps. Word and Excel files keep author, "last modified by", revision count, company, total editing time, comments and tracked changes, which is why Microsoft ships a Document Inspector to remove them. Anonymising the visible text doesn't touch any of it.
What happens to a photo's metadata if I send it to the AI Council?
It's stripped exactly as it's anywhere else in the app. The cleaning happens before the picture goes anywhere, so every model on the panel receives the same cleaned copy. The difference is arithmetic rather than technical: a council puts one question to several models from different companies at once, so that copy reaches several providers instead of one, which matters for the part no stripping tool can fix, the content of the picture itself. Two practical notes: PDFs can't be attached to a council panel at all, and the free pair takes no images either, because one of its two models is text-only. The branded panels do accept them.
Does Secret Chat AI strip metadata from files I attach?
Yes, by default and unconditionally. Every attached image is re-encoded with its metadata stripped, after the orientation flag is baked into the pixels so the picture stays upright; every PDF is rebuilt with Title, Author, Subject, Keywords and Creator blanked, including on the rasterised fallback path. There's no setting and no file that skips it. Two honest limits: the cleaning happens on our servers rather than in your browser (the intermediate copy is deleted once the result is collected, with an hourly sweep), and stripping metadata isn't redacting content — visible text and visible images reach the model exactly as they are.

Conclusion

The privacy conversation about AI attachments has been a conversation about what is in the document. The compartment beside it — the coordinates, the serial number, the author field, the revision history — travels on the same trip, was written by machines that were never asked, and is invisible in every application you use to check your work before sending.

It's also the tractable half. It sits in known fields, in known formats, and removing it's a solved problem: a share-sheet toggle, a right-click, one ExifTool command, or a service that does it for every file without being asked. What isn't tractable is the picture itself, and now that models can read a location out of the pixels, that distinction is the one worth keeping straight.

So: strip the envelope, then decide about the letter. And send it through something that never learns who is asking.

EXIF and Metadata in Uploaded Files
What AI Providers See That You Don't