Location is the headline; the rest is the fingerprint

GPS coordinates get most of the attention because they are the most obviously alarming field, and rightly so. But a photo file typically carries several other blocks of metadata that, taken together, can identify a device and link it to every other photo it produced - with no location field required at all. How precise that coordinate actually is, and what radius it narrows a person down to, is its own worthwhile question, covered in GPS precision in photo metadata.

The blocks, and what each one holds

EXIF is the block most people mean by "metadata": camera make and model, lens identifier, exposure settings, orientation, colour profile, and a timestamp accurate to the second. On its own, a make and model is not identifying - millions of people own the same phone. Paired with a timestamp and a pattern of other photos from the same device, it starts narrowing things down.

MakerNotes is a proprietary sub-block that manufacturers use for whatever they want, undocumented and inconsistent across brands. This is where the more specific identifiers tend to live: some devices write a body or sensor serial number here, which links every photo from that camera to every other one, independent of any account or filename. Because MakerNotes fields are not standardised, generic "strip metadata" tools sometimes miss fields that a manufacturer-specific tool would catch.

IPTC is older, built for the news and stock-photo industry, and carries caption, keyword, credit and copyright fields. Consumer photos rarely have these populated, but an image that has passed through professional editing software sometimes does, and the fields persist through edits that touch only the pixels.

XMP is Adobe's newer, more flexible metadata format, stored as embedded XML, and it is what most modern editing software writes to when you add a caption, a rating star or a keyword in a photo management app. It can also record edit history - which tools touched the file and when - which is informative about a file's provenance in a way none of the older blocks are.

Embedded thumbnails are a small preview image stored inside the file for fast display in file browsers and camera software. The thumbnail is generated at capture time and does not always get regenerated when you crop or edit the main image, which means a photo you cropped can still carry a small copy of the original, uncropped frame inside it.

Why the combination matters more than any single field

No individual field beyond GPS is usually damning on its own. The risk is linkage: a device model plus a lens plus a software version plus a sequence of timestamps is a fingerprint that, cross-referenced against other photos carrying the same combination, ties images together even when no single field names a person. That is the same logic that makes a body photo without a face still potentially identifying - identity is rarely one field, it is several weak signals converging.

What generic stripping does and does not catch

A tool that says it "removes EXIF" is usually targeting the standard EXIF block and sometimes GPS specifically, which is the highest-value target and the right one to prioritise. Whether it also clears MakerNotes, IPTC, XMP and the embedded thumbnail depends entirely on the tool, and this is exactly where the ten-second routine covered in stripping EXIF before you upload can fall short without you knowing it - the steps there handle the common case well but were not written to guarantee every block on every platform. The only way to know for certain is to inspect the file afterward with something that reads all the blocks, not just the headline one.

What is out of scope here

This inventory does not cover the newer provenance signatures some cameras and apps now attach, which are a different mechanism with different implications, nor does it cover what messaging and cloud apps do to metadata on their own - both are their own subject. It also is not a measurement question: none of these fields feed anything about size, which comes from a tape and a repeatable procedure, not a file's metadata.

Where this fits into a broader check

Metadata is one item on a longer list worth checking before any upload, alongside where the file goes, how long it is kept and who can see it. Rate Cock states its handling of uploaded files rather than leaving the metadata question implied, which is the standard worth expecting from anywhere you send an image. If the goal is comparing how thoroughly different tools disclose this kind of handling, that comparison is covered from the reader's side elsewhere, separate from what the file itself is carrying.