About photos - how can I check and make sure they do not contain any metadata EXIF for malicious people to track me or identify me?

I was asked this question earlier this year and it is an interesting question because this is exactly what we ask ourselves at snapWONDERS and have given a lot of thought in this realm.

We are very much interested with metadata within photos and exposing the privacy, tracking, identification, online safety and copyright concerns. Such information potentially could be used for forensic purposes as well.

Privacy Concerns, Metadata and Photo Analysis

It is well known that photos contain more than just image information. Photos may contain metadata and when used in a way that was not intended, it may raise some concerns on privacy and questions like these get asked.

As an example, a photo containing metadata may reveal:

• Date and time of the photo - the when.
• Location of where the photo was taken. This might be a privacy concern if you intended to keep the location of the photo private (i.e the photo might be shot at your workplace or private dwelling).
• Personal details such as your name, serial number, hardware identifier and device information that potentially can be used for tracking or forensic purposes.
• The type of camera and hardware used in taking the photo.
• Photos can contain thumbnails within the different metadata sections. This matters if you have blotted or blacked out sensitive parts of the photo and left the thumbnails intact inside. Under these circumstances, it may be possible to uncover what had been blotted or blacked out in the photo.
• Photo signatures which analyses the “trait” aspects of the photo itself to determine likelihood that photos were shot at the same scene or camera. This may be based on the underlying image compression details, lighting relationships from the image and other pattern analysis checks
• Artificial Intelligence (AI) analysis on the image content itself may generate metadata (for example “Face Detection”, “Face Recognition”, textual extraction to artificially understand the image contents itself)
• How you shared your photo content online.
• Whether your image contains faces, textual content and other photo leakage that can be uncovered through deep pattern analysis

Hidden Metadata

Although the question specifically mentioned EXIF, it should be noted that personal information that could be potentially identifiable or used for tracking is not limited to EXIF metadata. There are many other metadata sections that potentially could be expose or leak information as well. This could be the XMP, MPF (which may also contain additional EXIF), IPTC, Photoshop, Adobe, XAP, XAP-Ext, proprietary content and so on.

Some cameras / devices embed serial numbers or unique references which could be used for tracking purposes. Sometimes copyrights are added to the photo which may include your name which is acceptable if that was your intention. However, the addition of copyrights does provide the means to identify you, or your company/brand or “tag-name” that you operate under.

Different camera models or mobile smartphones have manufacturers that favour certain metadata types, and may even embed other proprietary content which is not disclosed on what the content contains. Example on different metadata and image sections has been shown at: https://snapwonders.com/checked-on-these-cameras-or-mobiles which shows a break down of metadata sections to popular cameras and smartphones.

So just Delete Metadata and I am safe?

It is very possible to remove the said metadata and help prevent tracking or identification. However, this statement is not entirely true. You might be wondering, what does this mean if you removed all the metadata then there should be no problem? Right? Well that depends…

It depends on:

• How you shared your photo content online.
• Whether your image contains faces, textual content and other photo leakage that can be uncovered through deep pattern analysis

Sharing Photo Content Online

How you share your photo content online matters. There is nothing stopping an app or online website portal that you are using to add the metadata into your content that is then used in a way unknown to you. The ability to assign unique references attached to content and associate this with a “person” via an account (or a device) provides mechanisms to track and gather information in a way that can learn patterns, infer relationships, behavioural analysis and for forensic purposes.

Even if there was no visible metadata shown then it does not mean the photo is free from tracking if steganography was added to the photo. Steganography is the practice of concealing a file, message, image or content within another file (in this case it would be the photos and media).

Photos containing Faces and Textural content

Currently the technology to do deep photo analysis to detect faces in an image, do face or object recognition or analyse the photo for textual content and extract out the text contents is already happening.

This means that a photo that may have metadata deleted may at some point undergo deep analysis and have new metadata generated, profiled and information built based upon the photo contents itself.

Imagine a scenario where several photos of you is shared online on the internet at various websites. Analysis on each website content generates 2 or 3 keywords based on content analysis. Based upon this there is a good statistical chance that your photo is somehow affiliated or connected to the keywords uncovered.

In the similar fashion and depending on the content available, it may be possible to delve deeper and infer names, locations, and other identifiable information about the photos. The more digital media content available means the more information and relationships can be uncovered.

Clearly from the information gleaned it can be possible to reconstruct metadata despite having metadata deleted.

Exposing Privacy, Tracking, Hidden Metadata Concerns in Digital Media

You can run the online tool at snapWONDERS to get an instant assessment report on the privacy, tracking, hidden metadata and copyright concerns.

About the Author