Contents
No. Removing metadata deletes the tags a file carries, the timestamp, the GPS coordinates, the camera model, but it changes none of the pixels, and the pixels are where the durable identifying signals live. A metadata scrub is a genuine privacy step. The most common mistake people make with images is treating it as the whole job.
What metadata removal actually does
EXIF, XMP and IPTC are blocks of structured text bolted onto an image file, separate from the picture itself, which is why any remover, or simply re-saving the file, clears them without altering a single pixel. That same separation is the technique’s limit. Once the tags are gone the photograph is unchanged, and everything below is read from the photograph rather than from its tags. What a clean strip leaves behind is the subject of can you be identified after removing EXIF data.
The device survives: the sensor fingerprint
Every camera writes a faint, device-specific noise pattern into its pixels, the photo-response non-uniformity, or PRNU, introduced as a method for camera source identification by Lukáš, Fridrich and Goljan (IEEE TIFS 2006). It arises from tiny manufacturing differences in how each sensor pixel responds to light, so it is a property of the pixels and not something software writes into the file. A metadata wipe cannot touch it. It is also durable: Goljan and Fridrich report that “The fingerprint survives a wide range of common image processing operations, including lossy compression, filtering, and gamma adjustment” (Proc. SPIE 6819, 2008), and describe the pattern as “biometrics for sensors.”
Its reach is conditional, though, not magic. Matching a photo to one specific camera needs the suspect device in hand plus clean reference images, and the fingerprint’s uniqueness is now contested on modern phones. Iuliani, Fontani and Piva warn that “with the advent of computational photography, most recent devices heavily process the acquired pixels, possibly introducing non-unique artifacts that may reduce PRNU noise’s distinctiveness” (IEEE Access 2021), concluding that “the effectiveness of PRNU based source identification on the most recent devices must be reconsidered.” What the fingerprint can and cannot establish is covered in can a photo be traced without metadata.
The location survives: geolocation from content
A deleted GPS tag does not hide where a photo was taken, because the scene carries the answer. Neural geolocation models read a storefront, a skyline or the quality of the light and place the shot on a map. PlaNet “outperforms previous approaches and even attains superhuman levels of accuracy in some cases” (Weyand, Kostrikov, Philbin, ECCV 2016). Newer systems are sharper: PIGEON lands 40.4% of its predictions within 25 km of the true location, a city-scale radius, and separately reaches 92.0% country accuracy with a median error of 44.4 km (Haas et al., CVPR 2024). Others, such as GeoCLIP, align an image directly against a learned, continuous map of coordinates (Vivanco Cepeda et al., NeurIPS 2023). Coarse placement at the country or city scale is strong and exact street-level precision is weaker, but none of it relies on the GPS field you removed.
The identity survives: recognition and inference
A face is the most direct identifier, and modern recognition is close to perfect on clean images: ArcFace reaches about 99.8% on the standard LFW benchmark (Deng et al., CVPR 2019). That figure falls on real-world images, however. Kim and colleagues note that “Recognition in low quality face datasets is challenging because facial attributes are obscured and degraded” (AdaFace, CVPR 2022), so a small, blurred or poorly lit face is far from a guaranteed match.
It is not only the face. A megastudy by Tkachenko and Jedidi tested 349 binary attributes across 2,646 facial images of 969 individuals, and found 82 of 349, about 23%, predictable better than random from the image alone (Scientific Reports 2023). The readable signal is mostly demographic. The authors name “smartphone camera artifacts, BMI, skin properties, and facial hair” as top candidate non-demographic signals, not personality or character, so the apparent is not the true. Their privacy conclusion is still blunt: facial analysis retains “the ability … to strip away privacy, regardless of whether predictions are based on biological features or on other potential signals, such as makeup, hair style, picture angle and lighting, background.”
Obscuring the face is a weaker fix than it looks. Todt, Hanisch and Strufe found 11 of 15 tested face anonymisations at least partially reversible, with Gaussian blur and pixelation among them, because they “only generalize the information … by averaging it,” leaving identity obfuscated and not removed (Fantômas, PoPETs 2024). The same study found deep, GAN-based anonymisers the least reversible, so which method you use matters a great deal.
Reduction, not invisibility
Because device, location and identity all live in the pixels, anonymising a photo is a pixel operation rather than a metadata one. In practice that means removing or cropping identifying content instead of merely blurring it, weakening the sensor fingerprint by downscaling and re-encoding, and checking whether a copy is already indexed online. None of these is free and none is complete, which is why the right framing is reduced exposure, not invisibility.
How much is reduced depends on the photo. An image with no faces, no landmarks and heavy compression leaks little once its tags are gone; a sharp portrait outside a named shop leaks a great deal no matter what you strip. To gauge your own image, read what does your photo reveal about you; when you are ready to act, the pixel-level routine is how to make a photo untraceable.
Sources
- Lukáš, Fridrich, Goljan (2006). Digital Camera Identification from Sensor Pattern Noise. IEEE TIFS 1(2):205-214.
- Goljan, Fridrich (2008). Camera Identification from Cropped and Scaled Images. Proc. SPIE 6819, Security, Forensics, Steganography, and Watermarking of Multimedia Contents X.
- Iuliani, Fontani, Piva (2021). A leak in PRNU based source identification. Questioning fingerprint uniqueness. IEEE Access 9.
- Weyand, Kostrikov, Philbin (2016). PlaNet: Photo Geolocation with Convolutional Neural Networks. ECCV 2016.
- Haas, Skreta, Alberti, Finn (2024). PIGEON: Predicting Image Geolocations. CVPR 2024:12893-12902.
- Vivanco Cepeda, Nayak, Shah (2023). GeoCLIP: Clip-Inspired Alignment between Locations and Images for Effective Worldwide Geo-localization. NeurIPS 2023.
- Deng, Guo, Xue, Zafeiriou (2019). ArcFace: Additive Angular Margin Loss for Deep Face Recognition. CVPR 2019:4690-4699.
- Kim, Jain, Liu (2022). AdaFace: Quality Adaptive Margin for Face Recognition. CVPR 2022.
- Tkachenko, Jedidi (2023). A megastudy on the predictability of personal information from facial images. Scientific Reports 13:21073.
- Todt, Hanisch, Strufe (2024). Fantômas: Understanding Face Anonymization Reversibility. Proc. Privacy Enhancing Technologies (PoPETs) 2024(4).