Privacy ·
Image metadata and the security risk of hidden EXIF data
Phone JPEGs embed TIFF IFDs in APP1: GPS latitude, altitude, unique camera IDs, orientation. Publishing the original is a location leak. Stripping in the browser means parsing or re-encoding locally, not sending the photo to a metadata site that now has both pixels and coordinates. Use remove EXIF or a canvas re-encode.
TIFF-in-JPEG APP1 structure
SOI, APP1 with Exif\0\0, TIFF header, IFD0, optional Exif IFD and GPS IFD. GPSLatitudeRef and GPSLatitude are rationals. Serial numbers and lens IDs live in maker notes, often proprietary. A “free EXIF viewer” that uploads the JPEG has your coordinates even if you only wanted to see them.
XMP packets and Photoshop IRB can duplicate GPS. Stripping APP1 only is incomplete on some exports. A dedicated remove EXIF pass should drop known segments, then you verify.
Why drawImage plus toBlob strips tags
The encoder writes a new bitstream from pixels. It does not copy APP1. That is the Canvas pipeline. It also recompresses — a quality cost. A dedicated stripper can rewrite JPEG without a full raster when it only removes segments. Choose strip-only when you cannot afford another JPEG generation.
HEIC and PNG extras
HEIC: iloc/meta boxes. PNG: tEXt, zTXt, iTXt, eXIf. SVG: metadata elements and editor junk. Each format needs its own strip, still local. Image format converter is a re-encode and will usually drop foreign metadata because it never copies those chunks.
Orientation must be applied before strip
Tag 274. Rotate or flip the bitmap, then encode without the tag. If you only delete the tag, photo apps show a side-lying image. This is the most common “your stripper is broken” report; it is a viewer applying a tag you removed.
Policy and minimization
Newsrooms, HR, and customer support should not email camera originals from phones. Minimize: strip, then send. That is Art. 5(1)(c) as architecture. Prove the stripper did not upload with a Network audit.
Tools
Strip tags: Remove EXIF. Accept quality loss and a new raster: Image compressor. Change container: format converter. Pixel dimensions: resizer.
Worked example: field photo for a public report
Phone JPEG has GPS of a private address. Run remove EXIF. If you also need a smaller file, compress after, knowing you pay another generation. Or compress first — canvas re-encode often drops APP1 anyway (Canvas pipeline) — then verify tags are gone.
HEIC from iPhone: convert with HEIC to JPG locally, then verify. Do not email the HEIC “and strip later.” Later often never happens. Minimization is strip before leave.
Newsroom: originals stay in an archive you control; public derivatives are stripped. A metadata website that shows GPS on a map also stored the photo. Skip it. Network audit on the stripper.
Orientation: if the public JPEG is sideways, you stripped tag 274 without rotating. Fix in rotate image or a stripper that applies orientation. This is not GPS coming back; it is pixels.
Frequently asked questions
Does exporting from Canvas always remove GPS?
drawImage plus toBlob typically emits a new JPEG/WebP/PNG without APP1. PNG tEXt and XMP can still appear if you copy chunks. Verify with a local reader. The compressor path is documented in the Canvas article.
Why do stripped photos look rotated?
Viewers apply orientation tags. If you drop the tag without rotating pixels, the image appears wrong. Apply orientation first, then strip. Resize and compress should share that helper.
Is HEIC the same as JPEG EXIF?
HEIC is ISO BMFF. Metadata lives in boxes, not APP1. You need a HEIC-aware path. HEIC to JPG is a decode-and-encode, which usually drops boxes as a side effect.