social-mediaprivacyfacebookinstagramtwitter

Does Social Sharing Remove EXIF? Test the Actual Download

Test a photo-sharing route with a harmless fixture, download the recipient copy and compare metadata without assuming server deletion.

by ExifCheck Team

Test a sharing route, not a platform name

“Does this app remove EXIF?” is too broad to answer reliably with a yes/no list. A feed image, message attachment, file/document send, cloud preview and original-download button are separate routes worth checking. Output can also depend on the client, settings and file format.

This is a reproducible procedure, not a report of platform tests. It makes no claim about the current behavior of Facebook, Instagram, X, WhatsApp or any other service. You will compare an original you control with the actual bytes available to a recipient.

1. Prepare a harmless fixture with known fields

Photograph a plain object without people, addresses, screens or reflections. Do not use a private photo simply to discover whether a service strips it. Start with the metadata-check lab if you want to practice reading fields.

Keep an untouched baseline and make a test copy. Open it in the EXIF viewer and record the fields it actually contains: GPS, capture time and offset, owner/artist, device serial, Software and any visible XMP/IPTC groups. Do not list an absent source field as a successful removal later.

If your test needs a recognizable marker, use the metadata editor to put a harmless label such as “SHARE-TEST-20261024” in a supported text field, then reopen the saved copy to verify it. Do not insert a real home coordinate, name or serial. A fixture without GPS cannot test GPS removal; mark that part as not tested rather than inventing a result.

2. Describe one route precisely

Record the date, app/browser version if available, operating system, input format, audience, upload control and quality/original setting. For example, “browser upload to a private test post, default quality” describes a route; “the app” does not.

Test these separately where available:

Route to investigateCopy to obtain
Post or storyImage downloadable by the intended audience
Direct-message photoImage saved by your consenting test recipient
File/document attachmentAttachment obtained with its download control
Cloud sharePreview download and original download, as separate files

These are test cases, not predictions. Use an account you control or a consenting recipient and comply with service rules. Use a public test only if you need to investigate public access and the fixture is safe to publish.

3. Retrieve the recipient’s copy

Upload the verified fixture through just one selected route. From the recipient’s permitted view, download the image using the control they would actually use. For public access, check the public or signed-out view when available; the uploader’s own export may expose a different file.

Save each available original, full-size image and preview separately, with labels describing how it was obtained. A screenshot tests a newly created screenshot, not the file the service delivers. A page thumbnail or a preview cache also cannot stand in for an original download.

Note the returned extension, detected format, dimensions and file size. A smaller file suggests transformation but does not prove which tags were removed. If no download is available, record that limitation; do not call the route metadata-free.

4. Compare actual returned fields

Open the baseline and each downloaded file in the same viewer. If the reader fails to parse a file, classify it as unreadable, not stripped. For a second local check with ExifTool installed, use:

exiftool -a -G1 -s "baseline.jpg" "recipient-copy.jpg"

This command reads fields without modifying the files. Group names help distinguish duplicate records; the ExifTool FAQ explains the options and why location checks should not be restricted to one EXIF group.

Use this blank record for each route; it is not a set of measured results:

ItemBaseline valueReturned valueInterpretation
GPS and location textFill from sourceFill from downloadRetained / not displayed / unreadable / not tested
Capture time and offsetFill from sourceFill from downloadCompare date and offset separately
Owner, artist and serialFill from sourceFill from downloadCheck each field and group
Software, description, markerFill from sourceFill from downloadNote retained, changed or newly added values
Format, dimensions, sizeFill from sourceFill from downloadDescribe the file, not a privacy guarantee

If a known source value no longer appears, say “not displayed in this downloaded copy by these readers.” If it remains, that route exposes it to that recipient. New Software or other tags are not proof of a complete editing history. Metadata values can be altered and are not authentication.

5. Act on the result without overclaiming

A stripped download does not show whether the service stored the original, extracted location into its database, retained backups or applied a different policy to another audience. A black-box file comparison cannot answer server-retention questions. Consult the service’s current privacy documentation and account controls separately.

For real sharing, use the metadata remover on a copy before upload, then inspect the downloaded output and share that verified file. Follow the hidden-personal-data checklist for visible content, filenames and captions too. Cleaning metadata does not make an image or an account anonymous.

Keep the test record, remove the test upload when finished, and retest after changing routes, clients, formats or relevant settings. Deleting the test post is housekeeping, not proof of server erasure. Limit your conclusion to the dated route and files you actually checked.

Related Posts

social-media · privacy · facebook