TL;DR: Metadata is “data about data”: the who, when, where and how attached to a file or message, rather than its contents. Photos can carry GPS location and device details; documents can carry your name and edit history; calls and emails carry who you contacted and when. Patterns in metadata can reveal health, relationships and routines without anyone reading a word. Check and strip it before sharing files publicly.
Metadata, defined
NIST's glossary puts it simply: metadata is “data about data,” or “information describing the characteristics of data.” If a letter is the data, the envelope (sender, recipient, postmark, date) is the metadata.
Where metadata hides in everyday life
Photos
Phone photos store EXIF data: date and time, camera model, settings and often exact GPS coordinates. Some platforms strip it on upload, but messaging files, cloud links and original-quality shares can keep it. We cover photos in depth in can my photos reveal my location and do geotagged photos reveal your address.
Documents and PDFs
Word, Excel and PDF files often store the author's name, organisation, creation and edit dates, and sometimes comments or tracked changes. A CV or contract shared online can quietly carry more than you meant.
Emails
Email headers record sender, recipients, timestamps and the servers a message passed through. Some marketing emails also carry tracking pixels that report when and where you opened them.
Calls and messages
Phone records show who called whom, when and for how long. Messaging apps log similar details even when the content is encrypted.
Why metadata is so revealing
The Electronic Frontier Foundation made the point with simple examples in “Why Metadata Matters”: a call to an HIV testing service, then a doctor, then a health insurer within an hour; or a call to a suicide prevention line from the Golden Gate Bridge. Nobody needs to hear the calls. As the EFF put it, metadata “provides enough context to know some of the most intimate details of your lives.”
The same goes for location history and app activity. That's why services like Google keep such detailed timelines; see what Google knows about you.
How to check and remove metadata
- iPhone photos: swipe up on a photo to see its info. When sharing, tap Options and turn off Location.
- Android photos: open the photo's details to see location; remove it or turn off location for the camera app.
- Windows files: right-click, Properties, Details, then “Remove Properties and Personal Information.”
- Office documents: use File, Info, Check for Issues, Inspect Document before sending.
- Stop it at the source: turn off location for your camera app, and review which apps have location access.
Metadata and personal data
Because metadata can identify you, it usually counts as personal data under UK and EU law and is often linkable PII in the US. Combined with what's already leaked about you, it fills in the gaps for scammers and stalkers.
Want to know what's already out there? A free email exposure check shows which breaches your email appears in, and the full Scan My Shadow scan adds your phone number.
Frequently Asked Questions
What is metadata in simple terms?
Data about data: details like when, where, how and by whom a file or message was created, rather than its actual content.
Can photo metadata reveal my location?
Yes. Phone photos can store GPS coordinates in EXIF data. Turn off location when sharing, or disable location for your camera app.
Is metadata personal data?
Often, yes. If it can identify you, such as location, device IDs or contact records, it is treated as personal data under UK and EU GDPR.
How do I remove metadata from a file?
On Windows use Properties, Details, Remove Properties and Personal Information. In Office use Inspect Document. On iPhone, turn off Location in the share Options.
What is call metadata?
Records of who called whom, when and for how long, without the content of the call.
Sources
- NIST CSRC Glossary: Metadata
- EFF: Why Metadata Matters (June 2013)
- Apple: Manage location metadata in Photos