What EXIF Data Do Photos Still Carry?

What this study measured

The question was narrow. Of the JPEG photographs published on Wikimedia Commons, what share carries a camera serial number, what share carries a location coordinate, and how do those two shares differ between camera makes and between camera models? The sample is Commons itself, and it was drawn by the platform’s own random generator rather than chosen by us: 2984 files, the ones a visitor would land on by opening the library at random.

EXIF is the block of notes a camera writes into a photograph next to the picture. It is where a camera leaves its name, its settings and sometimes its serial number and the place the picture was taken, and it is present in 65.5% of the files measured here.

The XMP packet holds a similar note in a different format, and the maker’s own note is a private area each manufacturer fills in as it likes. This study reads all of them and keeps them apart.

• The sample: 2984 files, drawn at random from the Commons file library on 10 Sep 2026, kept only when the file is a JPEG.
• The reading: the first 131072 bytes of every file, plus every byte of every tenth file, so the cheap reading could be checked against the complete one.
• The exclusions: 16 files were left out because the fetch or the reading failed. The rule that removes them was fixed before the first file was fetched, and the count travels beside every share on this page.

A file counts as carrying a location only when its coordinate values are not all zero. That rule was fixed in advance, because a camera that never got a satellite fix often writes a coordinate block full of zeros, and a cleaning tool that removes the value while leaving the block produces the same shape. Of the files with a coordinate block at all, 1.5% hold nothing but zeros, and those are not counted as carrying a place.

The prediction, and what the measurement did

The pre-registration was written down before the first file was fetched, and it made claims that could fail. It predicted that a location coordinate would appear in somewhere between 8% to 25% of the files. The measurement came back at 10.8%, with an interval of 9.7% to 11.9%, inside that range. That prediction held.

The second prediction was the interesting one, and it was written as something a script could check: the serial number is a property of the maker, not of the file. In the words of the pre-registration, more than half of the serial-bearing files would come from a handful of makes, and at least one make with 20 or more files would sit at or below 1%. Both held. 90.9% of the files carrying a serial come from the makes that carry the most of them, and 4 of the makes with 20 or more files sit at or below 1%.

The pre-registration also named what would prove it wrong, in these words: no make differs from the overall serial rate by more than five percentage points. The largest gap measured is 33.4 points, so the falsifier did not fire. Any statement about camera serial numbers in photographs therefore has to name the camera, because the average describes almost nobody.

Who writes the location, and who writes the serial

Split the sample by what made the file and the two fields swap places. Files from a phone maker carry a location coordinate in 52.7% of cases, and files from every other kind of device carry one in 10.4%, a gap of 42.3 points with an interval of 36.6 to 48.1 points. The serial number runs the other way: it is in 28.5% of the files from cameras and scanners, and in 1 of the phone-made files, which is a share of 0.3%.

The pattern is not that phones write less. A camera make is present in 100% of the phone-made files and in 100% of the rest, and an EXIF block in 100% and 100% of them, so the two groups carry the same container and differ only in what is inside it.

Most of the location on the library is not in the file at all. A coordinate added to the file page by a person or a program is present in 23.4% of the drawn files, and one written by the camera in 10.8%, which is 12.7 points more, with an interval of 11.2 to 14.1 points. A page coordinate is metadata about the library entry rather than about the photograph, so it places the upload rather than the camera, and it stays behind when the file is downloaded. The two are worth keeping apart: the file's own coordinate is what leaves with the picture.

Interpretation

The reason behind that split is a guess added after the measurement, not a measurement. This study never asked a manufacturer why it writes what it writes, and no file can answer that question. What the files show is the split itself, and the split is the part a reader can rely on.

Where a serial number hides

A serial number is not in one place. On the whole files, this study’s own reading of the standard fields found one in 13.3% of files, and a tool that also opens the maker’s own note and the XMP packet found one in 26.7%, a difference of 13.3 points with an interval of 9.7 to 17.3 points. Both numbers are correct. They are answers to different questions, and the second is the question a reader means when asking what a photograph gives away.

The two readings are nested, and that is the sharper fact. Of the 80 files the wider reading finds a serial in, the narrower one misses 40. Going the other way it misses none: not one file holds a serial this study finds and the wider tool does not. So the narrower reading is not a different answer to the same question, it is a strict subset of the wider one. 13 of the whole files carry a serial in the manufacturer’s own internal field and in none of the standard ones at all.

The wider reading was adopted after the narrower one had already been taken, when a second method written independently reported finding more serials than this study had: the narrow pass had 22.3% of these files, against 26.7% now. That order matters and is stated rather than left out, because a reading widened after a result is known is how a study talks itself into a bigger number.

• Same files, not a second sample. The wider request was made on the same whole files, so it is a closer look at one sample rather than a new one, and both readings can be compared file by file.
• It moved toward the independent method, not away from it. The second method was written without seeing this one, and the wider reading agrees with it rather than with what this study had said before.

The narrow rows are still in the ledger, marked as superseded, so a reader who prefers them can bind these claims to those instead.

The same split appears on the whole frame, where the platform’s own metadata tool reports a serial in 11.5% of the files while reading them directly finds one in 13.4%, a difference of 2 points with an interval of 1.1 to 2.9 points. The platform’s field is not wrong; it is narrower than the file. Its documentation describes the field as the metadata for the file and says nothing about where a value comes from, so a reader of that field cannot tell whether a missing serial means the camera wrote none or the reader did not look.

The make does not settle it

Grouping by manufacturer shows how far the difference goes, and it also shows that a brand is not a promise. Canon files carry a serial in 45.4% and files under the name NIKON CORPORATION in 46.8%, while Sony files carry one in 1.2%. The clearest case in the table is Apple, whose 111 files carry a location in 72.1% of cases and a serial in none of them. The zero has a boundary too, and it is narrow: across every phone make taken together the serial rate stays at 0% to 0.9%.

The odd row is the one where a single manufacturer appears twice. NIKON CORPORATION is the name Nikon’s interchangeable-lens cameras write, and 46.8% of those files carry a serial. NIKON, with no second word, is what its compact cameras write, and not one of those 67 files carries a serial number. The zero is a boundary rather than a proof: a clean run of that size still permits a rate as high as 5.4 per cent. Every file in that second group came from a Coolpix compact. The serial is a property of the model line, not even of the brand.

Interpretation

These are the models with twenty files or more, the threshold below which two values cannot be compared at all; every other model is in the dataset. Read the table as a count rather than as a rate: an interval narrow enough to set one model against another would need about a hundred files in every row, which a random draw of this size does not produce. The spread inside one brand is the part worth noticing, and the reason for it is not something this study measured, because the sample records the cameras enthusiasts chose to publish from rather than the cameras that were sold.

How the measuring program was checked

A number is only worth what its instrument is worth, so the instrument was tested before it was used. It is scored against 15 test files built for the purpose, whose contents were written down in advance, and it answers 165 checks on them without a failure. Each new check was then falsified on purpose: the reading was broken in the way the check exists to catch, and the suite had to fail before the check was trusted.

Two further checks ran against real files. A second reader was pointed at the same random frame, and over 150 files taken from the library the two readers agreed on every field compared, disagreeing on 0 of them, and a run of that size still permits a disagreement rate as high as 2.4 per cent. That is what makes a disagreement about the sample a fact about the sample rather than about the software.

The cheaper reading was checked against the complete one on 300 files read whole. Reading only the first 131072 bytes missed none of the serial numbers that the same reader finds in the whole file. That is a statement about where the reading stops, and its boundary is wide: a clean run of this many files still permits a miss rate as high as 1.2 per cent. It is not a statement about what the reading looks at. Both readings walk the standard fields, and neither opens the maker’s own note, which is where the 40 missed serials above actually sit.

Where this measurement is weak

• Commons is not the web. These are files that volunteers chose to publish in a library with an explicit licence, so the sample describes enthusiasts and institutions rather than everybody who owns a camera. It is not a sample of photographs in general and this page does not claim to be one.
• The maker’s note is read only on the subsample. The share of 26.7% rests on the files read whole, not on the whole frame, because the note sits in different places for different manufacturers and only a complete reading can be trusted to find it.
• The group split is ours, not the data’s. A file is counted as phone-made because its maker is on a list of phone manufacturers written into the method. The per-make table lets any reader rebuild the grouping differently.
• A make is a string in a file. One manufacturer can write more than one of them, which is why the table above shows two NIKON rows and two for samsung. Nothing here verifies that a make string is true.
• Presence, never content. The study never reads a serial value or a coordinate, so it cannot tell a real serial from a placeholder, and it cannot tell an original from a copy re-saved by software that carried the fields forward.

What would change the answer

• A different population would. Ordinary phone libraries and social platforms are the interesting comparison, and this method cannot reach them without an account on each. Commons is what a study can sample anonymously today.
• A larger sample would not. More files would narrow the interval around 13.4% and around the family difference of 28.2 points. It would not move the split itself, which is a property of what manufacturers write.
• Manufacturers changing their firmware would. The serial is a decision made in software, and a camera maker could stop writing one in the next generation exactly as Nikon’s compact line appears never to have written one.

What Viallo does with the file you upload

Viallo stores the file as it arrived and returns it through the download button, so the stored file is the same kind of file this study found a serial in 28.5% of. That is deliberate: keeping a photograph unaltered is what the product is for.

• The smaller copies are the cleaner ones: the display copy and the thumbnail are re-encoded when they are made, and the encoder writes a fresh file containing the picture and nothing else. The fields this study measures do not survive that step, so a link that is only looked at gives away far less than the file behind it. That is mechanical rather than a policy, and it holds for every photo on the service.
• What that means for you: a photograph you would rather not hand over with a serial number attached has to be cleaned on your device first, because a service that keeps your file faithfully keeps that too.

Sources

• ExifTool, EXIF tag names. The tag table this study used to separate the two serial fields: EXIF 0xA431 is the body serial number and 0xA435 is the lens serial number. exiftool.org/TagNames/EXIF.html
• MediaWiki, API help for imageinfo. Documents the metadata property this study compared against, and says nothing about which part of a file its value comes from: metadata for the version of the file. If the file has been revision deleted, a filehidden property will be returned. commons.wikimedia.org/w/api.php

Both pages were read and archived on 10 Sep 2026, the day the files were fetched. The platform documents what its metadata field is for and not where its value came from, which is why the difference between the two readings had to be measured rather than looked up.

The data behind this article

Every number on this page comes from the same table, and the files are listed below so anyone can check the work or reuse it.

• The measurements. One row per fetched file and one column per field read. It carries no image content, no coordinate values and no serial numbers, only whether a field was there. DATASET.csv
• The run and the instrument. Where the sample came from, how the reading program was checked, and the counts behind every group. DATASET.json
• The prediction, written first. The question, the predicted shares and the counting rules, all fixed before the first file was fetched, with every later change recorded beside it. PREREGISTRATION.md
• Licence. Released into the public domain under CC0, so it can be copied, changed and reused for any purpose without asking. LICENSE.txt
• The program that read the files. It asked for the bytes, read the metadata out of them, and wrote one row per request. analyze.py
• The dataset page. The published data, its licence and the citation in one place, for anyone who wants to cite it rather than read it. /studies/what-exif-data-photos-still-carry

Frequently Asked Questions