What EXIF Data Do Photos Still Carry?

What this study measured

The question was narrow. Of the JPEG photographs published on Wikimedia Commons, what share carries a camera serial number, what share carries a location coordinate, and how do those two shares differ between camera makes and between camera models? The sample is Commons itself, and it was drawn by the platform’s own random generator rather than chosen by us: 2984 files, the ones a visitor would land on by opening the library at random.

EXIF is the block of notes a camera writes into a photograph next to the picture. It is where a camera leaves its name, its settings and sometimes its serial number and the place the picture was taken, and it is present in 65.5% of the files measured here.

The XMP packet holds a similar note in a different format, and the maker’s own note is a private area each manufacturer fills in as it likes. This study reads all of them and keeps them apart.

• The sample: 2984 files, drawn at random from the Commons file library on 10 Sep 2026, kept only when the file is a JPEG.
• The reading: the first 131072 bytes of every file, plus every byte of every tenth file, so the cheap reading could be checked against the complete one.
• The exclusions: 16 files were left out because the fetch or the reading failed. The rule that removes them was fixed before the first file was fetched, and the count travels beside every share on this page.

A file counts as carrying a location only when its coordinate values are not all zero. That rule was fixed in advance, because a camera that never got a satellite fix often writes a coordinate block full of zeros, and a cleaning tool that removes the value while leaving the block produces the same shape. Of the files with a coordinate block at all, 1.5% hold nothing but zeros, and those are not counted as carrying a place.

What EXIF data is, and what it records

EXIF stands for Exchangeable Image File Format. It is written into the file at the moment of capture and travels with it: copy the photo, attach it to an email or upload it, and unless something strips it on the way, every field goes too. The block is invisible when you look at the picture, and anyone holding the original file can read it. A typical file can carry:

• Where: GPS latitude, longitude and altitude.
• When: the date and time, to the second.
• What took it: the camera or phone make and model, and the lens.
• How: ISO, aperture, shutter speed and focal length.
• What happened after: the editing software used, a name in the artist or copyright field if one was configured, and a small embedded preview image.

IPTC is a third format beside EXIF and XMP, which Google’s help page describes as holding copyright, the creator’s name and captions, so one tool can show a location while another shows a photographer’s name from the same file. On an iPhone, tapping a photo in the Photos app and swiping up shows the device, the date and time and where it was taken, according to Apple’s iPhone User Guide. In Google Photos for Android the same panel opens with an upward swipe; the three-dot icon that used to open it now opens a different menu, as Android Authority reported on 26 August 2025.

The prediction, and what the measurement did

The pre-registration was written down before the first file was fetched, and it made claims that could fail. It predicted that a location coordinate would appear in somewhere between 8% to 25% of the files. The measurement came back at 10.8%, with an interval of 9.7% to 11.9%, inside that range. That prediction held.

The second prediction was the interesting one, and it was written as something a script could check: the serial number is a property of the maker, not of the file. In the words of the pre-registration, more than half of the serial-bearing files would come from at most three makes, and at least one make with 20 or more files would sit at or below 1%. Both held. 90.9% of the serial-bearing files that name a make come from the three makes that carry the most of them, and 4 of the makes with 20 or more files sit at or below 1%.

The pre-registration also named what would prove it wrong, in these words: no make differs from the overall serial rate by more than five percentage points. The largest gap measured is 33.4 points, so the falsifier did not fire. Any statement about camera serial numbers in photographs therefore has to name the camera, because the average describes almost nobody.

Who writes the location, and who writes the serial

Split the sample by what made the file and the two fields swap places. Files from a phone maker carry a location coordinate in 52.7% of cases, and files from every other kind of device carry one in 10.4%, a gap of 42.3 points with an interval of 36.6 to 48.1 points. The serial number runs the other way: it is in 28.5% of the files from cameras and scanners, and in 1 of the phone-made files, which is a share of 0.3%.

The pattern is not that phones write less. A camera make is present in 100% of the phone-made files and in 100% of the rest, and an EXIF block in 100% and 100% of them, so the two groups carry the same container and differ only in what is inside it.

Interpretation

The reason behind that split is a guess added after the measurement, not a measurement. This study never asked a manufacturer why it writes what it writes, and no file can answer that question. What the files show is the split itself, and the split is the part a reader can rely on.

Where a serial number hides

A serial number is not in one place. On the whole files, this study’s own reading of the standard EXIF field and the XMP packet found one in 13.3% of files, and a tool that also opens the maker’s own note and the XMP packet found one in 26.7%, a difference of 13.3 points with an interval of 9.7 to 17.3 points. Both numbers are correct. They are answers to different questions, and the second is the question a reader means when asking what a photograph gives away.

The two readings are nested, and that is the sharper fact. Of the 80 files the wider reading finds a serial in, the narrower one misses 40. Going the other way it misses none: not one file holds a serial this study finds and the wider tool does not. So the narrower reading is not a different answer to the same question, it is a strict subset of the wider one. 13 of the whole files carry a serial in the manufacturer’s own internal field and in none of the standard ones at all.

The wider reading was adopted after the narrower one had already been taken, when a second method written independently reported finding more serials than this study had: the narrow pass had 22.3% of these files, against 26.7% now. That order matters and is stated rather than left out, because a reading widened after a result is known is how a study talks itself into a bigger number.

• Same files, not a second sample. The wider request was made on the same whole files, so it is a closer look at one sample rather than a new one, and both readings can be compared file by file.
• It moved toward the independent method, not away from it. The second method was written without seeing this one, and the wider reading agrees with it rather than with what this study had said before.

The narrow rows are still in the ledger, marked as superseded, so a reader who prefers them can bind these claims to those instead.

The same split appears on the whole frame, where the platform’s own metadata tool reports a serial in 11.5% of the files while reading them directly finds one in 13.4%, a difference of 2 points with an interval of 1.1 to 2.9 points. The platform’s field is not wrong; it is narrower than the file. Its documentation describes the field as the metadata for the file and says nothing about where a value comes from, so a reader of that field cannot tell whether a missing serial means the camera wrote none or the reader did not look.

The make does not settle it

Grouping by manufacturer shows how far the difference goes, and it also shows that a brand is not a promise. Canon files carry a serial in 45.4% and files under the name NIKON CORPORATION in 46.8%, while Sony files carry one in 1.2%. The clearest case in the table is Apple, whose 111 files carry a location in 72.1% of cases and a serial in none of them. The zero has a boundary too, and it is narrow: across every phone make taken together the serial rate stays at 0% to 0.9%.

The odd row is the one where a single manufacturer appears twice, and the model names in the published data explain it. Of the 331 files under NIKON CORPORATION, 329 come from models named NIKON D, NIKON Z or NIKON 1 and two from COOLPIX models, and 46.8% carry a serial. The 67 files under NIKON, with no second word, are 56 COOLPIX models and 11 under the older E-series and S1 names, and not one carries a serial number. Neither do the two COOLPIX files under NIKON CORPORATION. The zero is a boundary rather than a proof: a clean run of that size still permits a rate as high as 5.4 per cent. The serial follows the model line, not the make string and not the brand.

Interpretation

These are the models with twenty files or more, the threshold below which two values cannot be compared at all; every other model is in the dataset. Read the table as a count rather than as a rate: an interval narrow enough to set one model against another would need about a hundred files in every row, which a random draw of this size does not produce. The spread inside one brand is the part worth noticing, and the reason for it is not something this study measured, because the sample records the cameras enthusiasts chose to publish from rather than the cameras that were sold.

Does a phone library or a sharing link look different?

Commons is what can be sampled without an account, so on 25 and 26 October 2026 the same two fields were counted in two places it cannot reach, and Commons was drawn again. The phone library is one person’s library of 105 photos from one iPhone model, counted with exiftool with the owner’s approval for counts only, so it is one example beside the Commons sample and not a rate for phones. The fresh Commons draw was read two ways, from the file and from the platform’s own metadata field, and the two are kept on separate rows because they answer different questions.

The table gives the share of files carrying a location and a camera serial in each sample, measured on 10 September 2026 for the study’s draw and on 26 October 2026 for the rest. Every value is in dataset.csv.

The split by device holds: phone files carry the place and no serial, other devices carry the serial. The exact share moves more between draws than the file counts suggest, because uploads arrive in batches from one camera: four full draws on the same day put the serial share through the platform’s field between 10.5% and 14.4%, and for other devices between 22.3% and 28.6%, while no draw found a serial in a phone file. Read from the file, the first 250 files of the draw hold a serial in 13.2%, while the platform’s field reports one in 9.2% of those same files, the same direction as the gap the study measured. In the phone library the location is the common case and the serial is absent, which is what the Commons phone files predicted.

A platform can change the file on the way out. A test photo built from a NASA public-domain picture, carrying iPhone 15 Pro tags, a capture date, a time zone and a location written with exiftool, was uploaded to Google Photos on 25 October 2026 and downloaded three ways. It carries no serial, so this run shows which of the written tags survive, not what happens to a serial.

Each download of 25 October 2026 was read with exiftool, and the bytes and pixel sizes for every row are in dataset.csv.

The owner’s own download is the file that went up, location included, even after storage saver re-encoded it. A signed-out visitor to a shared link got the picture without its coordinates and with everything else that names the device and the moment. An Instagram or Facebook data export was not checked, because no account was available to this check.

Where this measurement is weak

• Commons is not the web. These are files that volunteers chose to publish in a library with an explicit license, so the sample describes enthusiasts and institutions rather than everybody who owns a camera. It is not a sample of photographs in general and this page does not claim to be one.
• The maker’s note is read only on the subsample. The share of 26.7% rests on the files read whole, not on the whole frame, because the note sits in different places for different manufacturers and only a complete reading can be trusted to find it.
• The group split is ours, not the data’s. A file is counted as phone-made because its maker is on a list of phone manufacturers written into the method. The per-make table lets any reader rebuild the grouping differently.
• A make is a string in a file. One manufacturer can write more than one of them, which is why the table above shows two NIKON rows, and samsung also appears in the data as SAMSUNG. Nothing here verifies that a make string is true.
• The reader can miss one. On the 299 whole files kept in the published data, this study’s reader and exiftool disagree on the standard serial field once: exiftool finds a serial in a DJI file that the reader recorded as having none.
• Presence, never content. The study never reads a serial value or a coordinate, so it cannot tell a real serial from a placeholder, and it cannot tell an original from a copy re-saved by software that carried the fields forward.

What would change the answer

• A different population would. One phone library already puts the location far above the Commons rate, and one sharing link already removes it. Many libraries and the exports of the big social platforms would need an account on each, which this check did not have.
• A larger sample would not. More files would narrow the interval around 13.4% and around the family difference of 28.2 points. It would not move the split itself, which is a property of what manufacturers write.
• Manufacturers changing their firmware would. The serial is a decision made in software, and a camera maker could stop writing one in the next generation; none of the 58 COOLPIX files in the sample carries one.

What Viallo does with the file you upload

Viallo stores the file as it arrived and returns it through the download button, so the stored file is the same kind of file this study found a serial in 28.5% of. That is deliberate: keeping a photograph unaltered is what the product is for.

To check your own photos, the free EXIF data viewer shows what each one carries, without uploading it.

• The smaller copies are the cleaner ones: the display copy and the thumbnail are re-encoded when they are made, and the encoder writes a fresh file containing the picture and nothing else. The fields this study measures do not survive that step, so a link that is only looked at gives away far less than the file behind it. That is mechanical rather than a policy, and it holds for every photo on the service.
• What that means for you: a photograph you would rather not hand over with a serial number attached has to be cleaned on your device first, because a service that keeps your file faithfully keeps that too.

Sources

• ExifTool, EXIF tag names. The tag table this study used to separate the two serial fields lists 0xA431 as SerialNumber, “called BodySerialNumber by the EXIF spec”, and 0xA435 as LensSerialNumber. exiftool.org/TagNames/EXIF.html
• MediaWiki, API help for imageinfo. Documents the metadata property this study compared against, and says nothing about which part of a file its value comes from: metadata for the version of the file. If the file has been revision deleted, a filehidden property will be returned. commons.wikimedia.org/w/api.php

Both pages were read on 10 Sep 2026, the day the files were fetched, and again on 26 October 2026, when both still said the same. The platform documents what its metadata field is for and not where its value came from, which is why the difference between the two readings had to be measured rather than looked up.

The data behind this article

Every number from the study comes from the same table, and the files are listed below so anyone can check the work or reuse it. The numbers from 26 October 2026 are in the check’s own files, described in the next section.

• The measurements. One row per fetched file and one column per field read. It carries no image content, no coordinate values and no serial numbers, only whether a field was there. DATASET.csv
• The run and the instrument. Where the sample came from, how the reading program was checked, and the counts behind every group. DATASET.json
• The prediction, written first. The question, the predicted shares and the counting rules, all fixed before the first file was fetched, with every later change recorded beside it. PREREGISTRATION.md
• License. Released into the public domain under CC0, so it can be copied, changed and reused for any purpose without asking. LICENSE.txt
• The program that read the files. It asked for the bytes, read the metadata out of them, and wrote one row per request. analyze.py
• The dataset page. The published data, its license and the citation in one place, for anyone who wants to cite it rather than read it. /studies/what-exif-data-photos-still-carry

How was this checked?

On 26 October 2026 a Python script drew a fresh random sample of Commons files through the MediaWiki API, read the first 250 of them byte by byte, and recomputed every number this page takes from the study’s published DATASET.csv; the study’s claims whose data was never published were removed. The Google Photos run of 25 October 2026 and the phone library count were read with exiftool 13.55, and the test photo is rebuilt with macOS sips and exiftool from the NASA original. The results are in dataset.csv, and check.py repeats the draw, the recomputation and the rebuild, and checks that every quoted source sentence is still on its page.

Frequently Asked Questions