Yes, photo metadata is often personal data under the GDPR. Article 4(1) of Regulation (EU) 2016/679 covers any information relating to an identified or identifiable person, and it names location data and identification numbers as examples, which is exactly what EXIF fields like GPSLatitude and BodySerialNumber contain. If your organization collects, stores or publishes photos, the GDPR's principles apply to their metadata as much as to the pixels.
This article explains the text of the GDPR and well-known case law in general terms. It is not legal advice. For decisions about your own processing, ask your data protection officer or a qualified lawyer.
What the GDPR says personal data is
Article 4(1) defines personal data as "any information relating to an identified or identifiable natural person". It continues: a person is identifiable if they "can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier" or to factors specific to their identity. You can read the full text on EUR-Lex.
Two points in that definition matter for photos:
- Indirect identification counts. A field does not need to contain a name. Data that can be combined with other information to single someone out is enough.
- Identifiability is judged realistically. Recital 26 says you account for "all the means reasonably likely to be used" to identify someone, considering cost, time and available technology. Truly anonymous data falls outside the GDPR, but pseudonymous data, which can be re-linked with extra information, stays inside it.
The Court of Justice of the EU has applied this test to technical identifiers. In Breyer (C-582/14, 2016) it held that a dynamic IP address can be personal data for a website operator that has legal means to obtain the extra information needed to identify the user. In Scania (C-319/22, 2023) it held that a vehicle identification number becomes personal data for anyone who can reasonably link it to the vehicle's owner. A camera serial number in an image file works the same way.
Which photo metadata fields can be personal data
Not every tag identifies anyone. A white balance setting does not. But a typical phone or camera photo contains several fields that do, alone or combined.
| Field (EXIF/XMP name) | Why it can be personal data |
|---|---|
GPSLatitude, GPSLongitude, GPSAltitude | Location data is named in Article 4(1). Coordinates of a home, workplace or school point to specific people. |
DateTimeOriginal, GPSTimeStamp, OffsetTime | Combined with location, timestamps describe where a person was and when, which reveals movements and routines. |
BodySerialNumber, LensSerialNumber, maker notes | A unique device identifier. It links every photo from the same camera, and it becomes personal data for anyone who can tie the camera to its owner, as the court reasoned for vehicle numbers in Scania. |
Artist, Copyright, CameraOwnerName, XMP dc:creator | Names of the photographer or device owner. Direct identification. |
XMP face regions and person names (for example mwg-rs:Regions) | Names attached to faces by photo management software. Direct identification of the people in the picture. |
| Embedded EXIF thumbnail | A small preview image that may show the uncropped or unedited original, including people or details removed from the main image. |
Make, Model, Software | Weak on their own, but they narrow down a person when combined with other data. |
For a complete reference of what a photo stores, see what metadata a photo contains. Serial numbers deserve particular attention because they link photos together. Our guide to camera serial numbers in photos shows how to find them.
When metadata can reveal sensitive information
Article 9 gives extra protection to special categories of data such as health, religion, political opinions and sexual orientation. A photo itself is not automatically in that category: Recital 51 says photographs are covered by the definition of biometric data only when processed through specific technical means that allow unique identification. GPS coordinates are a different matter. Coordinates placing a person at a clinic, a place of worship or a political meeting can reveal sensitive information by inference. In OT (C-184/20, 2022), the Court of Justice held that data which can indirectly reveal sensitive information falls under Article 9. Precise location metadata deserves more caution than it usually gets.
Data minimisation: the principle that makes stripping the default
Article 5(1)(c) requires personal data to be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". This is the principle of data minimisation, and it applies directly to photo metadata.
Ask what the photo is for. A staff portrait on your website needs pixels, not the GPS coordinates of the photographer's home. A product review photo needs to show the product, not the reviewer's camera serial number. If a metadata field is not necessary for your purpose, keeping and publishing it is hard to justify.
Several other provisions point the same way:
- Article 5(1)(b), purpose limitation. Data collected for one purpose should not be reused for an incompatible one. Mining uploaded photos for location data when users only meant to share an image is a new purpose.
- Article 5(1)(e), storage limitation. Do not keep identifiable data longer than necessary. Original files with full metadata sitting in a backup indefinitely are a common gap.
- Article 25, data protection by design and by default. Article 25(2) requires that by default only the personal data necessary for each specific purpose is processed, and that personal data is not made accessible to an indefinite number of people without the individual's intervention. A website that publishes user photos with GPS data intact makes location data accessible to everyone.
- Article 32, security of processing. Removing data you do not need is one of the most effective ways to reduce the impact of a breach.
Infringing the basic principles of Article 5 falls under the higher tier of administrative fines in Article 83(5): up to 20 million euros or, for an undertaking, up to 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. Supervisory authorities set actual fines case by case.
User-generated uploads: where most organizations get it wrong
If your platform accepts photos from users, such as a marketplace, a forum, a review site, a recruitment portal or a claims form, you are typically the controller for the personal data in those uploads, metadata included. Users rarely know their photos carry GPS coordinates, so they are not choosing to share them.
A defensible approach usually looks like this:
- Decide whether you need any metadata. Some purposes genuinely do, for example checking the capture date of a photo submitted as evidence. If so, identify the lawful basis under Article 6 and tell users in your privacy notice, as Article 13 requires.
- Strip at ingestion when you do not need it. Remove metadata as soon as a file arrives, before it is stored, indexed or copied to a CDN.
- Never publish originals. If you must keep originals for a specific purpose, store them separately with restricted access, and serve only cleaned copies.
- Check your image pipeline. Many CMSs and image libraries keep the original upload or copy metadata into resized versions. Our guide on stripping metadata before uploading images to your website covers common behaviors.
- Plan for data subject rights. Metadata you keep is in scope for access requests under Article 15 and erasure requests under Article 17.
When the GDPR does not apply
Article 2(2)(c) excludes processing "by a natural person in the course of a purely personal or household activity". Sending holiday photos to your family is outside the GDPR. The exemption is narrow, though. The Court of Justice held in Lindqvist (C-101/01, 2003) that publishing personal data on an internet page accessible to an indefinite number of people was not covered by the equivalent exemption in the earlier directive, and in Ryneš (C-212/13, 2014) that a home camera filming a public street was not purely domestic either.
Article 85 also requires member states to reconcile data protection with freedom of expression, including journalism, academic, artistic and literary expression. National exemptions vary. If you work in a newsroom, see our guide on photo metadata and source protection for the practical side.
Using third-party tools to clean photos
Removing metadata is itself processing under Article 4(2), which covers any operation on personal data, including erasure. When an organization sends images containing personal data to an outside service, that service usually acts as a processor, and Article 28 sets out what the contract with a processor must cover.
That applies to any online tool, including ours. Our tool processes images on our server, deletes them automatically and permanently 10 minutes after processing, and keeps no copies, backups or image logs. For occasional use by individuals, that is often all you need to know. For an organization processing sensitive images at scale, check your internal policy first, or use an offline tool such as ExifTool so the files never leave your systems. Our ExifTool cheat sheet has the commands.
A practical checklist for organizations
- List where photos enter your organization: uploads, email, staff phones, agencies.
- For each entry point, write down whether you need any metadata, and why.
- Strip metadata you do not need at the point of entry, not later.
- Publish only cleaned images. To clean a few files quickly, remove metadata online with our free tool.
- Restrict access to any originals you keep, and set a retention period.
- Mention metadata handling in your privacy notice if you keep any.
- Remember what stripping cannot do: faces, street signs and documents visible in the image remain personal data.