What EXIF metadata is in a website image
EXIF (Exchangeable Image File Format) is a metadata block that cameras and phones embed in JPEGs and some TIFFs. It stores technical settings (aperture, ISO, device model) and often sensitive fields: exact capture time, orientation, sometimes GPS coordinates or the photographer’s name.
On a company site those tags travel with every photo you upload to the CMS, blog, or team page. Visitors do not see them on screen, but anyone can read them with free tools. Stripping EXIF does not replace weight optimization or modern formats, but it closes a privacy and compliance gap many marketing teams miss.
Why it matters on company websites
Corporate photos show offices, customers, events, or remote teams. Keeping full EXIF means:
- A home-office headshot may expose GPS coordinates of someone’s residence.
- Timestamps and device IDs help unwanted correlation if files are scraped or leaked.
- Regulated sectors (health, finance, public sector) may conflict with internal policy or GDPR.
- Extra bytes on every download — small EXIF chunks add up on mobile networks.
Cleaning metadata is a low-cost editorial step, aligned with HTTP security and brand trust.
Which EXIF fields to worry about
Not every tag is risky. Teams usually audit:
- GPSLatitude / GPSLongitude — where the photo was taken.
- DateTimeOriginal — exact capture moment.
- Make / Model — device brand and model.
- Artist, Copyright, UserComment — photographer names or internal notes.
- Software — reveals retouching tools or internal workflows.
Exposure data is rarely a privacy issue, but stripping everything keeps the pipeline simple and files lighter.
How to remove EXIF without hurting quality
Sanitizing should not aggressively recompress pixels. Recommended flow:
- Export from your editor (Lightroom, Capture One, Photopea) with «strip metadata» or «save for web» without EXIF.
- Batch:
exiftool -all= -overwrite_original_in_place photo.jpgor the same step in CI. - When converting to WebP/AVIF, configure encoders not to copy metadata (many CLIs expose
-strip). - Verify with exiftool or online viewers before CMS upload.
Then compress and resize; the ideal order is crop → strip EXIF → compress → upload.
Automate in CMS, CDN, and deploy pipelines
If several people publish images, do not rely on memory:
- CMS hook that runs every upload through ImageMagick, Sharp, imgproxy, or similar.
- Static build rules that sanitize assets under
/public/img. - CDN «automatic metadata stripping» when available — confirm the origin does not reattach tags.
Document the flow next to your social preview policy: public thumbnails and served files should be equally clean.
Common mistakes
- Trusting CMS «save for web» without checking whether the plugin keeps EXIF.
- Replacing a file at the same URL after cleaning metadata without purging CDN or browser cache.
- Stock photos with GPS — some libraries ship location metadata from the shoot.
- Forgetting PDFs whose embedded thumbnails still carry EXIF.
- Publishing RAW or TIFF downloads with full metadata for press kits.
Quick checklist
- Does every new photo go through a documented strip-metadata step?
- Have you spot-checked GPS and comments per batch?
- Are WebP/AVIF encoders configured not to copy EXIF?
- Does the team know the policy for customer or event photography?
- Do blog images use descriptive alt text without leaking personal data in copy?
Conclusion
EXIF metadata is invisible to most visitors but trivial to extract. Removing it before publish protects people, trims weight, and signals professionalism. If you want your production image pipeline audited for privacy and performance, aatsoft can integrate sanitization, optimization, and deployment in one workflow.
