C CreatorPrivacyKit

What a photo still carries after you hit export

Creators usually mean three different jobs when they say “remove metadata from a photo”: strip GPS, strip camera EXIF, or strip provenance credentials. They live in different places, and social apps do not treat them the same.

Reviewed 17 September 2026

The layers

EXIF is the camera envelope: make, model, lens, timestamp, sometimes a serial, and — on phones — GPS. It sits in JPEG APP1, PNG eXIf, WebP EXIF, or QuickTime udta.

GPS / location is usually an EXIF GPS IFD (decimal degrees) and sometimes duplicated in XMP. Removing “location” without touching other EXIF is a different product promise than a full strip; this kit’s sharing copy re-encodes the image through Canvas, which drops the supported EXIF block.

XMP is the sidecar-in-the-file: Lightroom history, contact fields, rights strings, nested provenance pointers.

IPTC caption, keywords and contact records often travel as IPTC-IIM and/or XMP. A Canvas re-encode drops them with the rest of the header metadata on JPG/PNG/WEBP.

C2PA / Content Credentials are signed provenance claims (JUMBF in JPEG, caBX in PNG, UUID boxes in MP4). They are not “EXIF with a new name”. A platform may display a label from C2PA, from its own classifier, or from something you cannot see in the file.

Format differences

What platforms often rewrite

Messaging apps and social uploads frequently recompress, strip, or replace headers. That can look like “the platform removed GPS” when it actually made a new file. It can also keep a credential you thought was gone, or add an AI label from a signal that is not in EXIF.

Inspect the file you still have, then decide. Do not infer a private ranking rule from a header.

A practical workflow

Limits

This does not remove invisible pixel watermarks. It does not guarantee a platform will drop an “AI info” label. It does not process HEIC originals.

Related: How to check image metadata, Remove location data before sharing, methodology.