Your Photos Can Carry Your Location. The Army Learned the Hard Way

In 2007, a new fleet of US Army attack helicopters arrived at a base in Iraq, and some soldiers took pictures of them on the flightline. The photos went online. According to the Army, insurgents used the location data inside them to work out exactly where the helicopters stood, then mortared the compound and destroyed four AH-64 Apaches.

Nobody had written an address on those pictures. The cameras had saved it for them. “For every picture you take with that phone, it will automatically embed the latitude and longitude within the photograph,” Steve Warren, an Army intelligence officer at Fort Benning, said in 2012, as the Army stepped up its warnings to soldiers.

Phones still do this today, but only when their camera is allowed to use your location. This guide covers when a photo carries location data, how to check your own, who can see it, and when switching it off makes sense.

Apple describes the mechanism plainly in its Personal Safety guide. When Location Services is on for the Camera, the iPhone uses “cellular, Wi-Fi, GPS networks, and Bluetooth” to fix the spot, and the coordinates “are embedded into each photo and video”. The point is convenience: it is what lets you search your library by place.

Those coordinates are precise. GPS-enabled smartphones are typically accurate to within 4.9 metres (16 ft) under open sky, according to the US government’s GPS.gov, though accuracy worsens near buildings, bridges and trees. That is close enough to pick out one house on a street. The coordinates sit in the photo’s hidden EXIF data, so they travel with the file until something strips them.

Google Photos adds a second kind. Its help centre says a photo can get location data in two ways: the camera app saves it, or Google Photos estimates one from landmarks and your other photos. The estimate stays inside Google Photos. Google says estimated locations won’t be shared, even when you choose to share location details.

On an iPhone, the setting comes from a question you answered once. Apple’s guide says the first time an app wants location data, you receive a request with an explanation, and that includes the Camera. Turning off location on iPhone photos walks through every switch on iOS 26 and iOS 27.

The Android names come from Google’s help centre, which lists more brands. Names change with software updates, so look for any camera setting that mentions location, GPS or geotags. Whatever the phone, the switch only affects photos taken from then on. Photos already in your gallery keep their coordinates.

1. Step 1On iPhoneOpen the photo in Photos, then swipe up or tap the info button. A map below the details means it carries coordinates. Viewing EXIF data on iPhone explains the rest of that panel.
2. Step 2See every geotagged photo at onceThe iPhone’s Photos app can show your library on a map. On iOS 27, tap Library, then the Sort and Filter button, then Show Map. Apple says only photos and videos with embedded GPS data appear there, so the map is a list of everything that carries a location.
3. Step 3In Google PhotosOpen the photo and tap More to see its details, including any location. Google can also estimate a location for a photo that has none. How Google Photos handles location explains why a location written by the camera cannot be removed there.
4. Step 4On any fileFor a copy you are about to send, reading the GPS coordinates works on a computer too, and shows exactly what the file would give away.

A screenshot is a new image and never inherits the coordinates of the photo on screen, as the screenshot guide explains. Social feeds usually strip location on upload, for reasons set out in why photos lose location when shared.

No location data is not the same as no location. A street sign, a shop front or the view from a window can place a photo on its own, which is the subject of what one selfie can reveal.

Gerald Friedland and Robin Sommer of the International Computer Science Institute in Berkeley called it cybercasing: using geotagged information posted online to plan attacks in the real world. They collected 68,729 images linked from four days of “For Sale” listings on Craigslist in the San Francisco Bay Area. About 48% still carried metadata, and 914, roughly 1.3%, carried GPS coordinates. iPhones were the most common cameras among them.

The listings included cars parked in private spaces and valuables such as diamonds, “obviously photographed at home”, sometimes with notes on when the seller could be called. To test the precision, the researchers photographed a bike in front of a garage with an iPhone 3G. Entered into Google Street View, the coordinates placed the photo within about a metre.

A second test used a 204-line Python script. It searched YouTube for videos posted near Berkeley, then checked the same users’ other videos for any filmed more than 1,000 miles away and uploaded that week. It turned up a man on holiday in the Caribbean whose other videos, filmed at home with his children, suggested he lived near Albany, California. Gathering the data took about 15 minutes.

That is how John McAfee’s whereabouts leaked in December 2012. Wanted for questioning in Belize, he was travelling with journalists from Vice magazine, which posted a photo of him online. The file still carried its metadata. As the security writer Graham Cluley noted, it showed the camera was an iPhone 4S, and its GPS coordinates placed McAfee in Guatemala, across the border.

McAfee first claimed the data was faked. Then he wrote on his blog, NPR reported: “Yesterday was chaotic due to the accidental release of my exact co-ordinates by an unseasoned technician at Vice headquarters.” He was arrested in Guatemala days later for entering the country illegally.

Today the location is most likely to survive on routes that move a file rather than publish it. Which apps strip EXIF data sets out which routes keep the location and which drop it. Google Photos says new albums, links and conversations do not include location details by default, but partner sharing does. A photo you download from it and email to someone carries the location your phone saved.

Phones also offer a switch at the moment you share. On iPhone it sits under Options in the Photos share sheet, with a catch on iOS 27 that the iPhone guide explains. Samsung’s Gallery has a Remove location data box when you share, on One UI 3.0 and later. Both leave the photo in your gallery untouched.

Location is not only a risk. Google notes that photos without it may not show in your map view, in searches by place or in Memories built from trips, and the iPhone’s map works the same way. Years of trips sorted by place are hard to rebuild if the coordinates were never saved.

The case for switching it off comes down to who ends up with the originals. The Army told service members to disable geotagging on their phones and to limit check-ins. Apple’s Personal Safety guide gives two steps for anyone concerned about who can see where their photos were taken: remove the location from existing photos, and set the Camera to Never.

• Turn it off if someone may be trying to find you, if you work somewhere whose location is sensitive, or if you often send original files to people you do not know well.
• Keep it and strip it when sharing if you want your library searchable by place and mostly share through apps that remove it anyway. The metadata privacy guide covers that habit.
• Either way, check the scene. A photo with no coordinates can still show a street name.

On geospys.com, photo analysis comes with GeoSpy Premium: 7.99 US dollars a week or 29.99 US dollars a year, or ₺389 and ₺1,460 in Türkiye, with unlimited analyses under fair use. It renews until you cancel, which you can do at any time, and the yearly plan opens straight at checkout. It returns a city and country, never an address, and uploaded photos are not stored.