Photo metadata when you post photos of your kids

Why this isn't just another "before you post" page

This site has dozens of guides about stripping metadata before a specific post — before Instagram, before a dating profile, before a marketplace listing. Every one of them is built around the same shape: a single photo, a single audience, a single moment of exposure that ends once the header is empty and the file is sent. A parent posting photos of a child does not fit that shape, because there is always a next photo. A birthday, a first day of school, a sports game, a holiday — the posting continues for years, usually on the same one or two accounts, usually to a similar audience. The unit of risk is not the file. It's the account history.

That matters for metadata specifically because GPS and timestamp data behave differently in aggregate than they do alone. A single stripped photo gives away nothing explicit. A sequence of photos — even ones where you remembered to strip the header every time — can still show the same backyard, the same bus stop, the same classroom door, photographed on a recognizable weekly cadence, because that information was never in the metadata to begin with. It was in the picture, and in the fact that you posted it on a Tuesday and then again three Tuesdays later.

The pattern that builds across years, not one file

Child-privacy researchers describe this as one of sharenting's defining risks: the accumulation of ordinary, individually low-risk posts into a detailed, queryable record of a child's school, routine, friends, physical appearance over time, and home — built entirely by a parent acting in good faith, one normal post at a time. A 2020 Dutch court case is a useful, concrete illustration of how seriously this is now taken outside the United States: a grandmother posted photos of her grandchild without the parent's consent, and when the parent objected, the court found that because the posts could reach third parties, they did not qualify for the GDPR's "personal or household activity" exemption — the grandmother's sharing was ruled unlawful under EU data protection rules, grandparent or not. That case was about consent and data protection law generally, not about EXIF headers specifically, but it points at the same underlying shift: once a child's images are posted repeatedly to an audience beyond the immediate household, the standard of care most people apply to "just a cute photo" stops matching the actual exposure.

Metadata removal is the easy, mechanical part of lowering that exposure, and it is still worth doing on every single photo — a geotagged photo is a free, exact coordinate handed to anyone who downloads the file, and there is no reason to ever leave that in. But it only ever addresses one file's explicit header. It does nothing about the pattern that twenty photos make when you look at them together, because a pattern isn't a field you can delete — it's a property of the collection, and the only way to manage it is to think about the collection, not the file in front of you.

What consent means when the subject didn't give it

Every other page on this site assumes the person in the photo is the same person deciding whether to post it. A child's photo breaks that assumption at the root. The subject cannot consent in any meaningful sense at the age most of these photos are taken, has no say in the audience, the caption, or how long the post stays up, and will eventually grow into someone with their own opinion about a digital footprint they never built. Legal frameworks are still catching up to that gap. The GDPR's Article 8 sets an age-based consent standard for a child's own data, but says nothing about a parent's own household sharing, which is where the Dutch household-activity question came from. In the United States, COPPA is often assumed to cover this territory and does not: it regulates what companies may collect from children under 13, not what a parent chooses to post about their own child, which is left almost entirely to parental judgment. The practical result, in most places, is that there is little external check on sharenting beyond the parent's own sense of what the child would want — which is exactly why building a habit matters more here than almost anywhere else on this site.

A workflow for photos of your kids

1. Strip EXIF and GPS from every photo before it's posted, with no exceptions for "just family." A private account and a small follower list are not the same thing as a closed household, and the Dutch ruling above turned on exactly that distinction.
2. Turn off geotagging at the camera or phone level, not just at posting time. If your device stops writing GPS into new photos, you remove the chance of forgetting the wipe on any given day. The guide on stopping metadata from being written in the first place covers how to do this on the devices that support it.
3. Review the last several posts together before adding a new one, not just the new photo alone. Ask what a stranger could infer from the set, not the single file — a recurring background, a visible street sign, a school logo, a recognizable weekly timing.
4. Extend the same standard to everyone else who photographs your kid. Grandparents, co-parents, schools, sports leagues and other relatives often post photos of the same child with no metadata hygiene at all. One cleaned account does not close a gap that three other accounts leave open.
5. Treat requests to take something down as the norm, not the exception. Children in published research describe resenting posts they weren't asked about and having those requests dismissed; building in a willingness to remove things, including years later when the child asks, costs little and avoids the worst outcomes described in that research.
6. Separate the keepsake copy from the posted copy. Keep full-resolution, full-metadata originals privately, for your own family record, and only strip and post a separate copy meant for a wider audience. That way stripping metadata for privacy never costs you the record you actually want to keep.

Where this site's tool fits, and where it does not

MetadataWipe decodes a JPEG or PNG onto a canvas and re-encodes it — JPEG at quality 0.92, or PNG — which discards EXIF, GPS and other header data from that one file, entirely in your browser. That is exactly the right tool for step one of the workflow above: run every photo of your kid through it before it leaves your device, every time, with no exceptions. It is not built to look at a face, recognize a background across photos, remember your posting history, or flag a pattern across a dozen images — nothing client-side or otherwise can automate that part, because it requires a judgment about context that only a person reviewing the actual photos can make.

Common mistakes and misconceptions

"It's just our private family, so none of this applies." A private account, a family group chat, or a small follower list is still "posting" in the sense that matters here — it reaches people beyond the household, and the 2020 Dutch ruling specifically rejected the idea that family-only sharing is automatically exempt from data-protection rules once third parties can see it.

"I strip metadata, so I've covered the privacy risk." You've covered the explicit-header risk in that one file. The pattern risk — recognizable locations and routines visible across many photos — lives in the pictures and the posting history, which metadata removal was never built to touch.

"My kid is too young to care." Research on sharenting consistently finds that children, once old enough to have an opinion, often feel differently about old posts than the parent who made them — and by then the posts have usually been up for years.

"Grandparents and family members aren't really 'the public.'" Once a photo leaves your own device and lands on someone else's account, you no longer control its audience or its metadata hygiene, no matter how well you trust the person who posted it.

"COPPA protects my child's photos online." COPPA regulates what companies collect from children under 13; it has nothing to say about what a parent chooses to post, which is a common and understandable mix-up given how often the law comes up in child-privacy conversations.

Related guides

See also:

• Photo metadata when the photo is of someone else
• Can you stop metadata from being written in the first place?