Photo metadata when you send a photo to an AI chatbot

The rest of this site is organised around recipients. Roughly seventy pages here are some version of "clean this before it reaches that audience" — a marketplace listing, a dating profile, a newsroom, a court filing. The reasoning always runs through somebody who could look. Take the audience away and the instinct goes quiet, even though two things have just got worse rather than better.

The first is that the transfer is still a transfer. Attaching a photo to a chat is the same act as attaching it to an email: the file leaves your device and lands in an account, complete with whatever its headers say. The second is more specific to this situation, and it inverts the advice on every other page here. On a marketplace listing, the hidden data is the risk and the picture is the thing you meant to show. In an AI chat, the picture is the input to a system whose entire purpose is reading it closely and telling someone what it sees. That makes the visible content the larger exposure and the metadata the smaller one — the only page on this site where that is true.

What actually travels with the attachment

Assume, until you have checked otherwise, that the bytes you select are the bytes that arrive. A phone photo carries EXIF with capture time, camera make and model, lens and exposure settings, often GPS coordinates, frequently a proprietary maker-note block, and usually an embedded thumbnail that is a separate small image with its own history. An edited file may also carry XMP or IPTC blocks naming the software, the editing steps, a copyright string or your own name from an export preset.

Some products will re-encode or resize an image before it goes, some will strip headers on receipt, and some will do neither. That behaviour varies by product, by whether you are in an app or a browser, by plan, and by version, and it can change without being announced. Do not try to settle it from the outside, and in particular do not settle it by asking the assistant what it can see in the file — an answer describing tags is a description, not an audit, and an answer saying it sees none is not evidence that none arrived. The question is only worth answering if you leave something in the headers to find. If the file you attach was generated from pixels a moment earlier, there is nothing to parse and nothing to disclose.

Then there is the copy you keep creating without noticing. A chat is a transcript, and an attached image is part of it. If you can scroll back a week later and still see the photo, a copy is held somewhere until something removes it. Whether that removal is immediate, delayed, replicated into backups, retained for abuse review, or governed by a training toggle differs between products, plans and settings, and those settings change. This is worth checking once in your own account's data controls rather than guessing per message — and worth treating as a reason to send less, because the least risky copy is the one that was never interesting.

The frame is the leak, not the header

This is the part that has no equivalent elsewhere on the site, and it deserves to be stated plainly: in this setting, metadata removal is necessary and not sufficient.

The photos people send to an AI tool are rarely scenic. They are a letter from a clinic, a utility bill with a question about a charge, a rash, a tax form, a contract page, a child's homework, a dashboard error, a dead appliance with the serial plate visible, a whiteboard after a meeting. The reason the photo is there is that its contents need reading. A tool optimised to read images will read all of it, not only the part you were asking about — the corner of the envelope, the sticky note on the monitor bezel, the reflection in the window behind the laptop, the delivery label still on the box, the name badge, the street sign through the glass.

So the useful planning assumption is not a claim about how clever any particular model is. It is simply this: anything legible in the frame may be read back as text, and anything recognisable in the frame may be described. That assumption costs you nothing if it is pessimistic and saves you a great deal if it is not. It also reorders the work. Cropping to the question does more for you here than stripping headers does, and stripping headers belongs at the end so that the file you finally attach is a generated one.

Screenshots are the dominant case, because most of what people paste into a chat was never photographed at all. They carry a different metadata profile from camera photos and a much heavier content profile — see what metadata does a screenshot contain for what actually survives in a capture. In a chat the notable thing about a screenshot is that it shows your software: the other participants in a thread, an account number in a sidebar, a subject line you did not think about, an unread notification across the top, your own handle, the tab strip, the clock, the wi-fi network name.

And often the sensitive material is not yours. A photo of someone else's letter, a group chat, a class list, a colleague's payslip: attaching it makes a disclosure on their behalf, decided by you, in a context where you are focused on your own question. That asymmetry is worth naming before you attach, not after.

A pre-send routine

1. Ask whether the image is needed at all. A lot of what gets attached could be typed out in three lines with the identifiers left off. Text you compose is text you control.
2. Crop to the question first. Not to what looks tidy — to the minimum region that carries the thing you are actually asking about. This single step removes more than any header edit will.
3. Read the edges deliberately. Zoom in and sweep the four corners, the background, any screen inside the frame, and any reflective surface. You are looking for text and for anything that identifies a place, an employer or a person.
4. Redact destructively, and flatten. A drawn rectangle is only a redaction once it is burned into the pixels. An annotation layer in a format that keeps layers, or an editor's own "hide" overlay, can be a cover rather than a deletion.
5. Strip metadata last. Cropping and annotating tools frequently write their own tags and may preserve inherited ones, so cleaning before you edit means cleaning the wrong file. Make the strip the final action before attaching.
6. Send one image for one question. Batches feel efficient and leak more than their parts: several frames from the same place, at known times, invite exactly the cross-frame inference a single photo does not support.
7. Check your data controls once. Find the history, retention and improvement settings in the account you actually use, and set them deliberately. Then remember they are a snapshot that product updates can revise.
8. Do not verify by asking the model. Verify on your own side, against the file you are about to attach, before it moves anywhere.
9. Treat anything already sent as permanent. Cleaning afterwards protects the next copy of that file, which is worth doing, and does not reach the one that has gone.

The adjacent question — what AI systems put into image files they produce, and whether that survives a strip — runs the other direction: see do AI-generated images have hidden metadata that reveals they were AI-made.

What this tool can and cannot do here

MetadataWipe takes one JPEG or PNG at a time, decodes it in your browser and re-encodes it from the resulting pixels, so the file you download is generated rather than copied and carries none of the original header structures. JPEG output is written at a fixed quality setting; the image is not resized or cropped. The check shown before and after is a heuristic scan of the beginning of the file for EXIF, GPS and PNG text or timing markers — a quick screen, not a field-by-field audit. The download is produced from data already held in the page, and nothing about your image is sent anywhere. The clean copy arrives as a new file with -metadatawipe in the name; your original is untouched, which means you have to attach the right one.

What it cannot do is most of this page. It has no idea what your picture depicts, cannot crop, cannot redact, cannot tell you that there is a name badge in the corner, and cannot reach a copy already in a transcript. It also handles JPEG and PNG only — a HEIC file straight off a phone, a PDF, or a video will be rejected rather than cleaned. Judging the frame is human work, and in this setting it is the work that matters most.

Common mistakes and misconceptions

"It's private — it's just me and a tool." The interface is private; the transfer is not. Attaching a file to a chat puts a copy in an account held by a third party, which is the same category of act as emailing it.

"I stripped the EXIF, so the photo is anonymous." You removed the coordinates and kept the picture. In a context built around reading pictures, that is the smaller half of the disclosure.

"I deleted the message, so it is gone." You removed it from your view and requested its deletion elsewhere on terms you cannot inspect. Assume a delay at minimum.

"It said it couldn't see any location data, so there is none." That is a generated sentence about a file, not a report from a parser you can trust. Check the file yourself, on your own machine, beforehand.

"I drew a black box over the name." Only if it was flattened into the pixels. A shape in a layered or annotation-preserving format may be removable by whoever opens it next.

"It's only a screenshot." Screenshots are lighter on camera metadata and much heavier on visible content, which is the exposure that matters here.

"I turned off model training, so nothing is kept." Training use and retention are separate controls answering separate questions. Switching one off does not empty a conversation history.

"It's an internal work tool, so it is fine." Possibly, but that is a procurement question about a specific deployment rather than a property of chat tools, and the photo in your hand may belong to a customer or a colleague rather than to you.

Related guides

See also:

• What metadata does a screenshot contain?
• Do AI-generated images have hidden metadata that reveals they were AI-made?