Take a photo on a normal phone and it does not just capture the image. Baked invisibly into the file is a block of data called EXIF metadata, and among the camera settings and the timestamp is the one field that should stop you cold: the GPS coordinates of exactly where you were standing, often accurate to within a few meters.

That data travels with the file. So the vacation photo you texted a friend, the picture of something for sale you emailed a stranger, the shot you dropped into a shared cloud folder, each may have quietly included a pin on the map pointing at your kitchen, your kid’s school, or wherever you happened to be. You did not attach it. Your phone did, silently, and it is riding along inside the picture right now.

This is one of the oldest and most reliable privacy leaks there is, and most people have no idea it is happening.

What a geotag actually gives away

The consequences are not hypothetical. The most famous example is from 2012, when a magazine published a photo of the fugitive software founder John McAfee, and the GPS coordinates left in that photo’s EXIF data revealed he was in Guatemala, ending his time on the run. Stalkers have located victims from a single posted image. Service members have blown operational security by uploading geotagged photos from sensitive sites. The pattern is always the same: a picture that looks harmless, carrying a precise location the person never meant to share.

And it is not only where one photo was taken. A handful of your images, taken together, map your life, the place that appears in every evening shot is home, the one in every weekday photo is work. Your camera roll is a location diary you did not know you were keeping, and every file you share is a page from it.

One partial mercy: most big social platforms strip EXIF when you upload, so a public Instagram post usually is not leaking coordinates. But that safety net has holes. The original file on your phone still has it. Photos sent over many messaging apps, over email, or synced to cloud storage frequently keep it. And the moment someone has the raw file, they have the pin.

The fix everyone knows, and the better one

The standard advice is to strip the metadata before you share. That works, and it is worth doing. But it is reactive and fragile: you have to remember every single time, the original still carries the data, and not every app strips it for you. One forgotten share undoes it.

The better approach is to never generate the real coordinate in the first place. Two settings do most of the work. First, deny the camera access to your location, and no geotag gets written into the photo at all. Second, and this is where our GPS spoofing feature comes in, you can control what location the device reports to everything on it. Instead of handing apps and the camera your true position, the phone can feed a deliberately false location, or none at all. The geotag on your photos becomes wrong on purpose, or simply absent, and as a bonus, every other app that quietly grabs your location, the weather app, the games, the ad SDKs, gets the fake one too.

That is the difference between mopping the floor and turning off the faucet, the same principle we wrote about with data brokers. Stripping EXIF cleans up a leak after it happens. Controlling the location your phone reports means the leak never happens. You are not scrubbing coordinates out of files one by one; you are ensuring the real coordinates were never in them.

Two honest limits, because there always are

We are not going to oversell this, because two caveats matter.

First, spoofing the GPS controls the location that apps and your photos see. It does not change the location your carrier has. Your phone still connects to cell towers, and the carrier still knows roughly where you are from that, entirely separate from GPS. We wrote a whole piece on that, the SIM is its own leash. So GPS spoofing keeps your photos and your apps from knowing and leaking your real position, but it is not a cloak against the carrier. Different layer, different fix.

Second, and this is the newer and more unsettling one: stripping or faking the geotag defeats the metadata leak, but it does not defeat artificial intelligence reading the photo itself. Tools like GeoSpy, recently rebranded Raven, along with a growing crop of competitors and even general models like ChatGPT, can now determine where a photo was taken from the pixels alone, no EXIF, no GPS, nothing in the metadata at all. They read the architecture, the street signs, the vegetation, the angle of the sunlight, the terrain, and match it against tens of millions of street-level images, sometimes down to the specific building. As one analysis put it bluntly: you can strip EXIF GPS, but you cannot strip what the pixels themselves reveal. A 2025 investigation found one of these tools had been publicly accessible for months, and researchers have documented general AI models geolocating people from ordinary photos.

What that means practically: the metadata fix is necessary but no longer sufficient on its own. You also have to think about what is visible in the frame. A photo taken inside, against a blank wall, gives an AI almost nothing. A photo of your street, your storefront, the view from your window, hands it the answer no matter how clean the metadata is.

The layered defense

Put it together and it is three moves, and the device handles the first two for you.

Do not geotag, and control the location your phone reports, so the exact coordinate is never written and your apps get nothing true. Strip metadata from any raw file before you send it, as a backstop. And use judgment about what is actually in the shot, because the image content is now geolocatable on its own. The first two are settings and features. The third is discipline, and it is the one no phone can do for you.

The good news is that on a device built for this, the hard parts are defaults rather than chores. Location denied to the camera unless you choose otherwise. A reported location you control, including the ability to feed a false one. Metadata handling that does not depend on you remembering. You are left with just the human part, being mindful of the background, instead of fighting your own phone to keep your address out of your photos.

Your camera should not narrate your location to everyone you share a picture with. If you want a phone where it does not, and where you decide what location the whole device reports, that is what we build. Email hello@spicycorp.com, or book a call.