MetaWipe
← All posts

EXIF, IPTC, XMP and ICC Explained: A Field-by-Field Guide

What EXIF, IPTC, XMP and ICC metadata actually contain, field by field — which tags are harmless, which are risky, and which you should always remove.

Every image file is really two things: the picture, and a set of metadata blocks describing how, when, where, and by whom it was made. Four standards do most of the work — EXIF, IPTC, XMP, and ICC — and they're routinely confused with each other. This guide explains what each one is, walks through the important fields, and sorts them into harmless, situational, and dangerous.

The four metadata standards at a glance

EXIF (Exchangeable Image File Format) is written by the camera at capture time: exposure settings, device info, timestamps, GPS. It lives in JPEG, TIFF, and HEIC files (and in PNG via an extension chunk).

IPTC (IPTC-IIM / IPTC Core) comes from the news industry. It's added by people, not cameras: captions, creator name, copyright, keywords, usage rights.

XMP (Extensible Metadata Platform) is Adobe's XML-based container. Editing software (Lightroom, Photoshop) uses it to store edit history, ratings, keywords — and it frequently duplicates EXIF and IPTC data, which is why removing one block doesn't guarantee the information is gone.

ICC profiles describe color: how the file's numeric values map to real-world colors (sRGB, Display P3, Adobe RGB). They contain no personal data and removing them can change how your image looks.

EXIF fields, one by one

Harmless: the photographic settings

These describe the exposure and pose essentially no privacy risk:

  • ExposureTime, FNumber, ISO — shutter speed, aperture, sensitivity.
  • FocalLength — the lens zoom used.
  • Flash, WhiteBalance, MeteringMode — how the shot was metered and lit.
  • Orientation — which way is up. Worth noting: stripping orientation carelessly makes photos display sideways, so a good tool preserves or re-applies it.

If you're sharing on a photography forum, this is the data people actually want to see.

Situational: identifying, but not locating

  • Make / Model — camera or phone model. Mostly harmless alone, but narrows down who you are when combined with other clues.
  • Software — the app or firmware that saved the file. Reveals your toolchain, sometimes your OS.
  • DateTimeOriginal / DateTimeDigitized / OffsetTime — exact capture time and time zone. Harmless for a landscape; risky when it establishes where you were at a specific moment or shows you were away from home.
  • Artist / Copyright — often auto-filled with a real name entered once in a camera menu and forgotten. Check if you post pseudonymously.

Dangerous: remove before sharing

  • GPSLatitude / GPSLongitude / GPSAltitude — location to within a few meters. The single most sensitive field group in any photo. Includes GPSImgDirection (compass bearing) and GPSDateStamp on many devices.
  • BodySerialNumber / LensSerialNumber — unique identifiers that link every photo from your camera together across accounts and years.
  • MakerNote — a proprietary, undocumented blob where manufacturers stash extra data: focus points, internal temperatures, and on some models serial numbers and owner names again. Because it's opaque, treat it as sensitive by default.
  • The embedded thumbnail (IFD1) — a small preview of the image stored inside the EXIF block. If the photo was edited but the thumbnail wasn't regenerated, it can reveal the pre-edit image.

IPTC fields worth knowing

  • By-line (Creator) and Credit — the photographer's name. Fine on a portfolio; a doxxing vector on an anonymous account.
  • Caption/Description — free text that may contain names, places, context.
  • Keywords — often exported from photo-library tags, which can include people's names and event names you never meant to publish.
  • Copyright Notice — usually intentional and harmless, but again often contains a legal name.

IPTC data is entered by humans, so its risk depends entirely on what was typed. The trap is that photo managers apply it in bulk, so a name typed once can end up in thousands of files.

XMP: the duplicate problem

XMP deserves special attention for one reason: redundancy. When you edit a photo in modern software, it commonly writes an XMP packet that mirrors EXIF fields (exif:GPSLatitude, xmp:CreateDate) and IPTC fields (dc:creator), and adds its own:

  • Edit history (xmpMM:History) — which applications touched the file and when.
  • Document IDs (xmpMM:DocumentID, InstanceID) — unique identifiers that can link derivative images back to a common original.
  • Ratings, labels, and keywords from your photo library.

The practical consequence: a tool that "removes EXIF" but ignores XMP may leave your GPS coordinates in the file, just written in XML instead of binary. Any serious cleaning pass must cover EXIF, IPTC, and XMP together — which is how MetaWipe approaches it, showing all blocks before removing them in your browser, without the file ever leaving your device.

ICC profiles: the one block you might keep

An ICC profile is a color recipe, not personal information. Removing it can make colors shift — a Display P3 photo from an iPhone interpreted as sRGB looks visibly duller. Standard profile names ("sRGB IEC61966-2.1") reveal nothing about you. The only marginal consideration is that an unusual custom profile could theoretically help fingerprint your workflow, which matters to almost nobody.

Reasonable default: strip EXIF/IPTC/XMP, keep or convert the color profile so the image still looks right.

So what should you actually remove?

For any image leaving your control — social media handled outside the big platforms, email, marketplaces, forums, messaging apps in "file" mode:

  1. Always remove: GPS block, serial numbers, MakerNote, embedded thumbnail, XMP duplicates, edit history.
  2. Usually remove: timestamps, device make/model, software, creator fields (unless attribution is the point).
  3. Safe to keep: orientation, color profile, and — if you want to share them — exposure settings.

The simplest safe policy is "remove everything, keep orientation and color." That's one click in MetaWipe: drop in your photos, review every field it found, and download clean copies — processed entirely client-side, so checking a sensitive photo doesn't mean uploading it.

FAQ

What's the difference between EXIF and metadata?

Metadata is the umbrella term for all descriptive data in a file. EXIF is one specific metadata standard — the one cameras write. A photo can simultaneously carry EXIF, IPTC, XMP, and an ICC profile, and the same fact (like GPS) can appear in more than one of them.

Does removing EXIF data reduce image quality?

No. Metadata lives in separate segments from the compressed image data. A proper remover rewrites the file without those segments and never re-encodes the pixels, so quality is bit-for-bit identical.

Which metadata does a camera add vs. editing software?

The camera writes EXIF (settings, timestamps, GPS, MakerNote, thumbnail). Humans and newsroom tools add IPTC (captions, creator, copyright). Editing software adds XMP (edit history, ratings, and duplicated EXIF/IPTC values). ICC profiles can come from either the camera or the editor.