What Telegram, Signal and WhatsApp Actually Do With Photo Metadata

Send a photo through a messaging app and three different things can happen to its metadata: it can be stripped completely, it can be stripped from the copy the recipient sees but kept on the company's servers, or it can travel through untouched. All three apps get described as "private" in casual conversation. They are not the same, and the differences matter if you have ever photographed anything you would rather not geo-tag: your home, your kids' school, a client's property.

Every photo taken on a modern phone carries EXIF data: the camera model, shutter settings, the date and time, often the GPS coordinates of where the shutter was pressed. That GPS block is the sensitive part. A photo of a watch for sale is harmless. The same photo with latitude and longitude to four decimal places tells a buyer exactly which apartment window the watch sits behind.

WhatsApp: stripped in transit, with one big exception

WhatsApp re-encodes every photo you send. The image that lands on the other phone is a recompressed JPEG that does not contain the original EXIF block, GPS included. This has been true for years and is easy to verify: save an incoming WhatsApp photo, run it through our EXIF checker, and you will find camera make, GPS coordinates and serial numbers all gone.

Two things people still get wrong. First, WhatsApp strips the image, not the filename. Send IMG_20260714_083214.jpg and the recipient knows roughly when and where you were, because many phones encode a timestamp into the filename itself. Second, and more important: documents are not photos. Attach the same picture as a file (the paperclip, "Document" option) and WhatsApp passes the original bytes through untouched, EXIF and GPS included. This is the single most common way people leak their location over messaging without realising it. Real estate agents sending inspection photos as documents, contractors sending site photos as PDFs, anyone sending a screenshot exported from a camera roll as a file — all of it can carry full metadata.

Also worth knowing: WhatsApp keeps the undelivered message, photos included, on its servers for up to 30 days. Since the metadata is stripped at send time this mostly matters for the message text, not the image.

Telegram: depends entirely on compression

Telegram behaves like WhatsApp when it compresses. Send a photo the normal way and the recipient gets a processed image with EXIF removed. But Telegram also offers a "Send as File" option, and unlike WhatsApp's document path it is used constantly — people want to share full-quality photos, and "send as file" is how you do that. A file sent through Telegram is the original, byte for byte, metadata and all. In channels and groups with thousands of members, this is a recurring leak: a nice full-resolution photo posted "as file" hands every viewer the poster's camera model and, if GPS was on, the shooting location.

Cloud chats add another wrinkle. Telegram is not end-to-end encrypted by default; only Secret Chats are. In a normal cloud chat, the stripped, compressed photo sits on Telegram's servers in a form their systems can process. Telegram has stated it strips EXIF from uploaded photos before storing them, but you are trusting their pipeline rather than a mathematical guarantee. In a Secret Chat, the negotiation is peer-to-peer and the standard photo path strips metadata on the client side before encryption.

Signal: stripped at the client, always

Signal is the most predictable of the three. All messages, photos included, are end-to-end encrypted, and the app removes metadata from images on your phone before anything is sent. The recipient gets a clean image; there is no server-side copy to reason about because Signal keeps almost nothing. Signal's own documentation has listed EXIF stripping as standard behaviour for years.

The honest caveat: client-side stripping is a behaviour of the app, not a promise enforced by anyone. If you send an image as a file attachment rather than a photo, Signal will treat it as an arbitrary file — that is the whole point of file attachments, integrity. So the same rule from WhatsApp applies everywhere: photos get cleaned, files get passed through.

The pattern underneath all three

Notice what the three apps have in common. None of them promise to protect a file. Every stripping mechanism is bolted to the "photo" pipeline — the path where the app re-encodes the image for compression anyway. The moment you step onto the "document/file" path, the app treats your bytes as untouchable, because that is what a file transfer is supposed to do. Metadata stripping is a side effect of compression, dressed up as a privacy feature.

Which leads to the practical rules:

• Send photos as photos. Do not use the document/file option unless you have checked what is inside the file first.
• Check before you share anything sensitive. You can drag the file onto the tool on our homepage — it reads the EXIF locally in your browser and shows you exactly which fields, GPS included, are present. Nothing is uploaded.
• Watch filenames. IMG_20260714_083214.jpg leaks a date even when the image is clean. Rename before sending.
• Screenshots are usually safe on metadata (most phones do not embed GPS in a screenshot) but check once for your specific device — some Android skins attach more than you expect.
• If you receive a file from someone else and plan to forward or publish it, assume it has full metadata until you have checked. The original photographer's GPS becomes your problem the moment you republish.

A two-minute check worth doing once

Take one photo with location services on. Send it to yourself three ways on each app you use: as a photo, as a compressed file if the app offers it, and as the original file. Then pull each received copy into the EXIF checker and look at the GPS block. Ten minutes of checking once tells you more about your real exposure than any privacy policy. Most people who do this discover two things: their normal photo habit is fine, and the "send as file" button they have been using for quality is the one that has been quietly attaching their home address.

The apps are mostly on your side. The escape hatches are the ones you open yourself.