A shared photo seems to say only what it shows: a plate of food, a sunset, a child on a bicycle. Often, though, it also says where it was taken. Sometimes it says so outright, with coordinates saved inside the file; sometimes it lets the background give it away; and almost always, if there are enough photos, it tells the story over time.
Tracking people through their photos covers all the ways someone can work out a person’s places, habits and movements from the images they share. It does not require breaking into an account: it works on what has already been posted or sent.
This post explains the most common mechanisms and why they become more effective when the location travels with the pictures. It is the threat-side companion to the recommendation on turning off photo geotagging, geotagging being the feature that adds to photos and videos the coordinates of the spot where you took them.
A useful clarification: this post explains how these abuses work from the point of view of the people they happen to, so that you can recognise them and protect yourself. It is not a set of operational instructions.
Starting scenario
For a few years now you have been posting photos on your profile fairly regularly. Nothing special: breakfast at the café downstairs, the Saturday morning run in the park, the end-of-year party in the school gym, a few holiday shots while you are still at the seaside.
None of these photos, on its own, reveals anything sensitive. Put in a row, though, they can answer questions nobody has ever asked you: which part of town you live in, what time you leave home, where your children go to school, when the house is empty.
Hardly anyone asks those questions. For the few who do, however, the answers are often already there.
Why location in photos increases the risk
All the mechanisms that follow have one thing in common: they do not need to spy on you, they only need to piece together what you have already shared.
A photo contains two kinds of information. The visible kind, meaning what you see in the image. And the invisible kind, metadata: hidden data inside the file that describes the shot, such as the date, the time, the phone model and, if geotagging is on, the latitude and longitude.
Without location in the files, someone trying to pinpoint a person has to make guesses, and is often wrong. With location in the files, the coordinates point to a spot and everything else only serves to confirm it. Geotagging does not create the problem, but it makes it much simpler and more precise.
1. Reading coordinates from original files
In plain words. Someone receives one of your photos in its original format and reads its metadata, finding the exact spot where you took it.
How it works. When a photo leaves your phone as a complete file — sent “as a document” in a chat, attached to an email, shared from an online storage space, uploaded to some websites or forums — the metadata travels with it. Many platforms strip it out on upload, but not all of them, and not in every sending mode.
Why geotagging makes it easier. This is the mechanism geotagging makes possible: without saved coordinates, there would be nothing to read.
Possible impacts. Your home address, your children’s school or your workplace worked out to within a few metres; places you did not want known, such as a doctor’s surgery or a relative’s home, exposed.
Warning signs. Someone insistently asking for your photos “in full quality” or “as a file”; people referring to places you have never mentioned; your gallery showing your photos on a map, which means the location is being saved.
How to protect yourself. Turn off geotagging in the camera app, or remove the camera’s permission to use your location; remove the location before sending an original file. The practical steps are in the guide on how to remove location from photos.
2. Recognising the place from the background
In plain words. Even without coordinates, a place can be recognised from what appears in the photo.
How it works. A shop sign, a shop window, a street name plate, the house number on the front door, the outline of a bell tower, the shape of the hills, the view from a window: these are clues that someone who knows an area, or someone with time and patience, can compare with public images and maps. It is observation and comparison, not advanced technology.
Why geotagging makes it easier. Here the location in the file is not essential, and that is worth knowing: removing the coordinates does not make a photo anonymous. When the coordinates are there, though, the background only serves to confirm them, and the precision goes up considerably.
Possible impacts. Identification of the street or building you live in; recognition of your children’s school or the café you go to every morning.
Warning signs. Comments naming places recognisable from the background (“isn’t that the square in…”); requests for photos from particular angles; unusual interest in background details.
How to protect yourself. Look at the background before posting, especially in shots taken at or near home; frame more tightly, crop or blur shop signs, house numbers and number plates. The same goes for readable details such as QR codes, covered by the recommendation on posting photos with QR codes.
3. Reconstructing habits from many photos
In plain words. One photo says where you have been; a hundred photos say where you go, when and with whom.
How it works. Anyone who follows a profile over time, or saves its images, can sort them by date and place. Patterns emerge: the same gym on Tuesday evenings, the same park on Sundays, the same route at school pick-up time. It is a form of profiling, meaning building up a picture of a person from lots of scattered data.
Why geotagging makes it easier. With saved coordinates, every photo becomes a precise point on a map. Many photos together trace your routes without any need for interpretation.
Possible impacts. Predictable schedules and movements; knowledge of your children’s and relatives’ habits; loss of privacy about the places of your everyday life.
Warning signs. Someone who seems to know where you will be before you say so; an unfamiliar profile systematically viewing or saving your photos, old ones included.
How to protect yourself. Share your regular places sparingly; avoid always posting from the same spots at the same times; limit who sees your content, as the recommendation on connecting only with people you know suggests.
4. Publishing personal data (doxxing)
In plain words. Someone gathers private information about a person and makes it public, often to put them in a difficult position or expose them to pressure.
How it works. Doxxing usually starts from a conflict: an online argument, a review, a stance someone has taken. Whoever wants to cause harm pulls together whatever they can find — name, photos, workplace, the area where the person lives — and spreads it in a group or on a public page. Photos with location data are among the most immediate sources, because they turn a person “online” into a real address.
Why geotagging makes it easier. A single photo with the coordinates of your home can be enough to complete a profile that would otherwise stay vague.
Possible impacts. Unwanted messages, unwelcome visits, psychological pressure, fear for your own safety and your family’s.
Warning signs. Your photos reshared by unfamiliar profiles with hostile comments; people mentioning your neighbourhood or address in a discussion; a sudden rise in contact from strangers after an online disagreement.
How to protect yourself. Keep public profiles and personal ones as separate as you can; remove location from your photos; report the content to the platform and keep evidence. If it happens to you, it is not your fault: talk to people you trust and, if you feel in danger, contact the police.
5. Harassment and persistent monitoring
In plain words. Someone uses your photos to know where you are and to make themselves present in your life against your wishes.
How it works. Often it is someone you know, such as a former partner or an acquaintance who will not accept distance. The photos you post, and those sent in shared groups, let them follow your movements, turn up in the same places, and make it clear they know where you have been. When this behaviour is repeated and causes fear, it can also have legal relevance.
Why geotagging makes it easier. Coordinates make monitoring more precise and less effortful: there is no need to guess, just look at the latest photo.
Possible impacts. A sense of insecurity, changing your habits out of fear, isolation, effects on the wellbeing of the whole family.
Warning signs. “Chance” encounters that happen too often; messages commenting on where you have just been; the feeling that someone knows your schedule. That feeling always deserves to be taken seriously.
How to protect yourself. Review who can see your photos and remove access for anyone who does not make you feel safe; turn off geotagging; post places after the fact, not live. Asking for help is not an overreaction: support services exist and the police can step in.
6. Burglaries planned around holiday photos
In plain words. Holiday photos posted while you are still away also say that your home, at that moment, is empty.
How it works. It is not the most common case, and most burglaries do not start from a post. But when the person looking already knows where you live — perhaps from a geotagged photo taken months earlier in your living room — a post from the beach, with date and location, also shows how long you will be away.
Why geotagging makes it easier. Coordinates link the two pieces: the place where you live and the faraway place where you are right now.
Possible impacts. Burglary or damage to your home, and the unease of feeling exposed.
Warning signs. Unfamiliar profiles taking an interest in your trips; questions about when you will be back; old photos of your home still visible with their location.
How to protect yourself. Tell the story of your trip when you get back, not in real time; remove location from photos of your home that are already posted; limit the audience of personal posts.
Summary table
| Mechanism | Main risk | Warning signs | Effective defences |
|---|---|---|---|
| Reading coordinates | Precise location taken from the file | Requests for photos “as a file”, references to places you never mentioned | Geotagging off, location removed before sending |
| Recognising the background | Place identified from what is visible | Comments about recognisable signs or squares | Checking the background, tighter framing, cropping details |
| Reconstructing habits | Predictable schedules and routes | Someone knows where you will be before you say | Sharing sparingly, a smaller audience |
| Doxxing | Private data made public | Photos reshared by strangers with hostility | Separate profiles, location removed, reporting and evidence |
| Harassment and monitoring | Unwanted presence in your life | Repeated “chance” encounters, comments on your movements | Audience reviewed, delayed posting, asking for help |
| Planned burglaries | Empty home signalled | Interest in your trips and return dates | Posting the trip afterwards, home photos without location |
What they have in common
Six different mechanisms, three defences that cut across almost all of them:
- No location in the files — removing the coordinates makes these abuses slower, less certain and often pointless.
- A look at the background before posting — what is visible in the photo can say as much as the metadata.
- Timing and audience chosen by you — sharing later and with fewer people takes the value out of the information.
These are not advanced measures: they are habits you can pick up in very little time.
When it makes sense to switch off your phone’s location more generally is explained instead in the recommendation on turning off Bluetooth and location.
Protection checklist
- ☐ Geotagging turned off in the camera app, or location permission removed from the camera
- ☐ Location removed before sending a photo as a file or attachment
- ☐ Background checked in shots taken at home, at school or at work
- ☐ Shop signs, house numbers and number plates cropped or blurred when needed
- ☐ Holiday photos posted after you get back, not live
- ☐ Audience for personal content limited to people you know
- ☐ Old photos of your home checked again and, if needed, reposted without location
- ☐ Someone you trust to turn to if a person seems to know too much about your movements
How this connects to the Cyber Welfare Framework
| Pillar | What this content contributes |
|---|---|
| Awareness | Understanding that a photo carries more information than it shows, and that many photos together reveal habits |
| Skills | Recognising the ways a location can be worked out, from the coordinates in the file to the details in the background |
| Secure Behaviour | Looking at a photo through a stranger’s eyes before sharing it, and choosing when and with whom |
Reference level: FL3 — Autonomous, with elements of FL2 — Beginner in the sections on coordinates in files and holiday photos.
Conclusion
The mechanisms described here do not require special tools. They rely on everyday, harmless gestures — taking pictures, sharing, telling a story — and on what those gestures leave behind.
That is why the most effective defence is not to stop sharing, but to share knowingly: photos without location, a glance at the background, and timing and audience chosen by you. To find out whether your photos are already sharing your location, the signs your photos share your location are the next step; for a broader picture of your digital habits, you can start with the digital resilience self-assessment.
Something to think about. If a stranger looked at the last twenty photos you posted, what could they say about where you live and how you spend your days?
Related resources
Short pieces from the Resources section, for anyone who wants to focus on a single aspect:
- Hide Photos on Your Phone: What the Built-In Options Do
- App Permissions: Deciding What Each App Can Reach
Related content
- Turning off photo geotagging — the recommendation this belongs to
- Signs your photos share your location — the indicators to check
- How to remove location from photos — the steps to fix and prevent it
- EXIF photo metadata — the technology that saves the location in the file
- When a photo reveals where you live — what these abuses lead to when they succeed
- Risks of location data in photos — what is affected, from confidentiality to availability
- Consequences of location tracking — the wider picture of location data
Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.
