What is actually in there
Location. Latitude and longitude, sometimes altitude and compass direction. This is the field that matters, because a coordinate is not a fuzzy hint — it is a specific point, and a set of photographs shares a set of points.
Time. When the shutter fired, often with a timezone offset. Frequently more precise than anybody expects, and it does not change when you rename the file.
Device. Make, model, lens, and on some cameras a body serial number. Serial numbers are what let a set of otherwise unrelated photographs be linked to one camera.
Settings and processing. Exposure, aperture, ISO, focal length, and the software that last touched the file — including, on some phones, an editing history.
Orientation. A rotation flag, which is why a photo can appear upright in one app and sideways in another that ignores it.
Where it survives, and where it does not
Most large social platforms strip EXIF when you upload, partly for privacy and partly to save space. That is a genuine protection and it is also the reason people assume the problem is solved everywhere.
It is not. Metadata typically survives being emailed as an attachment, sent through most messaging apps as a "document" or "file" rather than as a photo, uploaded to a smaller site or forum, put in a shared cloud folder, attached to a marketplace listing, or sent to a print service. It survives renaming, moving and copying, because it is inside the file rather than attached to it.
Screenshots are the exception worth knowing: a screenshot has no camera metadata, because no camera took it.
How to look at yours
Open Check Photo Metadata and drop a photograph on it. Everything the file carries is listed, with location shown plainly rather than as raw coordinates. The image is read by your browser and nothing is transmitted — which for a tool whose entire job is examining sensitive fields is not an incidental detail.
Try it on something taken outdoors on a phone with location services on. The result is usually more specific than people expect, and it is a better argument for checking than any paragraph can be.
Removing it, when you want to
Re-encoding an image drops most metadata as a side effect, so anything that reads the picture and writes a new file — converting, compressing, resizing, or making a profile picture — normally produces a clean file. That is the simplest route, and it is usually a step you were taking anyway.
Two cautions. First, check afterwards rather than assuming: the same metadata tool will confirm what the new file carries. Second, do not strip your masters. Metadata is what makes a photo library sortable, searchable and mappable, and it cannot be recovered once it is gone. Strip the copy you are sending, not the original you are keeping.
A reasonable default
Not "remove everything always" — that costs you a working photo library for a threat that mostly is not there. A better rule is: know what a file carries before it leaves your control, and clean the copies that go to places you do not control. Photographs taken at home, at a child's school, or at anywhere you regularly are deserve the check. A picture of a sunset almost certainly does not.