Privacy · 7 min read
Remove Metadata Before Sharing: What Your PDFs and Photos Reveal About You
A quote for a new client, a CV for a job application, a photo of your flat for a classified ad: what is visible is only what you chose to share. The file itself often holds more, such as the name your computer account is registered under, the software you use, the exact time the file was created and, for photos, the location to within a few metres.
This guide explains which metadata PDFs and images typically carry, why it can matter under data protection law, and how to clean it with Toolula's Remove PDF Metadata and Convert Images tools. It is also honest about which traces such a tool does not remove.
What a PDF carries
Every PDF can contain an info dictionary with title, author, subject, keywords, the creating and producing software, and the creation and modification dates. Office programs often fill in the author automatically with the name of the user account, even when the document started as a colleague's template or was created at a different company.
Many files also contain an XMP block, embedded XML metadata that many programs write without asking. It may repeat the same details in more verbose form and sometimes holds an editing history. Some applications store their own private data as well. And if a PDF has been saved several times, earlier versions can still be technically present inside the file.
- Title, author, subject, keywords
- Creating and producing software
- Creation and modification dates
- XMP metadata and application-specific data
What a photo carries
Digital photos carry EXIF data: camera model, lens, exposure, the date and time to the second and, if location services were on, GPS coordinates. A photo of your garden or your child's room can therefore reveal your home address. Many smartphones also save photos as HEIC, which some programs and upload forms cannot open.
Some platforms strip EXIF data on upload, but you should not rely on it. If you send a photo as a file by email, through a cloud link or as a document in a messenger, you usually transfer the original file with all its metadata.
Why it matters under the GDPR
Under Article 4(1) GDPR, personal data is any information relating to an identified or identifiable natural person, and the regulation explicitly names a name and location data as identifiers. An author name in a PDF or GPS coordinates in a photo can therefore be personal data, whether yours or that of colleagues, clients and employees.
The data minimisation principle in Article 5(1)(c) GDPR requires data to be adequate, relevant and limited to what is necessary for the purpose. Organisations that regularly send documents outside, such as companies and public bodies, should therefore remove unnecessary metadata as a matter of routine. For private individuals it is simply a question of personal safety.
A common example from everyday work: a quote or contract template is reused for many clients. The visible text is updated each time, but the title field in the metadata may still carry the name of the first client it was written for. The next recipient then learns who else you work with, which is both a confidentiality problem and, if that client is a person, a disclosure of personal data.
Removing PDF metadata, and what is left afterwards
In Remove PDF Metadata, drop the PDF. Under Hidden data in this file, Toolula first lists what it found: title, author, subject, keywords, software, and creation and modification dates, plus a line for embedded XML metadata if an XMP block is present. Clicking Remove metadata replaces the entire info dictionary, so custom fields disappear too, deletes the XMP block and application-specific data at document and page level, and saves the file as a single clean revision. The copy gets -clean added to its name, and your original stays as it was.
Pages, text, images and fonts are not touched. That also means what is visible stays. Names in headers, comments, bookmarks, form values and attachments are not metadata in the narrow sense and remain in the file. Photos inserted into a PDF can also bring their own EXIF data along. So clean photos before you put them into a document, and redact visible details with Smart Redaction, whose Also remove metadata & hidden data option additionally deletes JavaScript and attachments.
Cleaning photos, and a routine before you send
For photos, use Convert Images. Drop the images (PNG, JPG, WebP, HEIC or HEIF, a whole batch if you like), choose JPG, PNG or WebP under Output and leave Strip image metadata switched on. After Process all, download single files or use Download all as ZIP. GPS location and camera details are then gone, and HEIC photos from an iPhone open everywhere.
A short routine before sending prevents most mishaps. Check what the document properties in your PDF reader show. Clean photos before they go into documents. Remove metadata as the very last step, once all edits are finished, because many programs write new details the next time they save. And remember that digital signatures detect any later change: do not clean a signed PDF, or its signature will become invalid.
Frequently asked questions
Does removing metadata change my document?
Not visibly. Pages, text, images and fonts stay unchanged; only the info dictionary, the XMP block and application-specific data are removed. The file is saved anew, though, so any existing digital signature becomes invalid.
Why does my PDF show no metadata?
Some programs write none, and some files have already been cleaned. Toolula then reports that no standard metadata was found. Cleaning still removes an XMP block and hidden extras if they are present.
Does the tool also remove EXIF data from photos inside the PDF?
No. It cleans the PDF's own metadata, not each embedded image. Remove EXIF data with Convert Images before you insert photos into a document.
Is metadata personal data?
It can be. The GDPR explicitly lists names and location data among the identifiers through which a person can be identified, so an author name in a PDF or GPS coordinates in a photo regularly qualify.
Are my files uploaded?
No. PDF cleaning and image conversion run entirely in your browser on your own device.