Why social media strips photo metadata

What gets removed

All of the evidence a provenance reader looks for lives in the container around the pixels, and a re-encode discards the container.

• EXIF capture data: camera make and model, lens, shutter, aperture, the timestamp, and the GPS coordinates.
• XMP fields, including the name of the application that last wrote the file, which is where several generators identify themselves.
• The IPTC digital source type, the field whose value trainedAlgorithmicMedia is software stating that a model produced the image.
• The C2PA manifest. It is cryptographically signed against the exact bytes of the file, so re-encoding does not just remove it, it would invalidate it anyway.
• PNG text chunks, where Stable Diffusion front ends write the prompt, seed and model, and which do not survive conversion to JPEG or WebP at all.

Somebody has been measuring this since 2013

The IPTC and the Embedded Metadata Initiative run a repeating test: upload one image carrying known metadata to each major platform, download it again, and see what came back. They ran it in 2013, 2016 and again in 2019, across about a dozen sites.

Ten of the sites removed at least some of the metadata from the file a user could download. One, Behance, both kept the embedded data and displayed it. The headline the IPTC put on the results in 2019 was that many social media sites still remove image rights information from photos, which tells you how much had changed across six years of testing.

Why they do it, which is not a conspiracy

• Bandwidth. A metadata block is dead weight on an image served a million times, and the pipeline that strips it is the same one that resizes and re-encodes.
• Privacy. A holiday photo straight off a phone carries the coordinates of where it was taken. Publishing that by default would be worse than the problem we are discussing.
• Format conversion. Serving WebP or AVIF to one browser and JPEG to another means generating new files, and a new file starts empty.
• Thumbnails and crops. Each derivative is another encode, and platforms generate several sizes of every image.

Where did the evidence go

What does survive an upload

• Pixel watermarks. SynthID lives in the image data rather than in the metadata, so resizing, cropping and re-encoding do not remove it. Only Google can read it, through its own detector.
• The platform's own label. Meta reads the markers on arrival and labels the post, which means the conclusion survives even though the evidence for it did not.
• The picture itself, for a reverse image search. An earlier copy of the same image, found elsewhere with a date on it, is provenance of a different kind.

The repair the standard is building

C2PA calls the answer durable Content Credentials, and it works by not depending on the metadata block at all. Alongside the signed manifest, the file carries an invisible watermark and a perceptual fingerprint, either of which can be used to look the original manifest up in a store after the file itself has been stripped. The specification calls these soft bindings.

Infrastructure is moving too. Cloudflare added a one-click option to Cloudflare Images in February 2025 that preserves Content Credentials through its transformations and records the transformation itself, which matters because a large share of the web's images are served through it.

Neither helps the photograph already sitting in your downloads folder. Both are worth knowing about because they change what a blank file will mean in a few years, and the honest position today is that it means nothing.

What to do with an empty result

• Treat it as no information rather than as a clean bill of health, in either direction.
• Ask whoever sent it for the original, as a file, before it went through anything.
• Run a reverse image search and sort for the earliest copy rather than the best match.
• If the image matters, say plainly that the provenance is missing, and say why. Missing metadata has an ordinary explanation and an accusation built on it will not hold.