--- id: CP-341 slug: exif-geolocation-social-media-photos lang: en title: Geolocation and metadata in published photos description: What a social media post reveals about an employee's workplace and habits, and the steps that limit this exposure. canonical_url: https://startbrain.io/cyberpedia/en/articles/exif-geolocation-social-media-photos/ markdown_url: https://startbrain.io/cyberpedia/en/articles/exif-geolocation-social-media-photos.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Geolocation and metadata in published photos", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/exif-geolocation-social-media-photos/ (CC BY 4.0) wing: 5 theme: browse_safely reflex: cr-058 schema: G2 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/exif-geolocation-social-media-photos/ fr: https://startbrain.io/cyberpedia/fr/articles/geolocalisation-exif-photos-reseaux-sociaux/ de: https://startbrain.io/cyberpedia/de/articles/geolokalisierung-exif-fotos-soziale-netzwerke/ es: https://startbrain.io/cyberpedia/es/articles/geolocalizacion-exif-fotos-redes-sociales/ sources: - "n": 1 title: "Search Open Websites/Domains: Social Media, Sub-technique T1593.001 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1593/001/ accessed: "2026-11-03" - "n": 2 title: Gather Victim Org Information, Technique T1591 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1591/ accessed: "2026-11-03" - "n": 3 title: Gather Victim Host Information, Technique T1592 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1592/ accessed: "2026-11-03" - "n": 4 title: Privacy and Mobile Device Apps | CISA publisher: CISA url: https://www.cisa.gov/news-events/news/privacy-and-mobile-device-apps published: "2022-12-18" accessed: "2026-11-03" - "n": 5 title: "Social Media: how to use it safely" publisher: NCSC (UK) url: https://www.ncsc.gov.uk/guidance/social-media-how-to-use-it-safely published: "2019-01-24" accessed: "2026-11-03" - "n": 6 title: La sécurité sur les réseaux sociaux publisher: Cybermalveillance.gouv.fr url: https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/reseaux-sociaux published: "2019-11-22" accessed: "2026-11-03" - "n": 7 title: Avoiding Social Engineering and Phishing Attacks | CISA publisher: CISA url: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks published: "2021-02-01" accessed: "2026-11-03" --- # Geolocation and metadata in published photos A photo published online shows what it depicts, but it also says where, when and in what context its author works. Social media sites contain information about an organization, including company announcements as well as the roles, locations and interests of its staff [1]. Attackers consult them to prepare their approaches. This article covers the exposure of the employee who posts: workplace, working hours, equipment, role. The sources gathered for this file describe this exposure and the settings that reduce it. They do not detail the technical content of the EXIF metadata of an image file or how each network handles it, so these points are not asserted here. ## In 30 seconds - Where it happens: on social media, where a post can reveal the roles, locations and interests of an organization's staff [1]. - What the attacker wants: to gather details about the company and its employees to target an approach better [2]. - The reflex: before posting, ask what the photo or the text tells a stranger about the workplace, working hours or organization. - If it's already done: check the privacy settings [6], and notify the appropriate people in the organization, including network administrators, if sensitive information has been disclosed [7]. ## Straight answers ### Why does an innocuous post interest an attacker? Because information about an organization also circulates through social media: department names, how the business operates, roles and responsibilities of key employees [2]. MITRE classes this collection under the reconnaissance tactic [2]. This information can open the way to other forms of reconnaissance, to account creation and to initial access, for example through phishing [2]. ### What does the attacker do with this information? They can collect the data passively. They can also use it to create fake profiles or fake groups to get victims to reveal specific information [1]. MITRE cites the case of EXOTIC LILY, which copied social media data to impersonate targeted people [1]. ### Can the devices themselves give away information? Yes. Information about a victim's workstations and devices (configuration, operating system, language) can also be exposed by data accessible online, including social media [3]. ### Can this collection be prevented? Not entirely. MITRE writes that this technique cannot easily be prevented with preventive controls, because it relies on behaviors outside the enterprise's defenses. Efforts should aim to reduce the amount and sensitivity of data available to third parties [1]. The employee therefore acts upstream, on what they post. ## How it works A post has two parts: what is put in it deliberately and what the device or the application attaches to it. For the second, the sources document the role of mobile apps. An app can ask for access to personal data on the device, including location data. Developers then have access to it and can share it with third parties, for example companies that target advertising by position and interests [4]. Some apps give access to the user's approximate physical location [4]. On the social network side, visibility settings are often wide open by default: data can be shared with all followers [6]. Even in a circle believed to be restricted, a post can be reshared or interpreted beyond what its author intended [6]. ## What you do The steps below follow the recommendations of the sources. - Limit access to location. For apps that need it, CISA advises restricting this access to the times when the app is in use [4]. It recommends looking in particular at apps that access the camera, storage and location [4]. - Check permissions. Review the permissions of each app, remove those that are not necessary and consider deleting apps that ask for too much [4]. - Set privacy. Ask who can see a post and whether the options are configured so that only the intended people can access it [5]. Recheck these settings regularly, as they can be changed without your knowledge [6]. - Sort what you say. Do not share personal or sensitive information that could be used to cause harm, and use discretion when talking about your work, as it can harm the employee and their company [6]. The NCSC invites people to distinguish what close contacts need to know from unnecessary details that could be useful to criminals [5]. - Keep track of what others say about you: friends, colleagues and contacts [5]. - Do not answer a stranger's questions about the company. CISA advises being wary of calls, visits or emails that ask about employees or internal information, and verifying the person's identity directly with the company [7]. ## Pitfalls The first pitfall is the digital footprint, that is, all the information available online about a person. The NCSC explains that criminals can use it to steal an identity or to make phishing messages more convincing [5]. The second is the false impression of a closed circle: a post can escape its author even among a chosen audience [6]. The third is the fake contact. An attacker can pose as a new employee, a repairer or a researcher and, failing to obtain enough information from one person, contact another person in the same organization, relying on what the first one said [7]. Published details can make this story more believable. The fourth comes from hijacked accounts: contacts can share malicious content without knowing it, especially if their account was hijacked without their knowledge [6]. Finally, connecting an app to a social media account allows the app to collect information from that account, and the reverse [4]. The sources advise checking the permissions before accepting [4][6]. ## What to do if a post causes a problem To have an embarrassing or compromising post removed, Cybermalveillance.gouv.fr refers to the CNIL's advice [6]. To report illegal content, it points to the Internet-signalement.gouv.fr platform [6]. If sensitive company information has been disclosed, CISA advises notifying the appropriate people in the organization, including network administrators [7]. ## Sources 1. MITRE ATT&CK, "Search Open Websites/Domains: Social Media, Sub-technique T1593.001 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1593/001/ (accessed 3 November 2026) 2. MITRE ATT&CK, "Gather Victim Org Information, Technique T1591 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1591/ (accessed 3 November 2026) 3. MITRE ATT&CK, "Gather Victim Host Information, Technique T1592 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1592/ (accessed 3 November 2026) 4. CISA, "Privacy and Mobile Device Apps | CISA", 18 December 2022. https://www.cisa.gov/news-events/news/privacy-and-mobile-device-apps (accessed 3 November 2026) 5. NCSC (UK), "Social Media: how to use it safely", 24 January 2019. https://www.ncsc.gov.uk/guidance/social-media-how-to-use-it-safely (accessed 3 November 2026) 6. Cybermalveillance.gouv.fr, "La sécurité sur les réseaux sociaux", 22 November 2019. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/reseaux-sociaux (accessed 3 November 2026) 7. CISA, "Avoiding Social Engineering and Phishing Attacks | CISA", 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/exif-geolocation-social-media-photos/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.