Cyberpediaby Brain
ENDEFR

Geolocation and metadata in published photos

What a social media post reveals about an employee's workplace and habits, and the steps that limit this exposure.

In 30 seconds

Where it happens
On social media, where a post can reveal the roles, locations and interests of an organization's staff1.
What the attacker wants
To gather details about the company and its employees to target an approach better2.
The reflex
Before posting, ask what the photo or the text tells a stranger about the workplace, working hours or organization.
If it's already done
Check the privacy settings6, and notify the appropriate people in the organization, including network administrators, if sensitive information has been disclosed7.

What it is

A photo published online shows what it depicts, but it also says where, when and in what context its author works. Social media sites contain information about an organization, including company announcements as well as the roles, locations and interests of its staff1. Attackers consult them to prepare their approaches.

This article covers the exposure of the employee who posts: workplace, working hours, equipment, role. The sources gathered for this file describe this exposure and the settings that reduce it. They do not detail the technical content of the EXIF metadata of an image file or how each network handles it, so these points are not asserted here.

Straight answers

Why does an innocuous post interest an attacker?

Because information about an organization also circulates through social media: department names, how the business operates, roles and responsibilities of key employees2. MITRE classes this collection under the reconnaissance tactic2. This information can open the way to other forms of reconnaissance, to account creation and to initial access, for example through phishing2.

What does the attacker do with this information?

They can collect the data passively. They can also use it to create fake profiles or fake groups to get victims to reveal specific information1. MITRE cites the case of EXOTIC LILY, which copied social media data to impersonate targeted people1.

Can the devices themselves give away information?

Yes. Information about a victim's workstations and devices (configuration, operating system, language) can also be exposed by data accessible online, including social media3.

Can this collection be prevented?

Not entirely. MITRE writes that this technique cannot easily be prevented with preventive controls, because it relies on behaviors outside the enterprise's defenses. Efforts should aim to reduce the amount and sensitivity of data available to third parties1. The employee therefore acts upstream, on what they post.

1How it works1 min

A post has two parts: what is put in it deliberately and what the device or the application attaches to it. For the second, the sources document the role of mobile apps. An app can ask for access to personal data on the device, including location data. Developers then have access to it and can share it with third parties, for example companies that target advertising by position and interests4. Some apps give access to the user's approximate physical location4.

On the social network side, visibility settings are often wide open by default: data can be shared with all followers6. Even in a circle believed to be restricted, a post can be reshared or interpreted beyond what its author intended6.

2What you do1 min

The steps below follow the recommendations of the sources.

  • Limit access to location. For apps that need it, CISA advises restricting this access to the times when the app is in use4. It recommends looking in particular at apps that access the camera, storage and location4.
  • Check permissions. Review the permissions of each app, remove those that are not necessary and consider deleting apps that ask for too much4.
  • Set privacy. Ask who can see a post and whether the options are configured so that only the intended people can access it5. Recheck these settings regularly, as they can be changed without your knowledge6.
  • Sort what you say. Do not share personal or sensitive information that could be used to cause harm, and use discretion when talking about your work, as it can harm the employee and their company6. The NCSC invites people to distinguish what close contacts need to know from unnecessary details that could be useful to criminals5.
  • Keep track of what others say about you: friends, colleagues and contacts5.
  • Do not answer a stranger's questions about the company. CISA advises being wary of calls, visits or emails that ask about employees or internal information, and verifying the person's identity directly with the company7.
3Pitfalls1 min

The first pitfall is the digital footprint, that is, all the information available online about a person. The NCSC explains that criminals can use it to steal an identity or to make phishing messages more convincing5.

The second is the false impression of a closed circle: a post can escape its author even among a chosen audience6.

The third is the fake contact. An attacker can pose as a new employee, a repairer or a researcher and, failing to obtain enough information from one person, contact another person in the same organization, relying on what the first one said7. Published details can make this story more believable.

The fourth comes from hijacked accounts: contacts can share malicious content without knowing it, especially if their account was hijacked without their knowledge6.

Finally, connecting an app to a social media account allows the app to collect information from that account, and the reverse4. The sources advise checking the permissions before accepting46.

4What to do if a post causes a problem1 min

To have an embarrassing or compromising post removed, Cybermalveillance.gouv.fr refers to the CNIL's advice6. To report illegal content, it points to the Internet-signalement.gouv.fr platform6. If sensitive company information has been disclosed, CISA advises notifying the appropriate people in the organization, including network administrators7.

Fact sheet

Identifier
CP-341
Wing
5. Office life and reflexes
Brain skill
Safe Web Browsing (browse_safely)
Brain reflex
cr-058
Diagram
G2 · Visual vs Technical Indicators
Languages
de, en, fr
Sources
7 sources checked on 3 November 2026
Sources7 sources
  1. MITRE ATT&CK, “Search Open Websites/Domains: Social Media, Sub-technique T1593.001 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1593/001/ (accessed 3 November 2026)
  2. MITRE ATT&CK, “Gather Victim Org Information, Technique T1591 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1591/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “Gather Victim Host Information, Technique T1592 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1592/ (accessed 3 November 2026)
  4. CISA, “Privacy and Mobile Device Apps | CISA”, 18 December 2022. https://www.cisa.gov/news-events/news/privacy-and-mobile-device-apps (accessed 3 November 2026)
  5. NCSC (UK), “Social Media: how to use it safely”, 24 January 2019. https://www.ncsc.gov.uk/guidance/social-media-how-to-use-it-safely (accessed 3 November 2026)
  6. Cybermalveillance.gouv.fr, “La sécurité sur les réseaux sociaux”, 22 November 2019. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/reseaux-sociaux (accessed 3 November 2026)
  7. CISA, “Avoiding Social Engineering and Phishing Attacks | CISA”, 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026)

Cite this article

Brain, “Geolocation and metadata in published photos”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/exif-geolocation-social-media-photos/

BibTeX 
@misc{brain_cp341_en_2026,
  author = {Brain},
  title = {Geolocation and metadata in published photos},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/exif-geolocation-social-media-photos/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence