"We resize every upload, so the metadata is gone" is a reasonable belief, held widely, and true or false depending entirely on which library does the resizing. To measure the difference we built a source image carrying six identifying tags and a set of GPS coordinates, put it through eight operations people actually perform, and re-read each result to see what survived.

The source, and the control

source image:   6 identifying tags   4 GPS tags

The identifying tags are make, model, software, artist, copyright and timestamp. The coordinates are a real latitude and longitude pair in the ordinary GPS sub-block.

The first operation tested is a plain file copy, which must preserve everything. It does — six and four. That is the control. Without it a row reading "zero tags" would be indistinguishable from a reader that simply could not find them.

What each operation does

operation                                  identifying   gps
plain file copy (control)                            6     4
re-saved with Pillow, no exif argument               0     0
re-saved with Pillow, exif passed through            6     4
resized with Pillow                                  0     0
converted to PNG                                     0     0
converted to WebP                                    0     0
ImageMagick convert                                  6     4
ImageMagick convert -strip                           0     0

The two library rows have opposite defaults. Pillow drops everything unless you explicitly hand the metadata back to it. ImageMagick keeps everything unless you explicitly tell it not to.

Both of those commands are, in the mind of whoever wrote them, "convert an image". Neither default announces itself at the call site, and the difference between them is a set of coordinates.

The GPS row is the one that matters

Of the operations tested, three carried the coordinates through: the file copy, ImageMagick's default convert, and Pillow when the metadata was deliberately preserved.

The middle one is the accident. A pipeline that takes an upload, converts it with ImageMagick, and writes the result to a public directory has published the location the photograph was taken, and every step in that sentence looks like ordinary image handling.

The risk is real but conditional, and the version people repeat is usually missing the conditions. Modern phones frequently do not write GPS unless location access was granted to the camera, and several social platforms strip metadata on upload. None of those conditions is one a site operator controls or can see.

Format conversion is not a strategy

Converting to PNG or WebP dropped everything here, which makes conversion look like a reliable cleaner. It is not, and this table slightly flatters it.

Both formats can carry metadata — PNG in text chunks, WebP in EXIF and XMP chunks — and whether it survives depends on the library and the version. What was measured is that these tools, at these versions, did not carry it across. That is a fact about the tools, not about the formats — and it is the kind of default that changes in a minor release without anybody noticing.

What to do

Strip explicitly, and never rely on a side effect. If metadata should not survive, remove it in a step whose only purpose is removing it — -strip in ImageMagick, or saving without passing the EXIF object in Pillow. A resize that happens to drop it today is a coincidence, not a control, and depending on it means depending on a default somebody else maintains.

Then verify, on the output. Read the file you actually wrote and assert the tags are gone. This is three lines, it runs in a test, and it is the only part of the process that will still be true after the next dependency upgrade.

Decide what should survive. Stripping is not automatically correct. Photographer attribution and copyright are metadata you may be obliged to keep, and a blanket strip removes those along with the coordinates. The useful policy names the tags to remove rather than removing everything by default.

And do it on ingest. Metadata removed when the file arrives is removed once. Wait until render time and the original has already been stored, backed up, and possibly served with everything intact.

How this was measured, and what it does not establish

One synthetic source JPEG carrying six identifying tags and four GPS tags, eight operations, each output re-read with the same reader, with a byte copy as a control. Pillow 11.3.0 and the ImageMagick build on this machine.

Synthetic is the right instrument here. The question is what the operations do, not what any photograph contains, and a constructed source makes the before state exact rather than approximate.

Versions decide this, and they change. Defaults around metadata have shifted between releases of both libraries. Every row above should be re-measured on the stack you actually run rather than inherited from this table — which is a two-minute job and the entire point of writing the harness down.

Only EXIF was tracked. XMP and IPTC live in separate blocks with their own survival rules. An operation that drops EXIF may keep XMP, so a clean EXIF read proves only that the EXIF block is empty. It does not prove the file is clean.

What a library ends up holding after all this is a separate question, and counting it turned out to be harder than expected.