forensics.media Subscribe
Image

What GPS EXIF tags reveal about location

By The forensics.media team
6 min read
Contents

When location services are on, a phone or GPS-equipped camera writes far more than a pair of coordinates into a photo. The Exif standard reserves a whole directory of GPS tags, 32 of them, covering latitude, longitude, altitude, the direction the camera faced, the speed it was moving, the satellite fix quality and the exact UTC time of the fix (CIPA, 2023). Read together they can place a device on a map to within metres at a stated moment. Read carefully, they are still unsigned metadata: everything below is a claim the file makes, not a fact the file proves, and its numerical precision is not the same as accuracy.

The GPS block is its own directory in the file

EXIF stores location data in a dedicated sub-directory of tags, the GPS IFD, separate from the camera and exposure fields and defined field-by-field in the CIPA DC-008 standard (CIPA, 2023). A device writes it only when it has a location fix available and its software is permitted to record one; EXIF compliance never requires a photo to carry coordinates. Any metadata viewer surfaces the block when present, and its richness surprises people, because the directory was designed to carry whatever the positioning receiver knows, not just a point.

GPS tag(s)What it recordsWhat it reveals
GPSLatitude / GPSLongitude + RefDegrees, minutes, seconds with N/S and E/W markersA map pin, at best to within metres
GPSAltitude + RefHeight relative to the reference surface, the ellipsoid or optionally sea levelElevation: which floor, hillside or flight
GPSTimeStamp + GPSDateStampUTC time and date of the satellite fixWhen the fix was taken, in UTC, independent of the camera clock
GPSImgDirection + RefHeading 0 to 359.99 degrees, true or magnetic northWhich way the camera was pointing
GPSSpeed + RefSpeed of the receiver in km/h, mph or knotsWhether the device was walking, driving or flying pace
GPSDOPDilution of precision (HDOP in 2D, PDOP in 3D fixes)How favourable the satellite geometry was

How the coordinates are actually stored

Latitude and longitude are each stored as three rational numbers, degrees, minutes and seconds, paired with a one-letter reference tag giving the hemisphere, N or S for latitude, E or W for longitude (CIPA, 2023). A reader combines them into the signed decimal coordinates a map uses. Altitude is a single value in metres with its own reference tag; in the Exif 3.0 standard that reference is the ellipsoidal surface, with sea level available as an alternative setting (CIPA, 2023). The format matters forensically for one reason: it is plain, editable structure. Nothing in the encoding authenticates the values, and a coordinate written by a phone’s GPS receiver is byte-for-byte indistinguishable from one typed in afterwards, a point demonstrated in can EXIF data be faked?.

The fields beyond the pin

The secondary fields are where a file volunteers more than its author probably realised. GPSImgDirection records the compass heading the lens faced, which can distinguish a photo of a building from a photo taken from it, and which becomes a consistency test when a heading points away from the landmark the picture shows. GPSSpeed above walking pace says the image was captured from a vehicle. GPSTimeStamp and GPSDateStamp carry the time of the satellite fix in UTC, written by the receiver rather than the user-settable camera clock, which makes them a quiet cross-check on the file’s own DateTimeOriginal: the two should agree once time zone is accounted for, and a mismatch is a finding. GPSDOP records the receiver’s own estimate of fix geometry, so a file can hint at how much to trust its own pin (CIPA, 2023).

One limit is structural: the coordinates describe the recording device, not the subject. A telephoto shot tags where the camera stood, which may be kilometres from the building, person or landscape in the frame. The GPS block locates the photographer, and only sometimes the scene.

Precision is not accuracy

The rational coordinate fields can encode more decimal detail than any map display needs, so converted coordinates often look accurate to a few metres. That numerical resolution is not a guarantee. The true error depends on the receiver, the satellite geometry, obstructions, multipath reflections and how recently the fix was obtained. A phone surrounded by tall buildings can write extremely precise-looking coordinates that are physically wrong by a street or more. Altitude is usually looser than horizontal position, heading may come from a magnetic sensor rather than the optical axis, and speed describes the device around the time of the fix, not necessarily the motion during the exposure. Every value is a claim carrying its own acquisition uncertainty, and the EXIF field reports what the device recorded, not an independently measured confidence interval.

From coordinates to a place name

Raw coordinates become human-readable through reverse geocoding. ExifTool, the standard metadata reader, bundles a GeoNames-derived geolocation database and resolves coordinates to the nearest city, region, country and time zone as composite output fields (ExifTool, no date). The lookup is a nearest-place calculation, so its resolution is bounded by the database’s density, and coverage is thinner in rural and non-Western areas (ExifTool, no date). The place name is a convenience layered on the coordinates and inherits all of their weaknesses; it is a database interpretation, not a label the camera wrote.

The reliability ceiling

Three structural facts cap what GPS tags can prove. First, location tagging is off unless enabled, and most photos that travel the internet carry no GPS at all because major platforms strip metadata on upload, so an absent GPS block is the normal state of a shared image and proves nothing, as covered in does a screenshot or upload remove a photo’s metadata?. Second, every field in the block can be rewritten or invented with free tools in seconds, because ordinary EXIF carries no cryptographic protection. The founding caution of sensor forensics applies: Lukáš, Fridrich and Goljan (2006) set metadata aside as evidence precisely because of “the credibility of information that can be easily replaced.” Third, even genuine values describe the receiver’s fix, not ground truth.

The forensic posture follows from the structure. A GPS block is the most precise lead a photo can offer and among the least trustworthy on its own, so its value is realised only when the coordinates, the heading, the UTC fix time and the visible scene are checked against one another. Field values that agree with each other and with the picture are meaningful support; a pin, alone, is a sentence the file says, not one it can prove. How an investigator actually corroborates the where and the when, using the scene as well as the file, is the wider subject set out across the metadata cluster starting from what does EXIF data actually reveal about your photo?.

Sources

  • Camera and Imaging Products Association (2023) Exchangeable image file format for digital still cameras: Exif Version 3.0, CIPA DC-008-2023. Available at: https://www.cipa.jp/std/documents/e/DC-008-Translation-2023-E.pdf (Accessed: 22 July 2026).
  • ExifTool (no date) ExifTool geolocation feature and GPS tags. Available at: https://exiftool.org/geolocation.html (Accessed: 22 July 2026).
  • Lukáš, Fridrich, Goljan (2006). Digital Camera Identification from Sensor Pattern Noise. IEEE Transactions on Information Forensics and Security 1(2):205-214. DOI: 10.1109/TIFS.2006.873602
#exif#gps#metadata#geolocation#image