Delete GPS, and AI Can Still Find You

On August 17, a test published by McAfee Labs brought photo privacy concerns back into focus: across a set of travel photos, AI was able to identify where the images were taken 87%–91% of the time using only visual clues in the images. Whether the photos retained GPS data or EXIF location fields was no longer the deciding factor.

Models examine architectural styles, road markings, storefront signs, vegetation, mountain silhouettes, river courses, and even hotel room decor and views from windows. Work that once required skilled investigators to conduct repeated searches and cross-checks can now be compressed into minutes by multimodal models—and some tools need only seconds.

This is not because AI has suddenly learned to “read minds,” but because visual recognition, OCR, geographic knowledge, and image retrieval capabilities have finally been connected. Individually, none of these clues is especially reliable. Combine dozens of weak signals, however, and the possible location quickly converges.

That said, 87%–91% should not be interpreted simply as “any photo has a 90% chance of being pinpointed to exact coordinates.” It is better understood as a warning about risk than as a universal benchmark for comparing every model. What developers truly need to recognize is that photo geolocation has evolved from a niche computer vision task into a capability that general-purpose vision models can perform at low cost.

What Exactly Does AI See in a Photo?

Traditional photo geolocation mainly followed two approaches. One was to read GPS coordinates directly from EXIF data. The other was to match well-known landmarks, such as the Eiffel Tower, the Oriental Pearl Tower, or a stadium with a distinctive shape. The former can easily be defeated by metadata removal tools, while the latter applies only to a small number of “easy questions.”

Modern visual geolocation is more like a multi-clue investigation.

1. OCR Is the Most Direct—and Most Easily Underestimated—Entry Point

Store names, road signs, bus stops, vehicle advertisements, menus, and parking payment signs can all reveal language and administrative-region information. Even when text is tiny, tilted, or only partially visible, modern vision models may be able to recover keywords and then combine them with search or map data to narrow the possibilities.

The useful clue does not necessarily have to be a complete address. Sometimes the name of a chain store, an area code, or a particular road-numbering format is enough to eliminate most countries and cities.

2. Road Systems Act Like a City’s “Visual Fingerprint”

The colors of road centerlines, curb markings, traffic-light designs, road-sign fonts, license-plate aspect ratios, and the side of the road on which vehicles travel all have strong regional characteristics.

A person may see only “an ordinary road,” while a model can simultaneously compare:

• Whether traffic drives on the left or right;
• Whether road markings use white, yellow, or a combination of colors;
• What colors, fonts, and mounting methods road signs use;
• Whether utility poles, fire hydrants, and manhole covers match styles commonly found in a particular place;
• Whether the surrounding mix of cars and motorcycles aligns with the local transportation system.

These details may not identify a city on their own, but they can often classify the country or broader region first.

3. Architecture and the Natural Environment Narrow the Search Further

Roof pitch, exterior wall materials, balcony structures, air-conditioner installation conventions, and building density can help a model infer the climate zone and urban form. Vegetation, soil color, coastlines, mountain silhouettes, and shadows cast by the sun provide additional information about latitude, season, and terrain.

Even a beach photo without recognizable landmarks is not necessarily safe. The color of the sand, tidal patterns, coastal vegetation, outlines of distant islands, and styles of umbrellas and lifesaving equipment can all become retrieval features.

4. Retrieval and External Data Turn “Guesses” Into “Verification”

General-purpose multimodal models usually begin with a semantic assessment, such as “a coastal city in Southeast Asia” or “possibly northern Portugal.” Specialized systems may also compare image embeddings against large-scale databases of street-view images, travel photos, or maps to find visually similar candidate locations.

The difference between these capabilities can be described as follows:

• A multimodal model is like a well-traveled investigator who excels at reasoning from general knowledge;
• A visual place-recognition system is like a researcher with an enormous archive who compares images one by one and excels at finding similar scenes.

When combined, the system can estimate a region even without an identical reference image, while a match with similar street imagery can narrow the error to a neighborhood or an even smaller area.

87%–91% Is High, but Do Not Misread the Metric

This number is highly shareable—and highly susceptible to misunderstanding.

First, “identifying a location” could mean identifying a country, a city, a tourist attraction, or a point within a particular radius. Recognizing “Japan” is clearly not as difficult as identifying “a particular hotel in Tokyo.” Without also specifying spatial granularity, Top-K accuracy, and error radius, a single accuracy figure cannot fully describe a system’s capabilities.

Second, the composition of the test set has a major impact on the results. Travel photos generally contain more landmarks, signs, cityscapes, and public infrastructure than random family photos, making them inherently rich in geographic clues. If the photos come from popular tourist cities, the model may also benefit from high-frequency images in its training data.

Third, models use prior probabilities. A tropical beach photo may first be attributed to one of the most common resort destinations seen on social platforms. This works well when the test-set distribution resembles public internet data, but accuracy may fall significantly for remote regions, indoor photos, or images deliberately composed to avoid geographic clues.

Developers evaluating similar systems should therefore record at least:

• Country-level, city-level, and neighborhood-level accuracy;
• Top-1, Top-3, and Top-5 accuracy;
• Median geolocation error and its long-tail distribution;
• Performance across scene categories such as streets, hotels, beaches, mountains, and indoor environments;
• Performance differences depending on whether readable text or famous landmarks are present;
• The proportion of cases in which the model refuses to answer or expresses low confidence.

A system that always provides a specific city even when uncertain may appear “smarter” than a cautious model, but it may actually generate large numbers of high-confidence hallucinations. For geolocation, knowing when to refuse is just as important as guessing correctly.

The Real Danger Is the Automated Attack Chain

Determining that a particular travel photo was taken in Paris is nothing new. People familiar with open-source intelligence investigations have long been able to do similar work using maps, street-view imagery, and search engines. What AI changes is the cost, speed, and scale.

Attackers no longer need to inspect photos one by one. They can scan public accounts in bulk, extract recent locations, travel patterns, and frequently visited places, and combine that information with public personal profiles. The risk therefore escalates from “a photo might leak a location” to “location clues can automatically enter a fraud workflow.”

A typical scenario might work like this: a user posts vacation photos in real time. The images contain no location tags, but they show hotel decor, local businesses, or airport facilities. Once a system determines that the user has just arrived in a particular city, an attacker sends a fake bank security alert claiming that a suspicious card transaction occurred there.

A generic phishing text might say only, “Your account is at risk.” A highly targeted version, however, can include a location and time that match the user’s itinerary. It does not need to identify the exact room number. A correct city-level assessment alone may be enough to make the message significantly more convincing.

Visual geolocation can also be combined with data such as:

• Post publication times and time zones;
• Permanent residences or workplaces visible in historical photos;
• Public itineraries for flights, performances, conferences, and other events;
• Names, employee badges, and vehicle information visible in images;
• Photos of the same scene posted by friends’ accounts;
• Phone numbers or email addresses exposed in data breaches.

Privacy risks often come not from a single “magical model,” but from multiple ordinary capabilities assembled into a pipeline. OCR, image classification, search, map retrieval, and text generation have all become highly commoditized, and the cost of combining them is far lower than it was a few years ago.

Removing EXIF Still Helps, but It Is Far From Enough

GPS and EXIF data should still be removed. Structured coordinates provide zero-cost, unambiguous information; if they remain, an attacker does not even need to invoke a vision model. But treating metadata removal as a complete protection strategy is now outdated.

The photo-upload pipeline can be divided into three layers of risk:

1. File layer: Metadata such as GPS data, device model, capture time, and thumbnails;
2. Pixel layer: Signs, addresses, receipts, views through windows, reflections, and landmarks;
3. Context layer: Publication time, captions, account history, companions’ posts, and social relationships.

Most platforms address only the first layer. Some also compress images, but few proactively identify and obscure location clues. Compression is not reliable protection: it may make small text harder to read, but building outlines, road layouts, and large signs remain visible. As models improve at understanding low-resolution images, “too blurry to see after compression” increasingly does not mean “impossible for a machine to recognize.”

Likewise, simple cropping can backfire. If the cropped image happens to retain a storefront sign or distinctive building, the model may focus even more attention on that crucial region.

For Developers, Protection Cannot Rely on a Single Safety Warning

If a product allows users to upload and publicly share images, visual geolocation should be incorporated into its privacy threat model rather than continuing to be treated as an edge case.

Upload Stage: Remove Structured Information by Default

Before storing images, the server should remove unnecessary EXIF data, GPS information, device serial numbers, and original thumbnails. It should also verify that transcoded derivatives do not reintroduce those fields. Original and public versions of an image should use different permissions and storage policies.

Capture time also deserves attention because it may be cross-referenced against other public itinerary information. Even without coordinates, a timestamp accurate to the second may still constitute sensitive information.

Publishing Stage: Add Location-Exposure Detection

Before publication, platforms can run a low-cost risk-detection pass to identify:

• Addresses, road signs, hotel names, and boarding passes;
• Employee badges, license plates, shipping labels, and receipts;
• Highly recognizable landmarks and views through windows;
• Reflected content in mirrors, glass, and screens.

The goal is not to force users to redact content, but to provide specific warnings when the risk is high—for example, “The upper-right corner of the image contains an identifiable hotel name,” rather than the vague “Please be mindful of your privacy.” Only specific warnings give users something actionable.

Permission Design: Reduce Bulk Collection Capabilities

Rate-limiting access to public images, preventing unauthorized bulk scraping, and restricting access to original files will not stop every attack, but they can raise the cost of automated collection. Content involving children, home addresses, or real-time travel should use more conservative default visibility settings.

Platforms should also guard against search interfaces becoming reverse-geolocation tools. For example, allowing external users to run unlimited visual-similarity searches against a public image library could turn previously scattered location clues into a queryable database.

Model Design: Return Candidates Instead of Pretending to Be Certain

For legitimate geographic analysis, content moderation, or disaster-response tools, the recommended approach is to return candidate regions, confidence levels, and types of evidence rather than only a single pair of coordinates.

A more responsible result should explain what the model observed, which clues support its conclusion, how large the potential error may be, and whether multiple similar locations exist. For sensitive locations such as homes, schools, and medical facilities, the system should also reduce output precision or require stricter authorization.

The Most Effective Step for Ordinary Users: Delay Posting

In practice, avoiding real-time photo posts while traveling is often more effective than complex image processing. If users wait until their trip has ended, even a model that identifies the city will have difficulty inferring their current location.

Several other low-cost measures can also help:

• Restrict who can see travel posts instead of making them fully public;
• Check image edges, reflections in glass, and views through windows;
• Obscure hotel names, room numbers, boarding passes, and vehicle information;
• Avoid posting a sequence of photos that can be combined into a complete route;
• Disable camera location permissions and remove metadata before sharing;
• Exercise greater caution with photos involving homes, schools, and children’s activity locations.

None of these measures can guarantee that an image is “absolutely impossible to locate.” A reasonable goal is not to create an image completely devoid of regional characteristics, but to reduce high-value clues, break temporal correlations, and increase the cost of bulk analysis.

This Capability Is Useful, but It Must Be Treated as Sensitive

Visual geolocation does not have only negative applications. It can be used to verify disaster imagery, fact-check news, search for missing persons, update maps, monitor wildlife, and organize historical photographs. The issue is not whether models can understand locations, but who is allowed to use them, what data they may process, and how precise their outputs should be.

From the perspective of technological development, location recognition will not disappear because of privacy controversies. The OCR, fine-grained visual understanding, and cross-image reasoning capabilities of multimodal models continue to improve, while map and street-view databases are becoming increasingly comprehensive. Future progress may no longer appear as an increase in country-level accuracy from 90% to 92%. Instead, it may take the form of moving from “guessing the city” to “pinpointing the neighborhood,” or expanding from a single photo to jointly inferring a route from multiple images.

Developers should treat this 87%–91% test result as a signal: pixels themselves are now location data. In product design today, saying “we removed the GPS data” means only that the most basic step has been completed.

A more realistic security boundary requires systems to address metadata, visual content, publication timing, and access permissions together, while imposing precision limits, audit mechanisms, and refusal policies on sensitive geolocation capabilities. Otherwise, a photo-upload feature may appear to be merely a media module while actually becoming a data interface that continuously exposes users’ movements.

References

• ITHome: With 87%–91% Accuracy, AI Can Identify Where Photos Were Taken Using Visual Clues — Reports the results of McAfee Labs’ test of travel-photo geolocation capabilities and summarizes the associated privacy and targeted-fraud risks.