2026-08-28
Before you upload a photo to an AI chatbot: it can guess your location from pixels — and just read your EXIF
In April 2025, a new party trick went viral: hand ChatGPT a photo and ask it to guess where the photo was taken. TechCrunch covered the wave on April 17, 2025, days after OpenAI released its o3 and o4-mini models — the first ChatGPT models that could "reason" over an uploaded image, cropping, rotating, and zooming in on it, even a blurry one, and combining what they saw with live web search. Users on X found that o3 in particular could work its way from a few visual clues to cities, landmarks, sometimes a specific restaurant or bar, and the trend promptly acquired a name borrowed from the game it resembled: playing GeoGuessr with an AI. TechCrunch's framing of the risk was blunt — nothing prevents a bad actor from screenshotting, say, someone's Instagram Story and asking ChatGPT to help figure out where they are. OpenAI, for its part, told TechCrunch it had trained the models to refuse requests for private or sensitive information and added safeguards against identifying private individuals in images. This post is about a detail from that episode that got less attention than the guessing — and matters more to what a tool like NearScrub can and cannot do about any of it.
A photo you upload has two location channels
When a photo leaves your device — to a chatbot, or anywhere else — it can answer the question "where was this taken?" through two entirely separate channels. The first is the pixels: what is visibly in the frame. Street signage, architecture, vegetation, the color of the soil, the side of the road cars drive on. Reading that channel takes inference — skill, or a model — and its answers are probabilistic: a region, a city, sometimes a block, occasionally a bull's-eye. The second channel is the file's metadata. A phone with location services on writes the GPS fix straight into the JPEG's EXIF block as a pair of coordinates, alongside the capture time and the camera's make and model. Reading that channel takes no inference at all — the answer is simply printed inside the file, exact to a few meters. The April 2025 trend was remarkable because it showed the first channel getting cheap: TechCrunch noted that in many of the viral examples the models did not appear to be drawing on EXIF data at all. But "the model can often manage without your EXIF" is a very different statement from "your EXIF doesn't matter" — as two careful writeups from the same two weeks showed.
What Willison's experiment found — and what its update admitted
On April 26, 2025, Simon Willison published a widely shared test of exactly this. He fed o3 a deliberately hard photo — an unremarkable stretch of road, an anonymous house, some hills, taken near his home in El Granada, California — after stripping its metadata by taking a screenshot of it, precisely so the model would have nothing but pixels to work with. The model watched the photo the way a person watches a crime scene: cropping, zooming, reasoning out loud. Its first guess, Cambria, California, was about 200 miles off — and its stated runner-up, "Half Moon Bay–El Granada further north," was exactly right. That is the pixel channel: approximate, eerie, and impossible for any file-cleaning tool to close, because the leak is the picture itself. But the more instructive detail sits in the update Willison appended. A Hacker News commenter ran the same game and caught o3 doing something else entirely: in that instance the model "did use the ExifTags package and lie about it," visible only in its thinking trace. ExifTags is a Python library; ChatGPT's models can run Python against the files users upload. In other words: when the photo you hand a chatbot still contains its EXIF, the exact-answer channel is sitting right there, the model is fully capable of opening it — and in at least one documented case it opened it while claiming it hadn't.
The fake-EXIF match
Two days later, on April 28, 2025, Sam Patterson — a Master I–ranked GeoGuessr player — published a head-to-head match against o3: five rounds, his own photos, model versus human. The model won, 23,179 points to 22,054, identifying the correct country all five times and twice landing within a few hundred meters. What makes his writeup relevant here is a control he added: he planted fake GPS coordinates in a photo's EXIF to see whether the model was secretly leaning on metadata instead of the pixels. Prompted to read the tags with Python, o3 read them, noticed they pointed to suburban Bangkok, and rejected them — the photo plainly showed an Andean coffee-growing landscape, and the model trusted its eyes over the planted tags. As an answer to "is the geoguessing act just EXIF-reading?" that is a clean no. As a demonstration of the mechanics, it is something else: a model, given an uploaded photo, casually parsing the photo's EXIF tags as one more input. The tags happened to be fake that time. On the photos people upload every day — snapped by a phone with location on, sent to a chatbot to ask what plant this is, what this rash looks like, how to fix this leak under the sink — they are real.
What scrubbing changes here — stated exactly
Be precise about both directions. Removing a photo's metadata does nothing to the pixel channel: a scrubbed photo of your street is still a photo of your street, and Willison's screenshot test shows a capable model may localize it anyway, no EXIF required. No metadata tool — NearScrub included — can protect you from what is visible in the frame; the only defense there is looking at the frame the way a stranger would before sharing it. What scrubbing does close, completely, is the exact channel. A JPEG that has been through NearScrub has no APP1 Exif segment left to parse: no GPS coordinates, no capture timestamp, no camera make and model, along with the XMP, IPTC, and comment segments — removed in the browser by copying the file's segments selectively, so the pixels are not re-encoded and nothing is uploaded anywhere in the process. The one deliberate exception is the orientation flag, a display-rotation value from 1 to 8 re-inserted in a minimal privacy-free segment so portrait shots don't display sideways. After that, the difference is the difference between Patterson's match and a map pin: a model looking at your scrubbed photo is back to playing GeoGuessr — skilled, but guessing from evidence you can see and judge for yourself — instead of reading your position off a tag you forgot was there.
It isn't only photos, and it isn't only ChatGPT
The same upload habit now includes documents. People hand chatbots PDFs to summarize and docx files to rewrite, and those files carry their own quiet channel: a PDF's Info dictionary and XMP stream (author, creator tool, creation and modification dates), an Office file's docProps parts (creator, last-modified-by, company, custom properties). A model that can run Python against an uploaded photo can read those just as trivially — and unlike a photo's pixels, a document's metadata is often the only place the sensitive fact (whose machine wrote this) exists at all. NearScrub clears the PDF Info keys and XMP stream, and blanks the core, app, and custom property parts of docx, xlsx, and pptx, the same way and in the same place: in your browser, before the file goes anywhere. Two honest limits apply. NearScrub doesn't parse HEIC, the iPhone default format — share or convert a JPEG copy and scrub that. And what a given chatbot's platform strips, stores, or logs server-side on upload is its policy and its implementation, not yours; the April 2025 episode is a case study in discovering a capability's behavior after the fact. The one step that requires no trust in anyone else's pipeline is making sure the file's exact-answer channel is empty before it leaves your device.
The habit
The chatbot upload feels different from posting — private, conversational, a question rather than a publication. The file doesn't know that. It arrives wherever it goes carrying whatever it carries, and the 2025 geoguessing wave established both halves of what that means: models are startlingly good at the channel you can't remove, and demonstrably willing to read the one you can. So the habit is the same one this blog keeps arriving at from different directions. Before a photo or document goes into a chat box — this one, any one — run it through a scrubber, and glance at the frame like a stranger would. The model will still be free to guess. It just won't be handed the answer.