Hidden metadata in scanned ID and passport photos
Identity verification is everywhere now — open a bank account, sign up for a crypto exchange, rent an apartment, or apply for a gig-economy job, and sooner or later you're asked to photograph your driver's license or passport and upload it. Most people snap the photo and send it without a second thought. But that file can carry more than the picture of your ID.
What rides along in the photo
If you photographed the document with a phone, the image file can include the same metadata any phone photo carries: the exact GPS coordinates of where you took it, the device model, and the precise date and time. If you scanned it instead with a flatbed scanner or a scanning app, the file may carry the scanning device's serial number and software version rather than GPS.
None of this shows up when you look at the image — it's stored in a hidden data block inside the file, separate from the pixels. But it travels with the file wherever it goes: into the verification company's systems, and often into backups, logs, or third-party fraud-check services you never dealt with directly.
Why it matters here specifically
ID and passport uploads are already one of the most sensitive things you send online — the whole point is that the document proves who you are. Layering your home GPS coordinates or device identifiers on top, unnecessarily, adds risk without adding any verification value. If that upload is ever caught in a breach — and identity-verification vendors have been breached before — the metadata is extra information attackers didn't have to work for.
There's also a simpler reason to care: some verification services flag mismatches between the metadata's timestamp or location and other information you provided. Knowing what's actually in the file before you upload it means no surprises.
What scrub actually covers here
If your ID photo is a JPEG or PNG — which is how most phone camera and scanning apps save it — scrub removes the EXIF, GPS, XMP and any appended data the same way it does for any image, losslessly, entirely on your device. Nothing gets uploaded anywhere to do this.
If the document was saved or scanned as a PDF, scrub currently detects hidden metadata and embedded text in the file and shows you what's there — PDF cleaning isn't available yet, so treat a PDF scan as check-first for now, not clean-first. For a full strip before you send an ID upload, save or export it as an image and clean that.
The short version
ID and passport photos can carry GPS and device metadata you never meant to send along with your verification. Clean the image before you upload it, and check any PDF version for what's hidden inside. Get scrub free and see exactly what's in your next upload.