Instagram strips most EXIF on upload — but not consistently, and not from every surface (DMs, downloaded copies, third-party reposts). For privacy-sensitive accounts — journalists, activists, public figures, real estate agents shooting on-site — the safe default is to strip metadata locally before upload, not trust the platform to do it.
Instagram strips GPS from the visible post in most cases, but the original file you uploaded may still carry it for some surfaces — story downloads, "send original" DMs, third-party scrapers, and certain backup services. The platform's behavior also changes over time as their pipeline updates. The safest approach is to never let the GPS leave your device in the first place: strip it locally before upload.
GPS is the obvious one. But your photos can also leak: device serial number (BodySerialNumber tag — uniquely identifies your camera), software signature (Software tag — tells anyone what app you used), Artist / Creator (often defaults to your iPhone account name or your editor's user identity), and capture timestamps (DateTimeOriginal — tells when the photo was taken to the second). For sensitive content, strip everything except what you explicitly want to keep.
Open MediaMeta's metadata remover on your phone or laptop. Drop the photo (or share it from your camera roll on iOS). The remover walks the JPEG segments and drops EXIF, IPTC, and XMP blocks while leaving pixel data intact. Download the cleaned file. Open Instagram and post the cleaned version. The whole process takes under 30 seconds per photo, and under 2 minutes for a batch.
Both work. On iPhone, AirDrop the photo to MediaMeta in Safari, strip, AirDrop back. On Android, share the photo to Chrome → MediaMeta. On desktop, drag-and-drop. The stripping logic is identical because everything runs in your browser regardless of platform. For privacy-critical workflows, prefer your own device over a public/shared computer.