Asked from the Privacy sub-reddit (https://www.reddit.com/r/privacy/comments/6jllmv/privacy_risk_from_iphones_or_other_camera_phones/):
"Hi, I learned about EXIF data recently and decided to take a random picture on my iPhone 6 (iOS 10.3.2) and upload it to an EXIF data viewer website. I was surprised at how much information was present; the only info not present in the EXIF file was location data, because I have location services turned off for the camera on my iPhone.
So I wondered, because of the wealth of data on an EXIF file, would not a particular combination of data points on an EXIF file be unique to a device, meaning that that device can be fingerprinted using the EXIF data? Is this possible?
Let me provide a hypothetical scenario where this might pose a grave risk to privacy:
Person A is a relatively well-know journalist, married father of three.
Person A frequents a popular porn website where people upload intimate pictures of themselves, and A decides to upload pictures of his genitals taken on his iPhone. Only his groin area is shown, location services is off so A is content that the EXIF data has no location information, and so he happily uploads it.
Then, a while later, A goes on a trip with his family, takes a selfie, and uploads it to his Twitter account which uses his real name. Again, location services off, but obviously his public Twitter does not contain embarrassing information, so A happily uploads the photo showing his face and those of his family to his Twitter feed.
A few weeks later, a bunch of anti-Semitic trolls target A because he is Jewish. They download photos from Twitter, or from his Facebook profile where he also has some public photos, then analyse the EXIF data to come up with a unique fingerprint (wait, after finishing the rest of this post, I remembered that apparently Twitter removes EXIF data? Ok, well, just assume they don't for the sake of this story. In reality, I am sure there are other places hackers can go looking for pictures with EXIF data on them.). They search for photos with this unique fingerprint on the top 200 most popular sites, which includes the earlier mentioned porn site, and they discover his online sexual indiscretions, after a few weeks of running the automated script which searches for EXIF fingerprints.
They then use this information to blackmail him and extort money, following which they expose him anyway and email evidence of his private activities to his family, friends and the rest of the Internet.
Is that possible?
EDIT: PS-I'll admit Black Mirror's "Shut Up and Dance" episode inspired that hypothetical scenario :) "