Camera Serial Number Privacy in EXIF

A camera serial number in EXIF identifies the individual physical device that took a photo — and, when paired with a lens serial, the individual lens as well. It does not contain your address, your name, or your location. What it does contain is a stable, unique, non-resettable identifier for a piece of hardware you own, written into every frame that device produces, which is exactly what makes it valuable to an investigator or a tracker. Here is where those numbers hide, what they can be used for, and how to remove them.

What a serial number is (and is not)

A camera body serial number is a string like 3902118 or 4129901 printed on the base of the body and duplicated into metadata. A lens serial number is a similar string on the lens barrel, written by the lens itself. Both are assigned by the manufacturer, and both are unique (or close enough to unique) to identify one unit among millions.

What the serial number reveals:

• The exact make and model of the body, when combined with the standard Make and Model tags.
• That two photos came from the same physical camera, and in some cases the same physical lens.
• A hardware-level fingerprint that survives account deletion, cookie clearing, new email addresses and new social media handles.

What it does not reveal: your address, your name, your employer, or where the camera is right now. The serial number is a key, not a location. Someone with the key still has to look the key up — against a purchase record, an insurance policy, a police report, a retailer’s stolen-gear database, or a leaked marketing database. That said, that lookup is trivial, and the people most likely to run it (police, insurers, claimants, thieves) are exactly the people you would not want running it.

Where serial numbers live in EXIF

Tag	Where it lives	What it identifies	Risk
0xA431 BodySerialNumber	Exif SubIFD	The individual camera body	High — hardware fingerprint, links photos to one device
0xA435 LensSerialNumber	Exif SubIFD	The individual lens	High — same, plus identifies valuable optics
0xA402 CameraSerialNumber	MakerNote (vendor block)	Duplicated copy of the body serial	High — survives a naive tag-level strip
0xA434 CameraOwnerName	Exif SubIFD	The registered owner, as typed into the camera	Critical — a person’s name
MakerNote copies (e.g. Canon 0x0001, Nikon 0x001D, Sony 0xB020)	MakerNote blob	Vendor-specific duplicates, often with internal build info	High — hidden from simple readers
0x001C HostComputer	IFD0	The computer the file was last saved on	Medium — reveals a machine name
0x9286 UserComment	Exif SubIFD	Free-text; often a device or app identifier	Medium
0xA420 ImageUniqueID / 0xA421 ImageID	Exif SubIFD	A hash of image content plus a per-camera seed	Medium — a per-device pseudo-ID
0x0131 Software	IFD0	The app or firmware that wrote the file	Low — but fingerprints your workflow

The most commonly missed detail: 0xA431 and 0xA435 are not the only copies. Most manufacturers also mirror the serial number into their proprietary MakerNote block, using their own private tag numbers, and a MakerNote also carries a vendor-specific UUID, internal build data and, on some bodies, a shutter count. Removing the two standard tags while leaving the MakerNote in place is the classic half-job: the serial is still in the file, just in a place most casual readers will not display. The only complete removal drops the MakerNote too.

Phones are a separate but related category. Phones rarely write a camera serial, but they do write device and app identifiers into UserComment, ImageUniqueID, and Software (“Google Photos”, “Snapseed”, “Halide”, “Camera OS v2.00”), and a vendor app may place a hardware identifier in the same field. Android’s own 0xA432 CameraInfo can carry internal camera module data. On iOS, the Photos library frequently rewrites Software and DateTimeOriginal when a photo is edited or exported.

Real-world consequences

Linking photos to a seized or confiscated device. If a phone or camera is seized, an investigator can hash the filesystem and match recovered photos to a public upload by comparing BodySerialNumber plus ImageUniqueID and timestamps. A serial that was casually left in a public post is a link between a public identity and a physical device in an evidence room.

Grouping an anonymous portfolio. A photographer using a different handle on every platform can still be collapsed into one person if a stable camera serial (or lens serial, which is even more distinctive) appears in each set. Serial numbers survive username changes, which is why investigators and platforms consider them “linkable identifiers” in the same category as advertising IDs.

Identifying high-value optics for theft. A lens serial is often the identifier used in police stolen-goods databases and in insurance claims. A photo of a $2,400 lens with its serial visible in the metadata tells a thief exactly which unit to steal, and tells a buyer exactly which unit is already reported stolen. It can also be used to make a serial look “already claimed” in a fraudulent sale.

Device fingerprinting for tracking. A camera serial is a supercookie that cannot be cleared. A fingerprinting script embedded in a page, app, or PDF can read it and match a returning visitor to a profile. This is why serials are sometimes described as the photographic equivalent of an advertising ID.

Insurance and claim disputes. In the other direction, a serial number is also the strongest possible evidence that a photo came from a particular insured camera. That cuts both ways: it can support a legitimate claim and it can be used to attribute a photo to you.

Does a serial number reveal your address?

No. This is the single most common misunderstanding, and it matters because it changes the urgency of the response. A serial number is a device identifier, not a geolocation. It tells you nothing about where the camera was when the shutter fired.

Where addresses come from is a different tag entirely: the GPS IFD. 0x8825 points to the GPS sub-directory, which holds GPSLatitude (0x0002), GPSLongitude (0x0004), GPSAltitude (0x0006) and GPSTimeStamp — often accurate to a few metres, which in practice means the front door of the building. If your concern is your address, the tag to worry about is GPS coordinates, and the GPS photo checker is the right tool. A serial number in the same file is a second, independent exposure, but it is the GPS tag that pins the location.

How to check your own files

1. Open the EXIF viewer and drop in a photo taken with your main camera.
2. Search for Serial and Owner. Look for 0xA431 (body) and 0xA435 (lens) in the hardware section, and check the MakerNote block for vendor copies.
3. Check 0xA434 CameraOwnerName. If you typed your legal name into the camera’s owner field, that is a more direct exposure than the serial number.
4. Check the MakerNote and UserComment sections. A serial number shown only in the MakerNote is still a serial number.

How to remove them

The metadata remover gives you category-level control. Removing the Camera & Hardware category drops 0xA431, 0xA435, 0xA434, the lens make/model, and the lens specification. Removing Software & Identity clears Software, ProcessingSoftware and HostComputer. The Quick Clean mode performs a full wipe of every standard in one pass, and the tool re-parses the output and shows you an itemised list of exactly which fields were dropped, so you are not relying on a promise.

Two honest caveats:

• Selective removal is EXIF-focused. A category strip that leaves XMP and IPTC intact may still leave a serial in an XMP packet or a Photoshop IRB from an earlier edit. If you need certainty, use the full wipe and re-check the result.
• The full wipe re-encodes. A complete wipe is done by decoding to pixels and re-encoding, which is lossless in terms of metadata but does compress the image data again at the chosen quality. If image fidelity is critical, keep the original and treat the cleaned copy as a publish copy.

Verify afterwards rather than assuming: load the exported file back into the viewer and confirm the serial, owner name, and any MakerNote copies are gone. Then check the platform copy, not just your local file — some services re-encode on upload, some do not, and the version other people actually see is the one that matters.

Finally, remember that a serial number can only be removed going forward. It is already in every photo you have published. Rotating the camera’s behaviour — or, for the more paranoid, having the serial registry document affected when the device is sold — is a separate problem from scrubbing files.

For the broader picture of what else travels with your photographs, see What is EXIF data and the EXIF tag reference.