The photographs that still say where they were taken are the ones nobody edited

A digital photograph can carry the coordinates of the place it was taken. A professional picture desk strips that before publication as a matter of routine. The question is what happens at the organisations that do not have a picture desk — and it turns out the answer does not depend on the company at all. It depends on what took the photograph.

The split is not close

Canon and Nikon are the workhorses of corporate photography — between them they account for more than two thirds of every image here that names a camera at all — and barely one in a hundred of their files keeps a location. Apple and Samsung are not cameras that a hired photographer brings to a shoot. They are the phones of the people who work there.

That is the whole finding. The metadata that survives is the metadata nobody edited, and the files nobody edited are the ones that did not come from a professional workflow. A commissioned shoot goes through Lightroom or Capture One and comes out clean. A photograph taken on somebody's phone at a site visit, sent to whoever updates the website, goes up as it was.

The drones are the interesting row

DJI is the highest rate in the table and the one worth pausing on. A drone photograph is usually taken because the subject is a physical site: a plant, a depot, a construction project, a wind farm. A drone image that retains its coordinates is therefore a precise fix on a piece of infrastructure, published deliberately, by the company that owns it, without anyone intending the coordinates to come along.

Sixty-six companies publish at least one image with coordinates. This is not concentrated in a few careless organisations; it is thinly spread across a lot of ordinary ones.

Why this is a hygiene story and not a scandal

Nothing here was hidden. Every one of these files is a public image on a public page, linked from a company's own website, fetched under its own robots.txt. The company chose to publish the picture. What it did not choose — and in most cases plainly does not know — is that it also published where the picture was taken.

The fix is a one-line step in a publishing pipeline, and most of these organisations already have that step. It is simply not applied to the images that arrive by a side door.

How this was measured

OSIC requests the first 64 KB of each image — enough to read the metadata block at the front of the file, and not enough to constitute a copy of the photograph. The bytes are parsed and discarded; no image is stored.

What is kept from the location fields is a single true/false: whether any coordinate was present. No latitude, no longitude, no rounded position, no map. The table above is built entirely from booleans, which is why it can be published at all. The same applies to the camera make, which describes a device type and not a person — the serial number that identifies one specific physical camera is handled differently and never stored as a value.

Three limits bound the number.

• Only 5,618 of the 239,632 images name a camera at all — 2.3%. The rest are logos, icons, illustrations and diagrams that never had camera metadata, plus photographs that were fully stripped. The rates in the table are therefore rates within each make, which is the comparison that means something; the 0.002% bottom row is the baseline for everything else on the web estate.
• It covers the companies we could crawl. Sites whose CDNs refuse our robots.txt request are absent entirely, and so are the roughly 119 companies whose sites returned nothing usable to a first-pass crawl. If those skew toward any particular publishing practice, this sample skews with them.
• An absent coordinate is not proof of a careful process. Most images have no camera metadata because of what they are, not because anyone removed anything.

Collected 1–4 September 2026, over a completed first pass. See about our crawler for the identity it sends and the rate it works at, and coverage for what is and is not in the corpus.