What is metadata, and what does it show about you?

What metadata means, and its types

NIST, IBM, CMU and EFF all give the short version, “data about data”, and CMU adds that it is “far too vague to be useful”. NIST’s glossary has several entries under the word. One, taken from its guide SP 800-86, says that for filesystems metadata is data that provides information about a file’s contents. Another, taken from SP 800-150 and SP 800-53 Rev. 5, is information describing the characteristics of data: structural metadata describes data structures, such as format, syntax and semantics, and descriptive metadata describes the contents, for example information security labels. A third entry, from SP 800-57, uses the same word for the attributes of a cryptographic key, so the term has another use there.

IBM’s page defines metadata as information, such as author, creation date or file size, that describes a data point or a data set. Its example is a table of recent customer orders: the table is the data, and who owns it or what type of file it is counts as the metadata. CMU gives a definition from NISO instead: structured information that describes, explains, locates or otherwise makes an information resource easier to retrieve, use or manage. Wikipedia points to an older case, the library card catalog, where each card holds the author, title and subject of a book; it says libraries converted their catalog data to digital databases until the 1980s.

IBM and CMU both sort metadata into descriptive, structural and administrative types. CMU’s administrative metadata is about the management of an object and may include preservation and rights management, creation date, copyright permissions, required software, provenance and file integrity checks. IBM lists two more, technical and preservation metadata, and its technical example is the structure of tables, data types and relationships between tables in a database. The figure below puts the names side by side.

Metadata on a photo

The Library of Congress page on the Exif family describes the Exchangeable image file format for digital still cameras. Its list of Exif metadata tags includes descriptive metadata, copyright details, camera settings, technical image data, date and time information, geographic data and thumbnail storage. The Library says JEITA and CIPA have jointly managed the standard since 2009, and that the most recent version when it wrote the page, in November 2023, was version 3. It adds that Exif is supported by almost all digital cameras and widely supported by smartphone cameras.

Two of the pages use the photo for different points. IBM mentions it once, as an example of metadata created along with data: most digital cameras automatically record details such as the camera model, date and time. EFF uses the photo to say that, on your phone, the information about a photo you took can show the aperture and shutter speed, or the location where the photograph was taken. The Library also says that its Recommended Formats Statement does not mandate or suggest the use of Exif data, which is a line about the Library’s own format preferences and not about cameras.

Taking that data out of a picture is a separate job. Our page on metadata in photos covers it, so the steps are not repeated here.

Metadata on a call or a message

EFF’s Surveillance Self-Defense guide, last reviewed on 22 July 2024, treats communication metadata as essentially everything except the content of a communication. Its picture is an envelope: the outside shows the sender, the receiver and the destination, and metadata does the same for digital communications you send and receive. Its examples are the subject line of your emails, the length of your conversations, the time frame in which a conversation took place and your location when communicating, as well as with whom.

On the law, EFF says metadata has historically had less privacy protection in some countries, including the U.S., than the contents of communications, and that the police in many countries can obtain the records of who you called last month more easily than they can arrange a wiretap. Wikipedia reports that bulk collection of call detail records, meaning the times, origins and destinations of calls and messages as opposed to their content, became controversial after disclosures by Edward Snowden. It adds that Slate reported in 2013 that the United States government’s interpretation of metadata could be broad enough to include the subject lines of emails.

EFF gives four scenarios of what a telecommunications company may know, and we quote three: a call to a suicide prevention hotline from the Golden Gate Bridge; an email from an HIV testing service, followed by a call to a doctor; and a half-hour call to a gynecologist followed later that day by a call to a clinic’s number for abortions. These are EFF’s illustrations and not the findings of a study.

EFF also says why this data is hard to avoid. Third parties often need metadata to connect your communications, in the way a postal worker needs to read the outside of an envelope to deliver it, and mobile phone companies need to know roughly where your telephone is in order to route calls to it. The guide adds that some software, naming Tor and Signal, tries to minimize the metadata it collects, and that this is still rare with most software. The page we read does not say which data Signal minimizes; Signal’s own statements are in the next section.

What a messaging app says it still sees

Two services describe themselves in two different kinds of document, so what follows is two sets of statements and not a comparison of measurements. We read what each says on 5 November 2026.

WhatsApp. The privacy policy copy we read is marked Effective January 4, 2021, and the current version may differ. It says WhatsApp offers end-to-end encryption, which it explains as messages being encrypted to protect against WhatsApp and third parties reading them. It says messages are stored on your device and not typically on its servers, deleted once delivered, with undelivered messages kept in encrypted form for up to 30 days. Under usage and log information it lists your activity, including the time, frequency and duration of your activities and interactions, when you registered, whether you are online and when you last used the service, your “last seen”. Under device and connection information it lists the hardware model, operating system, battery level, signal strength, app version, mobile network, connection information including phone number and mobile operator or ISP, language, time zone and IP address. If you use the contact upload feature, it receives the phone numbers in your address book, and it associates the names and photos of groups you join with your account. The page does not say these records are combined with message content. On retention it says it stores information for as long as necessary for the purposes it names, with periods decided case by case; the page we read gives no number of days for usage and connection data.

Signal. Its 2018 post on sealed sender says that, beyond end-to-end encryption, the service is designed to minimize the data retained about users, and that by design it does not store a record of contacts, social graph, conversation list, location, user avatar, profile name, group memberships, group titles or group avatars. The post says the service always needs to know where a message should be delivered, while ideally it should not need to know who the sender is. In sealed sender the sender goes inside an encrypted envelope, and the envelope reaches the service without authenticating, along with the recipient’s delivery token. Signal calls this a step toward hiding “who is messaging whom”, and says that resistance to traffic correlation through timing attacks and IP addresses were areas of ongoing development. The post dates from 2018 and does not describe the current state.

Signal’s page of government requests records what it handed over. For a grand jury subpoena from the Eastern District of Virginia, posted on 4 October 2016, Signal says the only information it could produce was the date and time a user registered and the last date of a user’s connectivity. Entries of 6 March and 3 November 2026, from the District of Columbia, say Signal does not have access to things such as messages, calls, profile information, groups and contacts. An entry of 28 October 2021 lists what a subpoena asked for and Signal did not have: names, addresses, correspondence, contacts, groups and calls. These are Signal’s statements about its own answers, not checks made by someone else.

Side by side, WhatsApp’s policy lists collecting the time, frequency and duration of activity, an IP address and a phone number, while Signal says it does not store contacts, a social graph or a conversation list and, in the 2016 case, could give two dates. The two cannot be compared one to one: one is a privacy policy about what a service may collect, the other is an account of legal requests answered. Our pages on WhatsApp, Signal and Telegram go through each service on its own.

What researchers found in phone records

A 2016 study by Mayer, Mutchler and Mitchell, in PNAS (issue of 17 May 2016), looked at telephone metadata. We read the copy on PubMed Central, because the PNAS site blocked our reading. Its abstract says telephone metadata is densely interconnected, can trivially be reidentified and can be used to draw sensitive inferences. The data came from 823 volunteers who installed an Android app, MetaPhone, that read their call and text logs; Facebook data served as the reference for what could be inferred.

To test how easily numbers can be matched to names, the authors ran random numbers from the dataset through Yelp, Google Places and Facebook, and matched 32% of them automatically. With a one-month Intelius subscription costing 19.95 dollars and 70 minutes of web searches, they say they were still able to identify the overwhelming majority of the numbers.

Table 4 of the study gives the share of participants with at least one call to a kind of organization: health services 57%, financial services 40%, pharmacies 30%, veterinary services 18%, legal services 10%, recruiting and job placement 10%, religious organizations 8%, firearms sales and repair 7%, political officeholders and campaigns 4%, adult establishments 2% and marijuana dispensaries 0.4%. Within health, Table 5 lists mental health and family services at 8% and sexual and reproductive health at 6%. The authors also correctly predicted the Facebook current city of 130 of the 241 participants who had at least 10 calls to reidentified businesses; those 241 were among the 418 who listed a current city on Facebook (the paper prints 57% next to the 130, but 130 of 241 is about 54%, so we give the counts only).

The limits matter. The participants were volunteers using Android, and the study looked at calls and texts, not at apps. Putting it beside Signal and WhatsApp is our own juxtaposition, not something the study does. The study is also from 2016.

What the pages we read do not say

We tested nothing on a phone and did not look at message data. The WhatsApp copy we read is dated 2021 and the Signal post on sealed sender is from 2018; both may differ from what the services say today. The WhatsApp page gives “as long as necessary” and no number of days for usage and connection data. The pages we read do not mention what Apple’s iMessage records; our page on iMessage is separate, and so is the one on encrypted email. EFF says Tor and Signal try to minimize metadata but, on the page we read, does not list which. We read no independent test of what the servers of an encrypted app see.

Of the five pages that rank first for this question (IBM, Salesforce, CMU, Acceldata and Wikipedia), which we read in full, none explains what an encrypted messaging service can still see; Wikipedia gives one sentence on the times, origins and destinations of calls and messages. The sections on calls, messages and apps above therefore rest on EFF, WhatsApp, Signal and the PNAS study.