What a photo carries
EXIF is a block of data the camera writes into the file itself. It names the make and model, often the lens, and the settings used: shutter speed, aperture, ISO, whether the flash fired. It records the moment of the shot. If the camera app had permission to use your location, it also holds latitude and longitude, accurate to a few metres.
Where it usually disappears
Most messengers and social platforms re-encode what you upload, and the metadata does not survive that pass: WhatsApp, Telegram and Instagram all strip it. So the risk is rarely the post. It is the original file, sent as an attachment or handed over on a drive, exactly as the camera wrote it.
Keeping coordinates out
Coordinates appear only when the camera app has permission to use your location. Revoking that permission in phone settings stops future photos from carrying it, but does nothing to the ones already taken. For those, run the file through the EXIF remover and send the clean copy.
Content Credentials
Newer cameras and editing tools can attach a signed record of how an image was made and changed: the C2PA standard, now spreading across phones and generative tools. This page reports only that such a credential is present. Checking the signature would need certificates and a trust list, and that is not done here.
Why JPEG only
PNG and WebP keep their metadata in different containers, and HEIC wraps it differently again. Convert the photo to JPEG if you want to read what the camera originally wrote.