PDF metadata — what your document reveals without you knowing (and how to control it)

In 2003, the Associated Press published a story about a US attack plan on Iraq. The official Word document, inadvertently distributed, contained in its metadata the names of all government employees who had edited the file. In 2006, a lawyer sent a Word document to journalists during a high-profile case — the metadata revealed that parts of the text had been deleted and rewritten in the hours before sending. In 2011, Egyptian government documents published during the Arab Spring contained GPS coordinates embedded in the photo metadata — identifying the exact location where they had been taken.

These cases are not historical anomalies. They happen constantly in ordinary offices, in tenders, in court filings and in commercial proposals — just without the headlines. Metadata is the invisible layer of every version of every digital document, and ignoring it has consequences that range from embarrassing to legally relevant.

What metadata is in a PDF

Metadata is data about data: information that describes the file, automatically recorded by the software that created or edited it, without the user needing (or generally wanting) to provide it.

In a PDF file, metadata exists in two layers:

1. Document metadata (XMP and Info Dictionary fields): structured fields with information such as title, author, subject, keywords, creation software, and creation and modification dates. These are the ones that appear when you go to File → Properties in Adobe Acrobat.

2. Metadata embedded in images (EXIF, IPTC, image XMP): when a PDF is created from photos or includes inserted images, the images carry their own metadata — which may include the camera model, exposure settings, recording date and time, and GPS coordinates if the photo was taken with a smartphone with location enabled. These metadata can persist inside the PDF depending on how the file was generated.

3. Revision and comments stream: editable PDFs or those created from Word documents with track changes may contain the editing history, comments, deleted text and even earlier versions of the content as residual data in the file.

What PDF metadata can reveal

The list is more extensive than most people imagine:

• Author's full name: registered in the software's user account (Word, LibreOffice, Adobe InDesign). If the contract was written by Jane Smith on her work computer, the "Author" field probably says "Jane Smith";
• Company name: similarly extracted from the software or operating system settings;
• Software and version: "Microsoft Word 16.0.15225" or "LibreOffice 7.4.2";
• Exact creation date and time: when the document was first generated;
• Exact last modification date and time: when the file was last saved — which can reveal, for example, that a contract was modified at 11:47 PM the night before it was sent;
• Number of revisions: how many times the file has been saved since creation;
• Comments and annotations: markups made during document review that were not removed before export;
• Hidden and deleted text: in some PDFs generated via virtual printing from documents with track changes, passages marked as "deleted" in the editor may remain present in the PDF data stream;
• Geolocation coordinates: in inserted images taken with a GPS-enabled smartphone;
• Names of other users: when multiple people reviewed the document with different accounts on the same software.

Practical implications — when metadata creates real problems

In tenders and proposals

A company sends a technical and financial proposal in a public tender. The PDF was generated from a Word document whose author is "Consulting Firm X — Emily Rogers." The procurement officer or a competitor analyzing the file sees that the document was originally created in 2022 and was modified 40 minutes before delivery — and that the author is an external consultant, not a company employee. Depending on the context, this may raise questions about the authorship of the proposal.

In contracts and legal documents

A lawyer exports to PDF a contract draft that went through several revisions. The metadata reveals the version of the software used, the number of revisions (48, indicating a long negotiation process), and in residual comments, a note between lawyers about the arbitration clause: "client won't accept this, but try to sneak it through." The document is sent to the opposing party.

In investigations and forensic analysis

The reverse side of metadata as a problem is metadata as evidence: in disputes about authorship, tampering or document forgery, digital forensic experts analyze metadata to reconstruct the file's history. The creation date that contradicts the date stated in the header, the author who is not who they should be, the software that reveals the document was generated in a version incompatible with the claimed period — these are regularly appearing clues in document forensics. On how to prove digital document integrity, read our SHA-256 hash guide and our cryptography and digital signatures guide.

From a data protection perspective

Metadata containing real people's names is personal data under the GDPR (and equivalent legislation worldwide). A document shared externally with the author's name in the metadata is a sharing of personal data — which requires a legal basis, as with any other processing. For documents sent to external parties (clients, suppliers, public agencies), clearing metadata is good compliance practice. Read more about privacy in document processing in comparing PDFs without upload — why it matters for data protection.

How to view the metadata of a PDF

In Adobe Acrobat Reader (free)

Open the PDF and go to File → Properties (or Ctrl+D). The "Description" tab shows basic metadata; the "Fonts" tab shows embedded fonts; the "Security" tab shows access and editing restrictions.

With ExifTool (command line — technical reference)

ExifTool is the standard metadata analysis tool in digital forensics. In a terminal (Mac, Linux or Windows with ExifTool installed):

exiftool document.pdf

The output is a complete listing of all metadata in the file, including XMP fields and EXIF from embedded images.

How to remove metadata from a PDF before sharing

Method 1 — Virtual printing (free, classic method)

The simplest and most widely available method is to "print" the PDF to a virtual PDF printer (on Windows: Microsoft Print to PDF; on Mac: save as PDF via the print dialog):

1. Open the PDF in your reader;
2. Go to File → Print and select the virtual PDF printer;
3. Save the new file.

The PDF generated by virtual printing is essentially a "rendering" of the pages — without the original document's metadata. Note: this method also removes digital signatures, visible comments and interactive forms. If the document has a digital signature, preserve the original and distribute the metadata-free copy for purposes that do not require signature verification.

Method 2 — Compression in RoseLab (free, no upload)

RoseLab's PDF compressor, in addition to reducing the file size, removes unnecessary metadata as part of the optimization process. Processing happens 100% in your browser — the file is not sent to any server, which is especially important when the very goal is to remove sensitive information from the document.

The flow:

1. Open the PDF compressor;
2. Load the file;
3. Choose the compression level;
4. The resulting file will have minimized metadata and reduced size.

What to do with images and photos inside the PDF

If your PDF contains photographs (from technical reports, products, locations), the images carry their own EXIF metadata. The safest approach is to process the images before inserting them into the document:

1. Open the image in a simple editor such as Paint (Windows) and export it — basic editors generally do not preserve EXIF metadata;
2. Or convert the images to PDF using RoseLab's image-to-PDF converter — the local processing ensures images are handled without being sent to servers;
3. Then merge the converted images with the rest of the document.

Metadata as evidence: the forensic perspective

It is important to balance the narrative: not all metadata is a risk. In many situations, metadata is an ally of authenticity:

• A creation date that matches the date stated in the header reinforces the document's credibility;
• An author who is who they should be confirms authorship;
• A revision count consistent with the described process validates the history.

The problem is not metadata itself — it is the inconsistency between what the metadata says and what the document claims, or the presence of information that should not be disclosed.

For complete chain of custody of documents, RoseLab's integrity checker registers the SHA-256 hash of the file — and together with the metadata, enables documenting the complete history of the document: who created it, when it was last modified, and that the content has not been altered since the hash was registered.

Integration with the complete document workflow

Metadata management is part of the professional document preparation and filing workflow:

• Before sending externally: verify and clean metadata with the compressor or virtual printing;
• For received documents: analyze metadata to verify authorship and history;
• For archived documents: register the hash in the checker;
• Before digital signing: process the file (including metadata cleaning) and only then collect signatures — remember that any subsequent manipulation breaks the signature;
• For electronic filing: compress and if needed split into parts within the destination system's limits.

To see how these steps chain together in a complete process, read our complete guide to comparing documents and proving what changed.

Frequently asked questions

Is metadata visible to anyone who receives the PDF? Yes — anyone with access to the file can see the metadata using the free Adobe Acrobat Reader (File → Properties). No special technical skill is required.

Does renaming the file remove the metadata? No. The filename is external to the content; the metadata is embedded inside the file. Renaming changes nothing internal.

Does a PDF generated directly from Word have less metadata than one produced by virtual printing? In most cases, it has more: Word embeds user information, company name, creation and modification dates, and comments directly in the export. Virtual printing produces a "clean" PDF — a rendering of the pages without the source document's history.

How do I know if an online PDF tool respects my metadata? The more important question is not what they do with the metadata — it is what they do with the entire file. Any service that uploads your document has access to everything in it. The safest approach is to use tools that process locally, like RoseLab, where the file never leaves your browser.

Are geolocation metadata in photos a real risk? It depends on the context. For ordinary consumer documents, rarely. For security documentation, investigative journalism, business confidentiality or any situation where the physical location should not be revealed, yes — it is a concrete risk.