Imagine this: on a Tuesday morning a person rings a sexual health clinic, then twenty minutes later calls their doctor, spends that evening forty minutes on the phone with their sister, and the next day looks for a pharmacy that is open late.
No one listened to a single word of those calls. No one read a single message. Yet you most likely already have a fairly good idea of what is happening in that person’s life.
That’s metadata; it refers to the information surrounding your communications rather than the communications themselves, and it is one of the most overlooked privacy issues. People will readily move to an encrypted messenger, cover their webcam and make use of a password manager, yet still leave a trail of metadata behind them every hour of every day without giving it a second thought.
It isn’t really their fault, since metadata has been designed to be invisible: people don’t see it, they don’t intentionally create it, and most applications never refer to it. Yet companies gather it, data brokers sell it, and in 2026 governments are still arguing over how much of it they should be permitted to keep.
Let us consider what it is, why it is so important, the places where it escapes from your life, and what you can realistically do in response to it.
What metadata actually is
The textbook explanation is “data about data”, which is accurate but of little use; it is better to think of it in terms of the envelope rather than the letter.
When you put a letter in the post, the contents are kept inside the envelope, but the envelope itself shows where it is going and often where it has come from, where it was posted and when. The postal service needs this information in order to deliver the letter. With digital communication it is much the same, except that the envelope contains a great deal more detail and is stored far more frequently.
Here’s what that looks like in practice.
A phone call does more than simply connect you with another person; it keeps a record of your number, their number, the time and the length of the conversation, and through the closest mobile mast it also shows approximately where you were.
A text or chat message typically shows who sent it, who received it, when, from which device and from which IP address; even when end to end encryption is used, many apps are still able to see a great deal of this.
An email is quite talkative, since its headers list the sender, the recipients, the subject line, the timestamps and, in many cases, the series of servers it passed through. The subject line in particular tends to catch people out, since it usually isn’t encrypted even when the body is.
A photo taken on your phone can include the exact GPS coordinates of where it was taken, the date and time to the second, and the make and model of your camera. This information is known as EXIF data and remains with the file unless it has been removed.
A document such as a Word file or a PDF generally contains the name of the author, the organisation to which it was registered, the date on which it was created and the date when it was last edited, and in some cases even earlier versions of the text.
Your web browsing also produces metadata. Even if it cannot see the actual pages, your internet service provider can see which websites you visit, and websites can see your IP address, your browser, your screen size, your language and a long list of other details.
Each of these individual parts doesn’t seem very alarming by itself. And that is the very problem.
Why a little metadata reveals so much
The typical argument in favour of collecting metadata goes something along these lines: “We are not reading your messages, all we are doing is seeing who you have contacted.” It sounds sensible, but it isn’t.
A message’s content shows what a person said at a particular moment, while the metadata gives information about their habits, relationships and routines over months or years. Metadata is structured, which makes it simple for computers to sort and search, and since it is gathered automatically there is a large amount of it.
Former NSA and CIA director Michael Hayden put it plainly during a debate in 2014: “We kill people based on metadata.” He was not exaggerating for emphasis. The reason intelligence agencies make use of metadata is that it is so revealing and also so easy to analyse on a large scale.
Research supports this. A well known study that appeared in Scientific Reports in 2013 examined the mobile phone location records of 1.5 million people and discovered that only four points in space and time were sufficient to uniquely identify 95% of them. Four; that’s all you need. If you know where someone sleeps, where they work and where they go on Saturday mornings, you don’t have to have their name.
A few years later, Stanford researchers asked some volunteers to pass on their phone metadata via an app. On the basis of their call and text records alone, they could make strong guesses about very personal issues. For example, one participant called a cardiology clinic, then a heart monitoring service and then a pharmacy. Another called a gynaecologist, followed by a pregnancy service, and then made a series of calls in the following weeks which indicated a specific outcome. None of those individuals gave the researchers any information; it was their metadata that did so.
There is another reason why metadata is so powerful: it connects people. While your contacts list tells us something about you, the contacts of your contacts tell us even more. If you combine enough of these links, you end up with a social graph that shows which people belong to which groups, who the key figures are, and who quietly communicates with whom. For activists, journalists, lawyers and anyone else who works with sensitive sources, this can be much more dangerous than any one message being read.
You can’t change your patterns as you can with a password, nor can you reset the place where you live or the members of your family.
Where metadata leaks in everyday life
Most metadata doesn’t escape through spectacular hacks; instead, it slips out through the ordinary things you do each day.
Your phone and its apps
Your phone is the biggest metadata machine that you own. Even if you’re not using it, it continuously checks in with mobile masts, scans for WiFi networks and Bluetooth devices, and allows apps to run in the background.
A large number of free apps earn money by giving your location to advertising companies. Every phone has an advertising ID, a long string of characters that remains unchanged until you reset it, and it’s this ID that connects all the data. Data brokers then purchase, combine and resell it. That is how a weather app or a simple game can end up contributing to databases that record the movements of millions of people. In the United States, regulators have been working for years to take action against the brokers who sell this type of data, and such cases continue to arise.
Messaging apps
Encrypted messaging services guard the content of your messages, but they vary greatly in the amount of information they gather about the people you are communicating with. While WhatsApp encrypts the content of messages, it still gathers a lot of metadata regarding your contacts, groups and usage habits, and the app is owned by Meta. Signal, on the other hand, is designed to collect as little as possible, and apps such as Session and SimpleX go even further by concealing who you are talking to. For anyone who cares about metadata, the choice of messaging app is just as important as the decision to use encryption.
Photos you share
Most major social media platforms remove the location data from photos when you upload them, though this isn’t the case everywhere. Photos sent as files via email, through some messaging apps, through cloud storage links or on online marketplaces may still carry their complete EXIF data. People have in fact been located from a single holiday photograph or from a picture of an item they were selling.
Documents
Leaked documents tend to reveal their source through metadata; the author field, the company name, the edit timestamps, printer tracking dots and tracked changes have all been used to identify people who believed they were sharing things anonymously. If your job involves sharing files, or if you ever need to share something sensitive, you should take this seriously.
Your browser
Each website you visit gathers information about you from your browser, such as your IP address, your approximate location, the device you’re using, the fonts you have, your screen size, your time zone and so on. Taken together, this information can create a fingerprint unique enough to identify you on different websites even if no cookies are used. As for your internet service provider, it is able to see all the domains you connect to unless you use a tool like Tor or a reliable VPN.
Cars, wearables and smart homes
Modern vehicles keep a record of where you drive, how fast you go, how hard you brake and, in some cases, who is in the car if their phone is connected. Fitness trackers monitor your heart rate, the quality of your sleep and the routes you run. In 2018, a fitness app’s public heat map inadvertently exposed the layout of military bases all over the world, simply because soldiers were jogging around them while wearing their trackers. Smart speakers, doorbells and thermostats also note when you are at home, when you are away and when you go to bed.
None of this requires anyone to read a message; all of it is metadata, and it is being gathered at this moment.
What changed in 2026
If you need proof of the importance of metadata, consider how much energy governments, regulators and companies have devoted to fighting over it this year.
Location data brokers are finally feeling some pressure
In May the US Federal Trade Commission announced a proposed settlement with data broker Kochava and its subsidiary, which had sold location data collected from hundreds of millions of phones. Under the agreement, they are no longer permitted to sell sensitive location data, such as information about visits to clinics, places of worship or shelters, without obtaining people’s explicit consent. The case had been ongoing since 2022 and revolved around exactly the type of advertising IDs mentioned above.
In the same month it was revealed that the implications extend far beyond advertising. In a letter shared by Senator Ron Wyden, US Central Command stated that it had received a number of threat reports about adversaries using commercial location data to target or watch American personnel abroad. If foreign militaries can simply buy this kind of information, so can a stalker or an abusive former partner.
US states are stepping in where federal law hasn’t. Since January, Californians have been able to send a single deletion request to every registered data broker through a platform called DROP, and from August brokers have been legally required to act on those requests. In August, the state regulator fined one broker, LocateSmarter, more than $116,000 in its first case under both the CCPA and the Delete Act. And on 1 October, a Connecticut law banning the sale of people’s precise location came into force, even as data brokers tried to block it.
The surveillance debate in Washington
Section 702 of the Foreign Intelligence Surveillance Act, which allows US agencies to gather the communications of foreign targets and, in the process, those of a large number of Americans, was due to expire in April. Following a number of brief extensions and failed votes, the law lapsed in June while lawmakers continued to negotiate. Because of the way court approvals work, the programme remains in operation for now, and experts at the Brennan Center say it will not actually come to an end if Congress reauthorises it by March 2027.
A major point of controversy has been the “data broker loophole”: instead of applying for a warrant, government agencies can simply purchase location and browsing data from data brokers. In March, over 130 organisations called on Congress not to renew Section 702 without first closing that gap.
Europe wants to keep metadata for longer
The issue in Europe is one of data retention. The Court of Justice of the European Union has on several occasions ruled that keeping everyone’s communication metadata as a precaution breaches EU law. Nevertheless, the European Commission has been moving towards a new data retention law, with a proposal expected around the middle of 2026. Documents leaked from the Council indicate that the majority of member states would like a retention period of one year, and that some also want it to apply to messaging services such as WhatsApp, Signal and Threema as well as to telephone companies. Digital rights organisations such as EDRi are strongly opposing it, and it is important to keep a close eye on the matter, since it would determine how much of your metadata ends up in a database awaiting a request.
How to shrink your metadata footprint
The straightforward fact is that it’s impossible to get rid of metadata altogether, since networks need some of it in order to function. However, you can reduce a great deal of it by adopting a few habits, and most of them take minutes rather than hours. There’s no need to do all of them at once; begin with the ones that match the risks in your own life.
Tame your phone
Check your app permissions and set location access to “only while using the app”, or turn it off completely for any app that doesn’t actually need it. A torch app has no business knowing where you live.
You can reset or delete your advertising ID. On more recent Android phones you can delete it entirely in the privacy settings, and on an iPhone you can tell apps not to track you, which stops them reading it. Either way, it breaks the link that ties so much of your data together.
Switch off WiFi and Bluetooth when they are not in use, and get rid of any apps that you last opened months ago. Each app that you delete means one fewer source of background data.
Clean photos and files before you share them
When you share a photo from your phone, look for the option to remove the location before you send it; both iPhone and Android offer this in the share menu. Even better, turn off location tagging in your camera’s settings unless you actually want it.
When it comes to documents, look at the file’s properties before sending it anywhere and delete the author’s name and company information. If you frequently work with sensitive files, you can use a tool such as ExifTool or the metadata cleaner included in Tails to remove almost all of it at once. Just remember that converting a document into a PDF does not automatically delete its metadata.
Pick tools that collect less
When it comes to messaging, choose an app that is designed to know as little as possible; Signal is the best place to start for most people. If you also want to conceal who you are talking to, consider Session or SimpleX Chat. Turning on disappearing messages also helps, since data that doesn’t exist can’t be handed over.
A privacy focused browser with tracking protection makes a real difference for everyday browsing. When you need more protection, Tor Browser hides your IP address and makes all its users look alike, which is currently the best defence against fingerprinting.
When it comes to email, remember that subject lines are often sent without encryption, so don’t include anything sensitive in them.
Push back on data brokers
If you live somewhere with privacy laws, make use of them. Californians, for example, can now use DROP to ask every registered broker to delete their data all at once. Elsewhere, you can send deletion requests to brokers yourself or pay a removal service to do it on your behalf. It is a tedious process, but it genuinely makes you harder to find.
Think about the bigger picture
Look through the privacy settings in your car’s app and on any connected devices at home. In fitness apps, set your activity to private by default, particularly routes that begin and end at your front door. And whenever you are considering signing up for a new service, ask yourself whether it really needs your phone number; usually it doesn’t.
Final thoughts
We have spent many years learning how to guard the contents of our messages, and that is a positive development. Encryption is now better and more widely used than ever before. However, the discussion about privacy usually ends there, as though concealing what we say is the same as concealing what we do.
It isn’t. Metadata maps where you go, who you know and what you care about, and it does so quietly, constantly and mostly without your knowledge. The fights happening in 2026, from data broker settlements in the US to retention laws in Europe, show that the people who collect it understand its value very well.
The good news is that you don’t have to become invisible to make a difference. Every permission you turn off, every photo you clean and every app you swap for a better one shrinks the trail you leave behind. You can’t stop leaving footprints altogether. You can make them a lot harder to follow.