Every photo taken on a phone arrives with a block of data attached to it. Not in the image - alongside it, in the file. The usual contents are more specific than people expect.
- GPS coordinates, typically accurate to within a few metres, plus altitude.
- The exact date and time, including timezone.
- Device make, model, and often a lens identifier.
- Camera settings, orientation, and software versions.
- On some devices, a unique identifier that is stable across photos from the same camera.
None of that is removed by blurring a plate, because none of it is in the plate.
What each operation actually does
Blur, pixelate, draw over. Changes pixels only. Metadata untouched.
Crop. Changes pixels and usually updates the dimension tags. GPS, timestamp and device all survive.
Screenshot of the photo. This one genuinely does drop the original metadata, because it produces a new file from the screen. It also drops your image quality, and it retains whatever was visible on screen, which sometimes includes a filename or an album name that is itself identifying.
Converting the format. Depends entirely on the tool. Some preserve EXIF deliberately, which is correct behaviour for archiving and wrong for sharing.
Uploading to a large platform. Most social platforms strip metadata on upload, and this is where the false sense of safety comes from. It is true for the big ones and not reliably true for forums, classifieds, messaging apps that send "as file", email attachments, or a shared cloud folder.
The realistic failure
Someone photographs a car on their driveway, covers the registration properly, and sends the file to a buyer over a messaging app that preserves the original. The buyer now has coordinates for the seller's house, a timestamp, and a device model. The plate is the thing that was protected and the least sensitive thing in the package.
What to do about it
Strip it at export, as part of the same pass that covers the pixels, rather than as a separate discipline you have to remember. If the tool doing the redaction can also drop EXIF and GPS on the way out, the decision is made once instead of every time.
The exception worth stating: keep metadata when the photo is evidence or archive material. Timestamps and coordinates are what make an incident photo credible. Strip the copy that gets shared, not the copy you keep.