Share Family Photos Without Sending Your Master Files

What actually happens when you share a photo

Your sister asks for the photos from the christening. You have them, she wants them, and it should take a minute. What is easy to misunderstand is that sharing is not one action: each route decides about resolution, format and metadata on your behalf, and mostly the company has not written that decision down anywhere you can read.

By the end you should be able to match a request for photos to a route, and to separate what vendors publish from what everyone repeats. This article does not guess: where a company documents nothing, that is recorded as undocumented rather than filled in. It is not an audit of anybody’s privacy practices.

Broadly, three things can happen to a photograph you hand over.

• It can be re-encoded for viewing. Apple is unusually specific. For iCloud Shared Albums it publishes that “When shared, photos are reduced to 2048 pixels on the long edge, except panoramic photos, which can be up to 5400 pixels wide,” with video “delivered at up to 720p resolution.”
• It can be replaced by a link to a copy the service holds. Google: “anyone with the link can view them.” Dropbox: “Anyone with the link can preview the content without editing it.” Microsoft is the bluntest — an Anyone link “gives access to anyone who receives this link, whether they receive it directly from you or forwarded from someone else.”
• It can be moved as a file, inside a published ceiling. WhatsApp caps documents at 2 GB, Telegram publishes 2 GB per file, Gmail states that “For personal Gmail accounts, the limit is 25 MB,” and Apple’s Mail Drop takes 5 GB. Those ceilings are in the table below.

Messaging apps straddle those categories. WhatsApp offers Standard and HD per item, with the default under Settings > Storage and data > Media upload quality, but publishes no dimensions and no compression ratios for either tier, and warns that “You can’t upgrade the quality of an existing photo you’ve sent.” Apple says an iPhone “can compress photo and video attachments when necessary,” again without figures.

Why it matters to a photo library

None of this is a problem while a shared copy stays a shared copy. It becomes one when the shared copy quietly becomes the copy you keep — a relative downloads the album, adds a few of their own and sends the lot back; a posted photo turns out to be the only version that survived a phone upgrade. At 2048 pixels on the long edge an image is comfortable on any screen, but it is not a 24-megapixel original, and the difference shows the moment somebody wants a large print.

Apple’s phrasing repays a second reading, because it does not say pixels. The download “may not contain the same information as the original.” Metadata is information. Capture time is information. When a file arrives with no capture time in it, sorting software has nothing to work with but when the file arrived, so a decade of family photographs can collapse onto one afternoon — the same problem described in what photo exports actually give you, arriving by a different door.

Capacity is worth checking before an archive gets planned around a sharing feature: Apple publishes limits of 5,000 items per Shared Album, 200 albums and 100 subscribers. A Shared Album can also be published as a Public Website, which Apple describes exactly as it sounds: “Your photos publish to a website that anyone can see in an up-to-date web browser.”

The metadata question, and who has answered it

Ask whether a platform strips the hidden data out of your photos and everybody has a confident answer except the platforms. X is the exception, and it is unambiguous: “X retains Exif data temporarily to process your photo. It is not available to those who view your photo on X.” That is the only explicit statement of its kind we could find from a major social platform. Flickr documents the opposite: it stores EXIF including GPS location, and its privacy settings govern whether that data is displayed, not whether it is held.

Google sits in between, and the precision matters: “new albums, links, conversations, and other items you share do not include location details by default.” That is location suppression at share time, not a claim that EXIF in general is removed. Apple does not suppress by default, but warns that recipients “may be able to access the location metadata and learn where it was taken,” and documents a Hide Location control.

Facebook, Instagram and WhatsApp are the cases people are most confident about. We could find no help-center page from any of them documenting EXIF or GPS removal — so the honest position is not that they keep it, nor that they strip it, but that nobody outside those companies knows.

Choosing a route for the job in front of you

Almost every argument about how best to share photos is really two people doing different jobs. Name the job and the choice mostly makes itself. There are three: looking, where somebody wants to see the photographs; keeping, where they want copies good enough to reprint or file; and handing over, where you are transferring masters to an heir, a designer, or your own new computer.

Judge every route by what the vendor publishes about the copy, and about who can reach it.

Two exclusions belong with that table. Not one of those routes is documented as delivering a byte-identical original; Dropbox and OneDrive are the likeliest candidates and neither publishes the claim, which is not evidence that they alter anything, only that nobody has answered it publicly. And this compares published behavior, not security.

Five questions, in order, settle most cases:

1. Is the job looking, keeping or handing over?
2. Does the batch fit a published ceiling — 25 MB, 2 GB, 5 GB, 3 GB in a 30-day window?
3. Has the vendor published anything about the copy? If not, assume it changed.
4. Who can reach the link, and does it survive forwarding?
5. Do the photographs show where somebody lives?

Nine things people believe that nobody has published

Each is repeated constantly, often by people trying to help. None can be traced to the vendor concerned.

1. Sending as a document or file gives the untouched original. Neither WhatsApp nor Telegram documents this. It may well be true. It is not published.
2. Facebook and Instagram strip all EXIF. No Meta help page we could find says so, in either direction.
3. WhatsApp HD sends full original resolution. HD is an unquantified tier — no dimensions, no ratios, no figures.
4. WeTransfer’s free tier means 2 GB per transfer. Its help center now publishes 10 transfers or 3 GB in total in a 30-day rolling window, while its own marketing subdomain still shows older wording.
5. Flickr strips metadata. Flickr documents storing it, GPS included.
6. iCloud Shared Albums share full-resolution photos. Documented at 2048 pixels on the long edge.
7. Outlook.com’s attachment limit is 20 MB. Its own page says 25 MB; the 20 MB figure belongs to the Outlook desktop client.
8. CISA or the NCSC warn about photo geotagging. The citable source is the NSA sheet quoted above, which CISA republished.
9. Signal compresses images to a particular size. We could find no published attachment size limit or image-quality documentation from Signal.

The pattern is worth naming: the routes people assume preserve an original mostly do not say so, and the ones that might are undocumented. Sharing features are built for looking, and nobody promised otherwise. It becomes a problem only when a display copy is mistaken for an archive copy.

What to do next

1. Say which job you are doing before you choose an app. Most bad outcomes are a looking route used for a handing-over job.
2. Tell the recipient which one it is. One sentence — these are for viewing, ask if you want the full-size files — stops a downloaded album becoming somebody’s archive by accident.
3. Check one arrived file yourself. Open it and look at the pixel dimensions and the date. It is the only test that needs nobody’s documentation.
4. Use the location controls that exist. Apple’s Hide Location at share time and Google’s default exclusion of location details are both documented.
5. Do not rely on stripping you cannot cite. Where a platform has published nothing, assume it does nothing, and remove the geotag yourself if the picture gives away an address.
6. Keep your masters somewhere that is not a chat thread. Share from a copy, and keep the originals where you can still find them in ten years.