Path allegedly geotagging photo posts even after users disable location services (update)

path for ipad

In its settlement with the FTC announced today, Path closed the door on one privacy controversy, but it seems the company may soon find itself embroiled in yet another. According to security researcher Jeffrey Paul, Path will geotag your posts on the social network even after you've disabled location services for the app. How is it accomplishing this? By pulling EXIF data — which contains GPS coordinates — from any images you've attached via the iOS camera roll, Path is able to uncover the location where each shot was taken.

We're not sure why the company would blatantly disregard user preferences in this way, so if Paul is correct it's most likely some sort of oversight on the part of Path's programmers. Thus far we've been unable to replicate the issue, but have reached out to Path for clarification. In the meantime, you can work around this privacy hole either by refraining from attaching photos to Path posts, or by disabling your iPhone's camera from geotagging photos in the first place.

Update: We were able to replicate the geotagging issue when attaching photos taken with Apple's Camera app. Path has confirmed the bug in a response posted directly to Jeffrey Paul's blog:

Jeffery, thanks for alerting us to this. We take user privacy very seriously here at Path. Here is what we have discovered and how we are responding:

1. We were unaware of this issue and have implemented a code change to ignore the EXIF tag location.

2. We have submitted a new version with this fix to the App Store for approval.

3. We have alerted Apple about the concerns you've outlined here and will be following up with them.

One note to clarify: If a Path user had location turned off and an image was taken with the Path camera, Path does not have the location data. This only affected photos taken with the Apple Camera and imported into Path.

Dylan Casey, Product Manager, Path

The Verge
Log In Sign Up

Log In Sign Up

Please choose a new Verge username and password

As part of the new Verge launch, prior users will need to choose a permanent username, along with a new password.

Your username will be used to login to Verge going forward.

I already have a Vox Media account!

Verify Vox Media account

Please login to your Vox Media account. This account will be linked to your previously existing Eater account.

Please choose a new Verge username and password

As part of the new Verge launch, prior MT authors will need to choose a new username and password.

Your username will be used to login to Verge going forward.

Forgot password?

We'll email you a reset link.

If you signed up using a 3rd party account like Facebook or Twitter, please login with it instead.

Forgot password?

Try another email?

Almost done,

By becoming a registered user, you are also agreeing to our Terms and confirming that you have read our Privacy Policy.



Choose an available username to complete sign up.

In order to provide our users with a better overall experience, we ask for more information from Facebook when using it to login so that we can learn more about our audience and provide you with the best possible experience. We do not store specific user data and the sharing of it is not required to login with Facebook.