AI can find your home from one photo. How to vanish online

Try an experiment. Take a photo of yours from the balcony, from the cafe down the street or from the playground, with no caption and no geotag. Upload it to a modern multimodal model and ask where it was taken. Chances are you will get the neighborhood, and sometimes the street.

Not long ago only a handful of enthusiasts could do this, spending hours comparing facades and road signs. Now, as privacy researchers put it, it is an API call: fast, cheap and available in bulk. And it does not only work on new pictures. A photo you posted five years ago, before these tools existed, can be taken apart today.

I am not a fan of panic and I am not telling you to delete your social accounts. But digital hygiene needs an update for the age of AI. Below is a plan for one evening, and half of the boring work will be done by AI itself.

What the model sees in your photo#

Social networks and messengers learned long ago to strip coordinates out of image files. The problem is that the model no longer needs them. It looks at the same things an experienced investigator would:

• architecture, brick color and window shapes;
• road markings, signs, house numbers and storefronts;
• vegetation, terrain and the view out of the window;
• the angle of the sun and the length of shadows;
• license plates and school uniforms in the background.

The rights group Privacy International published a dedicated report on the risks of AI geolocation: covert surveillance, stalking and exposure of identity. Specialized services such as GeoSpy show that the job takes seconds, even when the file carries no GPS data.

Step 1. Run reconnaissance on yourself with AI#

Before deleting anything, find out what is visible. Open an assistant with web search and give it a task along these lines:

You are a digital privacy specialist. My name is [first and last name plus spelling variants], I live in [city], my usernames are [list]. Build a checking plan: which searches to run, which social networks and services to look at, where addresses and phone numbers usually surface. Then search open sources and put together a table: what was found, where, how risky it is and how to remove it.

Keep the model to public information about you and nobody else. Also ask it to check whether your usernames repeat across sites. The same handle on a forum, in a game and on social media lets anyone link all of your accounts into one profile in a minute.

Step 2. Take yourself out of Google results#

Google has a tool called Results about you. It works in the Google app and in the browser. You enter your contact details, Google finds pages that show your phone number, home address or email, and puts them in a tab for review.

From there it is simple: pick a result, submit a removal request, say it shows your personal info and you do not want it there. The status of each request shows up on the same page: in progress, approved or denied. In 2026 Google expanded the tool so you can also add ID numbers, such as a passport or a driver's license, and get notified if they appear in search.

Two important limits. First, Google removes the page from search, not from the internet, so the site itself stays up. Second, it generally does not remove information from government sites, news outlets or educational institutions, or anything you publish yourself, such as your own social accounts. Available features vary by country.

Step 3. Data brokers and the right to deletion#

The most detailed files on people are not built by social networks but by data brokers and people-search sites. They merge addresses, phone numbers, relatives and employers from public records and leaks into a single card.

If you live in the European Union, Article 17 of the GDPR gives you the right to have your personal data erased, and the company has a month to respond. California residents can demand deletion under the CCPA, and many other countries have similar rules. Writing these letters by hand takes forever, and this is where AI saves hours. Ask it to draft a short deletion request that cites the right article, sets a response deadline and asks for written confirmation. Then ask for a list of the major people-search sites in your country with links to their opt-out forms.

Step 4. Leaks, passwords and keys#

Check your email on Have I Been Pwned, which shows the known breaches it has appeared in. Change your passwords on every service it finds. After that, three rules cover most of the risk:

• a password manager and a unique password for every site;
• passkeys wherever they are supported;
• app-based two-factor authentication, not SMS, for email, banking and cloud storage.

If you write code or use AI services through an API, make sure your keys are not sitting in public repositories. The latest Anthropic threat report describes criminals who pulled apart 1.8 million Android apps just to harvest keys left in the code.

Step 5. Photos without an address#

• Turn off location tagging in your camera settings. When sharing a photo on iPhone, tap Options and switch off Location.
• Before posting, look at the frame like an investigator would: house number, storefront, the view from the window, a license plate, a child's school uniform. Crop or blur.
• Post photos from places you visit regularly after you have left, not in the moment.
• Lock down old albums. Ten years of photos is a ready-made map of your life.

Step 6. Do not overshare with the AI itself#

The irony is that today the main leak channel is often the AI assistant. A few rules:

• do not upload passport scans, contracts or medical records to chatbots unless you truly have to;
• in the privacy settings, turn off the use of your chats for model training if the service allows it;
• use official apps and do not buy cheap access through middlemen. The same Anthropic report describes how names, emails and work data of hundreds of users leaked through exactly these routing services.

A checklist for one evening#

• AI reconnaissance on your name and usernames: 30 minutes.
• Requests in Results about you: 20 minutes.
• Three letters to data brokers, drafted by AI: 30 minutes.
• Breach check and password changes: 40 minutes.
• Geotags, old albums and social media privacy settings: 30 minutes.

About two and a half hours. Less than a season of a series, and far cheaper than cleaning up the consequences.

Finding a person used to take a private detective. Now it takes one photo and one prompt. Which means hiding will take AI too.