I’ve known some students who took a group photo in a non identifying location, for whatever reason- literally in front of a blank wall, but that was at their clinical location.

Exif data is crazy. Unless expressly disabled it can include GPS coordinates (including elevation), time (and timezone), the direction the camera was facing, model of phone/camera, camera settings like exposure time, ISO, and if flash was used, and a ton more.

Obviously things like camera settings aren’t likely to be a privacy risk, but it’s worth considering just how much data could be included.

Most social media sites strip Exif metadata, but just as a general rule don’t take pictures anywhere even remotely related to something supposed to be confidential.