I don't recall correctly but there was this patent/paper discussing how Facebook (& perhaps a few others) use the EXIF data to confirm and expand your social graph. I guess processing the pictures already gives them everything they need to identify different people who were at the same place at around the same time. But all that meta data like timestamps, geolocation, camera make and model etc. must definitely provide them a great deal more info to be sure about that.

And if one company can do it, I don't see how others can't or won't do it in the future. And only God knows in what all other ways this information can be exploited.

I recommend everyone to clean up EXIF data before they send out files to friends and family or upload backups to the cloud.

I found the CLI tool at https://exiftool.org/ to be very useful. It helps remove EXIF data from a wide variety of file types and comes with tons of filters and features to observe and selectively manipulate & remove EXIF data.