Apparently! Just looked it up and reports presently say that the Serial Number of device was found to be 560151117 from EXIF data. Camera make : Canon Rebel 350 (also known as the Canon EOS 350D or Canon Digital Rebel XT);

or just the individual characteristics and flaws of the lens/sensor/postprocessing software, some of which can be unique per device, and potentially comparable to other photos made with it.

Even without EXIF data I would bet the actual encoding of the image will be identifiable to a specific instance of the camera software.

Similar to how websites fingerprint your browser by rendering something in the canvas or webgl and sending back the rendered image. The exact same rendering procedure will produce slightly different images for each browser instance. I suspect browsers are fully aware and complicit in this because why the actual fuck would they not make the rendering engines deterministic to their inputs?!

In that case, looks like they didn't remove the EXIF data.

That's the obvious one. But you can also add data to images by adding tiny values to the pixels, it'll still look the same to us (same as printer tiny dots).

I don't know if phones actually do this. Just saying it's possible.

But many uploading sites optimize the images, so it'll be gone on reshare, but they could get it on first upload.

Any image editing tool like mspaint or similar. Just copy paste the pixels into a new image file. Though, the program youre using will probably still add it's own metadata to the new file, but all the original metadata from the camera won't be there.