What gives you away online every day

In the early 2010s, one of the most common threats on forums came down to a few words: "I'm going to find your IP address". It sounded credible because the IP address was then almost the only kind of digital trace the general public had heard of. In reality, the information capable of identifying a person is far more varied, and its volume has kept growing.

Much of this trace appears during perfectly ordinary actions. Opening an app, viewing a page, paying for a subscription, taking a photo, moving around with a phone or saving a document is enough to produce data. The aim of this article is not to provide a recipe for disappearing, but to show the full range of information that makes it possible to recognise someone: from the most obvious identifiers to signals we almost never see.

A digital trace is not limited to what you publish

A digital trace is any piece of information left behind after an action in a digital environment that may reveal something about a person. It includes voluntary publications — messages, photos, comments, forms and profiles — but also data recorded automatically by websites, apps, telecoms operators, banks, delivery services, payment systems, cameras and the phone we carry in our pocket.

Almost every interaction with a digital system therefore leaves a record somewhere. Some data leads directly to a person: an identity document, a phone number, a means of payment or biometric data. Other data does not immediately reveal a name, but sharply narrows down the number of possible people.

A phone model, its technical settings or a file's metadata do not necessarily say who is behind the screen. They do, however, make it possible to stop looking for an abstract user and start looking for a person with a specific device, present at a given place at a given time. When several clues of this kind are linked, they may be enough to reveal an identity.

Several weak clues can add up to strong evidence

An isolated clue is often unremarkable. Hair colour, a moustache, a suit, a public role or a verbal habit may apply to many people. Brought together and attributed to the same person, these elements sometimes immediately point to one specific individual.

Digital traces work on the same principle. A single piece of data seems insignificant. A series of consistent data points forms a profile. Anonymity does not always vanish because of a spectacular revelation: it can gradually dissolve as fragments from different services are matched up.

Direct identifiers

The first category covers data that points directly to a person: passport or identity card details, national register number, home address, phone number, bank details and payment data.

Biometric data forms a group of its own. The face, voice, fingerprints, handwriting and other physical characteristics can be used to recognise a person. When a service uses them for registration or verification, a direct link is created between the account and the person's legal identity.

A verified account, a registered SIM card, a bank account or a personal government portal are thus durably attached to their holder. That link can then spread. An account presented as anonymous stops being anonymous as soon as a subscription is paid with a personal bank card: the account leads to the payment, the payment to the bank account and the bank account to its holder.

The service used does not necessarily see every link. The chain can nonetheless be reconstructed following a lawful request from the authorities, an investigation or a data leak. The same thing happens with an email address used both for an official procedure and for other sign-ups, with a messaging app tied to a personal number or with a shopping account linked to a payment card.

This information belongs to the active side of the digital trace: it results from data the user chooses to hand over. A second, passive part appears automatically and often without any separate action on their part.

The IP address: useful, but rarely enough on its own

The IP address is the one from which a device or network accesses the Internet. The website or service contacted necessarily receives it at the time of the connection, unless a technical intermediary masks the original address.

To an outside observer, an IP address generally indicates a country, an approximate region and an Internet service provider. It does not systematically give a name or the exact location of a home. The operator, on the other hand, may keep the information needed to associate an assigned address with a subscription for a given period. Within the applicable legal framework, the competent authorities can request that correspondence.

The IP address is therefore neither a magic wand nor a piece of data of no interest. Its value depends on who is observing it, which logs they can access and their ability to match it with other elements.

The phone also has its own identifiers

A device with a cellular module has, among other things, an IMEI, a number that identifies the handset on the mobile network. When the phone connects, the operator can see this identifier and associate it with the SIM card in use.

Changing SIM cards while keeping the same phone is therefore not enough to break earlier links: the handset remains recognisable by its IMEI. The reverse is also true. An old SIM card inserted into a new device creates an association between the subscriber and that new handset. What looked like just any phone gradually becomes "that phone, used by that person".

Movements draw a behavioural profile

Geolocation can come from GPS when the user has granted permission to an app. It can also be estimated from Wi-Fi networks, Bluetooth or the cell towers a phone connects to. To provide mobile service, the operator necessarily knows which network cells the device is using.

Location seems useful mainly when the person has already been identified. Yet movements have their own regularity. If a phone stays in the same place for several hours every night, that spot probably corresponds to the person's home. If it travels to another address almost every working day, that may be the place of work or study. Cafés, shops, gyms and homes visited regularly complete the picture.

Each point carries little information. Together, they form a characteristic route. Even after changing phone or SIM card, continuing to sleep in the same place, take the same routes and visit the same places makes it easier to link the old profile to the new one.

Combining times, places and habits thus makes it possible to estimate with high probability that two apparently unrelated devices belong to the same person. This kind of correlation is by no means theoretical: it is used in advertising, mobility analysis, fraud prevention and certain investigations.

Trackers follow your actions from page to page

Many websites embed measurement scripts supplied by third-party companies. They record the buttons clicked, the length of a visit, the pages viewed, the origin of a click or the steps abandoned. These tools can be used for internal analytics and to fight bots. Very often they also feed targeted advertising.

The same tracker installed on several sites can follow a browser from one domain to another. For example, it stores an identifier in a cookie and reads it back when the user arrives on another page containing the same component. A company that has nothing to do with the site being visited can then build a cross-site browsing history.

Blocking third-party cookies reduces some of this collection, but does not eliminate every means of recognition. Other techniques rely on the technical characteristics of the browser and the device.

The browser fingerprint

A website can obtain or calculate a great deal of information needed to display and run its pages: operating system and browser version, language, time zone, screen dimensions, available fonts, browser extensions or capabilities, number of processor cores, graphics information, supported codecs and many other parameters.

Taken separately, these elements seem harmless. Their combination, however, varies from one device to another, even between two very similar machines. The browser on a computer, phone, tablet or TV thus presents a configuration that can become rare enough to serve as a fingerprint.

This fingerprint does not necessarily contain a name or address. First of all, it makes it possible to distinguish one browser from others, without a logged-in account and sometimes without a cookie. If the same actor later obtains a directly identifying piece of data, it can try to link the technical fingerprint to a real person.

The Electronic Frontier Foundation's Cover Your Tracks and AmIUnique let you see which characteristics a browser exposes and estimate how rare they are. The test itself involves sending these parameters to the service analysing them; its privacy policy is therefore worth reading, as with any measurement tool.

Metadata hidden in files

Metadata is technical information stored inside a file to describe it or to allow software to process it. It often remains invisible in everyday use and sometimes requires a particular tool to view.

A photo can contain EXIF data: make and model of the camera, date and time the picture was taken, lens settings and, when the option is enabled, geographic coordinates. Some devices or programs can also write the author's name in the copyright field. A simple photo sent to someone can therefore reveal at once the equipment used, the time, a location and sometimes a name.

Office documents, PDF files, presentations and videos also carry housekeeping information: author name, organisation, software used, creation date, editing history or the local path of the file. Such details have already made it possible to show that footage presented as recent had been prepared several days earlier, or to find a project's internal name from its editing folder.

A black rectangle does not always remove the content of a PDF

PDF files deserve special attention. They can retain comments, attachments, hidden layers, intermediate versions, traces of edits or text that the author thought had been redacted.

Covering a sentence with a black shape does not guarantee that it has been deleted. If the original text still exists under the rectangle, it can sometimes be selected, copied or extracted. The reader sees an apparently cleaned-up version while the information remains present in the document's structure.

The people around you also leave traces about you

Not all traces are produced by the person concerned. The social graph — family, friends, colleagues, members of a chat group and occasional contacts — creates links capable of revealing a number, a pseudonym or a membership.

A phone number may never have been published by its owner and yet appear in the address books of dozens of people. These address books are regularly synced with messaging apps, social networks and online services. A leak, a misconfiguration or a caller ID app can reveal how other users have saved that number.

Relationships then become clues. An unknown account shares the same contacts as an identified profile, joins the same groups and communicates at the same times: each match shrinks the space for anonymity. This mechanism can be used to identify a fraudster or a hidden account, but it can just as easily expose a person who had never made anything public themselves.

Understanding rather than trying to disappear

This list is still incomplete. Digitalisation is extending traces into new spaces: a smart speaker may process words spoken in a kitchen; a car records journeys; a badge keeps a record of entries; a camera captures a face in the street; a household appliance logs when it was used.

Disappearing entirely from digital systems has become extremely difficult, and most people do not need to. It remains essential, however, to understand how much information is collected and how it can be linked.

The decisive point is not always how sensitive a single piece of data is. It is an actor's ability to accumulate fragments, keep them long enough and bring them together. An IP address, a time, a phone, a journey, a photo and a few contacts look ordinary. Together, they can tell the story of a life with a precision its owner never intended to publish.