Section: Technology & AI Author: V Reading Length: ~27 min Sources and further reading: 22 items Topics: digital footprint, GDPR, OSINT, cookies, data brokers, public registers, deindexing SEO / Working Title: What is a digital footprint and what does it reveal about a person?
What is a digital footprint, and what does it reveal about a person? The question sounds simple until we notice that we are not assembling one biography. A cookie is not consent to everything. Deindexing is not deletion of a page. An IMEI is not an account, and an account is not the content of messages. And an American list of data brokers is not a Czech file. The following text maps the everyday footprint under the GDPR. It is not court evidence, a forensic chain or a guide to assembling a stranger.
1. Two namesakes, one bar, four different traces
Imagine an ordinary lunch in the office. Someone types their name into a search engine and finds an old race result, a social profile, a company entry in a register and an article about a person with the same name. A colleague says the internet knows everything. An accountant objects that it is enough to file a GDPR request and it will be gone. A lawyer recalls the cadastre and ARES. A marketer adds American data-broker catalogues and a number that looks like a definitive map of the market.
At first glance this is a dispute about privacy. In fact each person is describing a different layer. The colleague mixes a visible selection of links with a biography. The accountant confuses a right against one controller with deletion of the whole web. The lawyer is talking about the statutory publicity of recorded facts. The marketer is transferring an American registration regime into Europe, where no such single public catalogue exists. That is why they can all be partly right and the sentence “the internet knows everything” still wrong.
The first distinction is therefore not whether a trace exists. It exists. It is which trace, with whom, at what time and toward which conclusion it may be used. A trace after your own comment is not the same as a cookie in a browser. An entry in the commercial register is not the same as the contents of a mailbox. And a search result by name is not proof that all displayed records belong to the same person.
2. An everyday footprint has at least six layers
The single word “footprint” hides several things. Some are public, others sit with a particular controller. Some we create on purpose, others arise as a side record of traffic. Some have legal weight, others are only a technical joining point. If we do not separate them, we begin to read character from cookies and private life from the cadastre.
Six layers of the everyday footprint:
- Deliberate publication: profiles, comments, photos, public CVs, reviews and posts. In VŠIT 2025, CZSO reports that 15.7% of social-network users aged 16+ in private households had a fully public profile and posts; this is a self-report by network users, not an audit of all their accounts [1].
- Account and telemetry: history with Google, Apple, Microsoft, social networks or apps. It is a rich picture of behaviour with one controller. It is not public merely because it exists.
- Device and network identifiers: IMEI, IMSI, advertising ID, IP address, cookies or fingerprint. The GDPR recalls that online identifiers can, in combination with other data, identify a person [3]. By themselves they are not a biography.
- Commercial aggregation: data brokers, advertising profiles, people-search services and marketing segments. Their record can be useful for targeting and dangerous for fraud. It is not a register of civil status.
- Statutory publicity: public registers, collections of deeds, the cadastre of a property, official notice boards. They have weight for the recorded fact. They do not have weight for everything a person does outside the record.
- Copies, caches and backups: search-engine snippets, forwarded emails, downloaded documents, web archives or stored screenshots. The author need not control them.
A forensic chain does not enter here. Seizure of a device, a bit copy, procedural usability and evidence in proceedings belong to another series. Here the subject is the ordinary footprint a person meets when using accounts, websites and public records. It is not a smaller topic. It is a different topic.
That is why the question “where am I everywhere” is misleading. A person is not spread across the internet the way text is spread across a page. With one service there is an account, with another an advertising segment, with a third a billing contact, with a fourth a public record and with a fifth only a technical identifier. A map of your own footprint cannot begin by throwing everything into one list. It begins with a table of layers: what I published, what the account controller holds, what the browser holds, what is in a register, what may sit with a broker and what is already a copy outside the original context.
A digital footprint is not a biography. It is a set of traces with different weights.
— Jiný Kontext
3. The best map is the one whose gap you can bear
With a footprint we are not looking for an all-knowing picture of a person. We are looking for a map that admits its gaps. A good map says what it sees, what it does not see, whom the record belongs to, who administers it and why a stronger conclusion cannot be drawn from it. A bad map folds everything into one person and adds certainty where there is only resemblance.
| Type of failure | How it looks | How to test | What limits the harm |
|---|---|---|---|
| Confusion of layers | A cookie or IMEI is read as a biography | Separate identifier, account, content and register | A map of controllers and data types |
| Confusion of rights | Deindexing is passed off as deletion of a website | Distinguish the source page and the search engine | First the source controller, then the search engine |
| Confusion of geography | 750 brokers from the USA are transferred onto Czechia | Name the state, the register and the period | Do not transfer an American number onto the EU |
| Confusion of publicity | The cadastre or ARES is taken as “everything about a person” | Ask what fact the record writes down | Stay with the recorded role or property |
| Confusion of population | A visible profile is passed off as a universal state | State the population and the unit of the statistic | Read CZSO as self-report, not as a forensic file |
That is reasonable, but incomplete if the map ends with a list of finds. Each find needs a weight. A public profile can be genuine and still old. A register entry can be accurate and still speak only of a function in a company. A cookie can join visits, but it does not say who sat at a shared computer. A footprint is therefore not judged by the number of items. It is judged by which question it can bear without switching into conjecture.
A good map also has a date. Not because everything vanishes quickly, but because different layers age differently. Cookie settings can change after one click. A social profile can stay visible for years even if the author long ago stopped using it. A register entry can have a legal history. A broker’s segment can be derived from an old purchase. Without a date the map becomes a mix of present and past that looks like today’s portrait.
4. A footprint is not a biography. And it is not a verdict
A biography has a plot, an author, a timeline and responsibility for the selection. A digital footprint has records. Some are accurate, others outdated. Some arose from your will, others from the running of a service. Some concern you, others a namesake, a company account, a family device or a shared address. That is not a detail. It is the boundary between orientation and a false conclusion.
A footprint is also not a verdict. Court evidence must pass other questions: who obtained it, how it was secured, whether it changed, how it relates to the alleged event and whether it can be used in proceedings. An everyday footprint has no such chain. It can be a guide for cleaning your own accounts, for a request to a controller or for better privacy settings. It should not pose as a definitive truth about a person.
It does not follow that a footprint is worthless. It follows that it must stay in its weight. When we find an old photograph, we know that a copy of an image exists somewhere. We do not know whether it expresses today’s consent. When we find a company entry, we know something about a legal role at a certain time. We do not thereby know anything about health, a household or everyday movement.
The largest error does not arise from one bad item. It arises from correct items joined by a bad sentence. The name fits, the field fits, the city fits, the photograph looks similar. It does not follow that it is the same person. Shared Wi-Fi, a family tablet or a company phone can create a technical record that, if read carelessly, would look more personal than it may. A digital footprint therefore needs a denominator: who is the subject, who is the controller and how we know that the record belongs to them.
5. An IMEI is not an account. An account is not content
An IMEI identifies a device, more precisely mobile equipment on the network according to GSMA rules [14]. It is not an account with Google, Apple or a social network. And an account is not automatically the content of messages, photos and documents. In ordinary speech the three words melt into the sentence “the phone knows everything about you”. Technically and legally they are three different traces.
A device can be company-owned, shared or sold. An account can be signed in on several devices. Content can sit with another controller, in a backup, in an app with end-to-end encryption or only locally. So when a person checks their own footprint, they should not ask what “the phone knows”. They should ask which identifiers the device has, which accounts are signed in and where the content sits.
This distinction is practical. Resetting an advertising ID does not change account history. Signing out of an account does not delete a public comment. Replacing a phone does not cancel a profile with a service. One change can be right, but only for its own layer. Whoever sells it as a cleansing of the whole footprint is selling calm without support.
The opposite error holds as well. When a person finds a long list of app permissions on a phone, it does not mean that every app read every piece of content. A permission is a possibility in a certain regime, not an automatic log of everything that happened. It is still a good place for a clean-up. Of your own footprint we ask: which app has access to location, photos, contacts or the microphone, and whether that matches the function for which I use it. The answer need not be large to be useful.
6. A cookie is not consent to everything
A cookie is a small technical record. It can hold a login, a basket, a language, analytics or advertising. Recital 30 of the GDPR states that online identifiers such as an IP address, cookies or RFID can, in combination with other data, identify a natural person [3]. Directive 2002/58/EC, Article 5(3), ties the storing of or access to information in a terminal device to consent, except for what is necessary for a service the user requested [4].
In Guidelines 2/2023 the EDPB reads the technical scope of this rule more broadly than traditional cookies alone; it also reaches similar technologies of access to information on a device [5]. That does not mean every cookie is the same. It means a technical detail in the browser can be personal data if it joins other data and serves to distinguish a person.
In VŠIT 2025, CZSO reports that 43% of persons aged 16+ in Czechia said they had changed cookie settings; in the age group 16 to 34 it was 62%, among persons 75+ it was 7% [1]. The figure measures a self-report about a change of settings, not the legal quality of consent and not the actual number of trackers. It does show that part of the population no longer treats the cookie bar as mere website background.
What needs to be tested
On your own browser it is enough to start simply. Which sites have an exception? Which extension blocks or allows tracking? Which services hold a login? This is not an audit of someone else’s computer. It is a check of your own layer, which has different rules from an account, a phone or a public register.
7. Deindexing is not deletion
The right to be forgotten is often shortened in ordinary speech to “they deleted me from Google”. But the judgment of the Court of Justice of the EU in Google Spain, and the practice that followed, aims at search results by name, not at the automatic disappearance of the source page [8]. The later case Google v. CNIL rejected a duty of global deindexing as a general rule of Union law [9].
In its guidelines on the right to be forgotten in search engines, the EDPB distinguishes the role of the search engine and the role of the publisher of the source content [7]. That is the core of the matter. A link can disappear from a European name search while the page remains at the original address. Whoever knows the URL can find it. Another search engine can display it differently. An archive or a copy can live on.
A study by a Google team for the period May 2014 to May 2019 reports that Google deindexed 44.5% of requested URLs in requests under the right to be forgotten [10]. This is a historical window of one service and one type of request. It does not measure deletion of the internet, it says nothing about every request today and it is certainly not a promise of a result. It only shows the difference between a request, a search result and source content.
Deindexing deletes a link under a name. It does not delete the page. And Article 15 shows one controller, not the internet.
— Jiný Kontext
8. A public register is not everything about a person
A public register is strong precisely because it is narrow. Act No. 304/2013 Coll. regulates public registers of legal and natural persons and the recording of registered facts [15]. Justice and ARES help verify a company, a role, an entry or a link to business [17] [18]. They are not diaries of private life.
Similarly, the cadastre of real estate records rights to property. Section 52 of the Cadastre Act regulates inspection of the cadastre [16]. The practical weight of an entry concerns a plot, a building, a unit or a right. It is not a telephone directory of residents and it should not be used to build a “name, address, contact” procedure about a stranger.
For your own footprint a public record has a different sense. A person can look at whether their company, role or property matches reality, whether an old document still sits somewhere and whether the recorded fact is still true. That is a check of your own legal picture. It is not a search into someone else’s privacy.
9. An American broker catalogue is not Czech OSINT
In an analysis published in 2025, Privacy Rights Clearinghouse reports that at the beginning of April 2025 it found 750 unique groups of data brokers registered in at least one of five American state registers [22]. The figure is useful if we know what it measures. It is a floor of registrations in the USA, not the number of data brokers in Czechia and not the number of profiles of Czech residents.
In the European Union a data broker is governed by the GDPR like any other controller of personal data. That is a strong rule, but it is not a single public catalogue of every firm that trades in data. Whoever transfers the American number into the Czech sentence “there are 750 brokers about you” is making a precise number for the wrong population.
In its documentation of App Tracking Transparency, Apple lists sharing data with data brokers as one of the purposes of tracking for which apps ask permission [13]. That is useful for understanding your own device and apps. It is not a list of firms that have a record of you in particular. Again: a trace exists, but its weight depends on the layer, the controller and the geography.
10. One Article 17 request does not delete copies
Article 17 GDPR regulates the right to erasure under stated conditions [3]. It is not a magic button. If the controller has published the data, paragraph 2 speaks of reasonable steps to inform other controllers processing those data. It does not say that one email will physically destroy every cache, screenshot, downloaded file and forwarded copy.
The time limit is also concrete. Article 12(3) GDPR says that the controller shall provide information on action taken without undue delay and in any event within one month of receipt of the request; depending on complexity and the number of requests the period may be extended by up to a further two months [3]. This is a time limit for the controller’s response, not a promise of complete disappearance of a footprint.
In VŠIT 2025, CZSO reports that a request to delete data previously provided on the internet was made by 21.2% of persons aged 16+ in Czechia, that is 1,838.7 thousand persons; the figure has a broad definition and also includes situations such as unsubscribing from a newsletter [1]. The number measures people’s behaviour, not the success of erasure and not the extent of copies. The precision of a statistic must not cover the limit of what it actually counts.
11. Sixty-three percent of networks is not a complete profile
Social networks are the most visible part of a digital footprint, and that is why they invite exaggeration. In VŠIT 2025, CZSO reports social-network use among 63.2% of persons aged 16+ in private households in Czechia, that is 5,492.6 thousand persons [1]. In 2020 it was 54% and in 2009 it was 5% [1]. That measures the spread of use, not a complete profile of every person.
The same source reports that 15.7% of social-network users had a fully public profile and posts, that is 863.9 thousand persons; 79.6% had at least sometimes set privacy and 4.7% did not know the settings [1]. This is a self-report. We do not know from it whether a service profiles a person for advertising, whether someone downloaded a copy or whether a namesake is mixing into search results.
The age layer looks different again. Among persons 75+, CZSO reports social-network use of 9.4% [1]. A digital footprint is therefore common, but not universal in the same way for everyone. Whoever says “everyone has a public profile” misses the population. Whoever says “older people have no digital footprint” misses accounts, official records, operators, family devices and copies.
12. Article 15 shows a picture with one controller. Not the whole footprint
The right of access under Article 15 GDPR gives a person the possibility to ask a particular controller whether and how it processes their personal data [3]. In Guidelines 01/2022 the EDPB explains how a controller is to fulfil the right of access [6]. That is a strong tool. It is not, however, a statutory “extract of the digital footprint of a citizen of the Czech Republic”.
When you ask an operator, you get the operator’s picture. When you ask a social network, you get the social network’s picture. When you download data from your own account through Google Takeout, you obtain an export at Google [11]. Each extract has its own structure, time range, exceptions and controller. Only their comparison shows a map. Even then it is not the internet.
In VŠIT 2025, CZSO reports that refusal of personal data for advertising purposes at least once in three months was stated by 58.2% of persons aged 16+ in Czechia, that is 5,060.2 thousand persons [1]. Checking the security of a page when entering data was stated by 45.6%, while the chapter text speaks in rounded terms of 46% [1]. A change of access to device location was stated by 52% [1]. All of these figures speak of people’s behaviour. They do not say what individual controllers hold about them.
13. Six months with an operator is a different layer from a cookie
The Electronic Communications Act, Section 97(3), works with the retention of traffic and location data for 6 months [19]. These are network metadata, not the content of communication. That is a different layer from a cookie in a browser, an advertising ID on a phone or a profile with a social network.
In a press release on decision 30 Cdo 2556/2025 of 8 January 2026, the Supreme Court stated a conclusion on the unlawfulness of blanket retention of electronic-communications data in relation to EU law [20]. This text does not turn that into an article about data retention or police location. It uses it only as a boundary: the same person can have cookies, a public profile, an account with a platform and network metadata with an operator side by side. Each layer has a different purpose and a different regime.
A practical error arises when network metadata are added to the general sentence “the phone knows everything”. Metadata are not content. Nor is content always with the operator. And a statutory duty of retention is not a user’s consent to advertising tracking. The rules of one layer cannot be inferred from another.
14. Deliberate publication and a broker differ in weight, not only in visibility
A public profile is conspicuous. A broker’s record can be hidden. That invites the conclusion that the first is less serious and the second always more accurate. But visibility and weight are not the same. A public profile can contain a real name and photograph, but also irony, an old job or a namesake. A broker’s record can be extensive, but duplicated, derived and wrongly assigned.
Neither layer is a register of civil status. A profile is a statement in the environment of a service. A broker’s segment is a commercial hypothesis over sources that must be known. In both cases one must ask about origin, updating, the controller and the possibility of correction. It does not follow that they are the same. It follows that they deceive differently.
For your own footprint that means two kinds of work. The public layer can often be cleaned directly: old profiles, visibility of posts, photographs, captions, linked accounts. The hidden commercial layer can be handled only toward a particular controller, if you know them, or through platform settings, consents, advertising preferences and rights under the GDPR. The feeling that a catalogue exists somewhere is not enough.
15. A copy outlives the author. Recital 27 is a different file
A digital footprint does not die at the moment the author deletes a post. Someone may have quoted it, downloaded it, forwarded it or saved it in a backup. A search engine may have had a snippet. An app may have created a preview. A controller may have held a log. This durability is not always ill will. It is a property of a distributed environment in which data are copied for speed, backups, integrations and human convenience.
Recital 27 of the GDPR states that it does not apply to the personal data of deceased persons, while Member States may lay down rules for the processing of such data [3]. That is a boundary, not an invitation to a detour. Digital inheritance of accounts after death is another text. Here it is enough to say that a copy can outlive the author’s original intention and their control of the account.
That is why it is more cautious to speak of reducing visibility than of absolute erasure. A change of settings, a request to a controller, deindexing and deletion of an account can be the right steps. They are not the same step and they do not have the same result. Cleaning a footprint is gradual work with layers, not a one-off cleansing of the internet.
A copy also changes the addressee of a request. With the original service you can ask the controller. With a search engine you can address a search result. With a post that someone else took over, you are already dealing with another controller or a new context. That is inconvenient, but precise. One request to the wrong place can be lawfully handled without a result, because the addressee does not control the layer that bothers the person. That is why, before each step, the map gets a column “who can change it”.
16. A map of your own footprint says more than the sentence that the internet knows everything
A practical test should be the reader’s defence. Not a search for a stranger. The aim is to find which layers of your own footprint exist, where they are administered and what follows from them. The moment the test turns into assembling someone else’s address, phone or privacy, it has stopped being hygiene and has become a risk.
Three tests of your own footprint
The first test is the deliberate layer. In a private window search for your name and your email, that is, data you yourselves enter. Sort the results into “me”, “namesake”, “register”, “news” and “other people’s content”. It is not a file. It is a list of visible finds and confusions.
The second test is the account and the browser. Download data from your own account using Google Takeout or a similar export at a service you use [11]. Next to that, look at cookies, site permissions and advertising settings in your own browser. Compare what is public and what only the account controller sees.
The third test is the device and the content. On the phone find the advertising ID, app permissions and signed-in accounts. Separate the device identifier, the account and the content of communication. Resetting an identifier is not deletion of messages. Signing out of an account is not deletion of a public page. Each step belongs to its layer.
The result of the test should not be a feeling of guilt. It should be a working list. For each item four columns are enough: layer, controller, visibility and a possible step. A public profile has a different step from an old register document. A cookie in the browser has a different step from account history. A copy with someone else has a different step from a post you still hold in your own account. Such a table is less impressive than the sentence “the internet knows everything”. It is, however, usable.
What needs to be tested with Article 15
Choose two controllers you know: say your own operator and one platform. Request access under Article 15 GDPR and watch the one-month time limit with a possible extension under Article 12(3) [3]. Read the answer as the picture of one controller, not as a complete footprint.
Before a request for erasure and deindexing
First find the source. If the problem is on a page, write to the controller of the page. If it is a search result by name, address the search engine; Google offers tools for this, including Results about you [12]. The historical 44.5% of deindexed URLs at Google in the period 2014 to 2019 is not a promise. It is a reminder that the result of a request depends on the law, the content and the controller [10].
The same rule holds for public records. For your own company or your own property, first check whether the recorded fact is correct and current. If it is, it is not an error merely because it is public. If it is not, correction is handled under the rules of the record. This test is not done on a stranger. This article is not a manual for assembling someone’s address from official traces.
17. The question is not what the internet knows about you. It is which layer can bear which conclusion
A digital footprint is not one vault, one profile or one verdict. It is a set of records that arise with different controllers and serve different purposes. Some are public. Some are visible only after sign-in. Some are technical. Some have a legal effect. Some are copies that the author no longer controls.
The hidden cost is not only a loss of privacy. It is a biography assembled from unlike traces. When a cookie is read as character, a register as privacy and an American list of brokers as Czech reality, a picture arises that looks precise because it has many items. The precision of an item is not the precision of a conclusion.
The same caution holds inside a family or a firm. One laptop is used by several people. One phone can be a work phone. One address can serve a whole household. One role in a register can outlive the actual work on a project. A digital footprint is therefore not only a question of privacy. It is a question of attribution. Whoever does not know whom a record belongs to and why it arose should not make a strong sentence from it.
The right question is therefore not: “What does the internet know about me?” The right question is: “Which layer of the footprint can bear which conclusion, who administers it and how can I verify or correct it for myself?” At that moment an undefined panic becomes a map. It is not perfect. But it is precise enough that a person does not chase the whole internet and does not begin to assemble someone else’s life from someone else’s traces.
Such a map has a second value as well. It teaches you to brake your own interpretation. Once a person has, for themselves, distinguished an account, a cookie, a register and a copy, they more easily use the same distinction in a public debate, a newspaper text or a company decision. The digital footprint then no longer acts as a fog in which anything can be claimed. It becomes a set of limited records. Some require correction. Some require only lower visibility. And some require mainly the sentence: from this, what we would like to say does not yet follow.
Related texts in this series
- On the site, the series A digital footprint is not a verdict — court evidence. This text is an everyday GDPR/OSINT map.
- What can Google find out about you from a single name?
- What does your mobile phone know about you?