What is a digital footprint, and how do you check yours?

A digital footprint is the trail of data you leave behind when you use the internet. The Australian eSafety Commissioner describes it as the unique data created from your online activities, and the Internet Society calls digital footprints the records and traces we leave behind us as we use the internet. It includes what you post yourself, what other people post about you, and the records that websites, apps and devices keep as you use them.

The footprint matters because other people read it. eSafety notes that it is often the first thing someone sees when they search your name, including a possible employer. The UK National Cyber Security Centre (NCSC) adds that criminals can use the same details to steal an identity or to make a phishing message more convincing. The Internet Society notes that companies use it to track you, tailor what you see and market to you.

UltoPulto calls the public, findable part of this personal exposure: the places where your name, contact details, photos and face can be found and reused by people and systems you never dealt with. The terms are defined in the glossary.

The Internet Society's reference framework separates the footprint into two parts. The first is the explicit footprint: the things you knowingly share, such as a post, an uploaded photo or an email. The second is the implicit footprint: the trail you leave as you move around the web without posting anything. Each site you visit can see your IP address (the number that identifies your connection and often your rough location), your browser and operating system, and often the last site you came from. Cookies tie those visits together into one stream. You will also see these two parts called an active footprint and a passive footprint.

The US Federal Trade Commission (FTC) describes the collecting side in plain terms. When a website you visit tracks you, that is first-party tracking. When it lets another company track you, that is third-party tracking. Apps add to the implicit footprint too, by asking for access to your location, your contacts or your photos.

• Posts, comments, likes and shares on social media, including ones from years ago. eSafety notes that the internet remembers more than you expect, and that old content can resurface.
• Photos and videos you shared or were tagged in, and photos that others post of you.
• Accounts you opened and no longer use. eSafety lists accounts used in the past among the things a name search can turn up.
• Online purchases, browsing history, app usage and location data, which the Internet Society lists as everyday sources of footprint data.
• Public records compiled online. The FTC says people-search sites build reports from government public records, public social media profiles and other data brokers.
• Your email address in a data breach. Have I Been Pwned defines a breach as an incident where data is inadvertently exposed in a vulnerable system.

Use a private browser window so your own logged-in accounts do not shape the results, and write down what you find with the date and the web address.

1. 1.Search your name in quotation marks, then run it again with your city, your employer and your school. eSafety recommends searching your name to see what a potential employer or friend can find, and repeating the search regularly.
2. 2.Search your image. Google's search by image lets you upload a photo or paste an image link and shows websites with the image or a similar image. eSafety recommends searching your image as well as your name.
3. 3.Check breach records. Have I Been Pwned is a free service: enter your email address and it lists the breaches that address appears in. Its Notify Me option emails you if the address turns up in a future breach.
4. 4.Check people-search sites. The FTC says these sites compile reports from public records, public social profiles and other brokers, and that most let you opt out. Search your name and city on each large site. Our data broker checklist lists the common ones with their opt-out pages.
5. 5.List your old accounts. Search your inbox for phrases such as "welcome", "verify your email" and "your account" to find services you signed up to and forgot. eSafety notes that if you have forgotten the details for an old account, the platform may be able to help once you verify your identity.
6. 6.Review app permissions. The FTC advises opening the privacy settings on your phone to see which apps can reach your location, contacts or photos, then turning off permissions an app does not need or deleting apps that ask for too many.
7. 7.Check your own profiles while logged out, to see what a stranger sees.

The free Exposure Scan does part of this for you. It checks people-search sites, known breach records, face-search engines (as guided steps, because those engines ask for your own photo) and AI dataset indexes, and turns what it finds into an Exposure Score from 0 to 100. Results stay hidden until you confirm a code sent to the email you entered. Breach lookups use the Have I Been Pwned service and need a licensed key that is not yet connected, so the demo shows sample breach results until then.

Start with what you control. eSafety's advice is to delete anything from your own accounts that you no longer think is appropriate, to limit who can see your posts, and to check those privacy settings regularly, because they help but do not cover everything. If you are uncomfortable with something another person posted, un-tag yourself or ask them to edit you out or take it down.

• Close accounts you no longer use, so the data in them stops being available to the service and to anyone who breaches it.
• Opt out of people-search listings one site at a time. The FTC confirms you can do this yourself for free. Our guide to removing your home address from the internet walks through it.
• Shrink the implicit footprint. The Internet Society suggests reviewing the privacy settings on your browser, devices and apps instead of accepting the defaults, questioning requests for notifications and location, and blocking third-party cookies where you can. The FTC notes that browser privacy settings can block sites from seeing your browsing history.
• Use separate email addresses for different parts of your life, another Internet Society tip, so one leak does not connect everything.
• Turn on 2-step verification (2SV). The NCSC says a criminal who knows your password still cannot get into an account that uses it.
• Use your legal rights where they exist. In the UK, the ICO explains that you can ask an organisation to erase your data in certain situations, that it has one calendar month to respond, and that it can refuse for reasons such as journalism or a legal duty to keep records. Our privacy rights finder shows what applies where you live.

Before you post, ask whether you would be comfortable with a future employer seeing it. The Internet Society puts the same idea bluntly: it is much easier to keep data from being shared than to remove it later.

Some of the footprint is permanent. The Internet Society warns that deleting online content often only removes it from public view, and that it can be stored in archives and databases indefinitely. eSafety says that once something is online it can be very difficult to remove, that it can be shared quickly, and that words and images can be altered on the way.

The same is true of structured data. The FTC says opting out of people-search sites does not delete anything from government public records, that your details may still appear in reports about relatives or neighbours, and that a listing can reappear when your records change. Under UK law, the ICO notes that an organisation which made your data public must take reasonable steps to tell others to erase links or copies, but that reaches only the copies it knows about. And data that was exposed in a breach has already left the company; changing the password and turning on 2SV limits what someone can do with it, but does not recall the copy.

So treat the footprint as something you check and trim on a schedule, not something you clear once. Search again every few months, re-check the listings you opted out of, and keep your log.