Identifying Information Online: Decide What You Share, With Whom

Additional resource for the lesson “What to Share” — Online Anonymity course

Identifying information online is not only your name and your face. It is also the small details that point back to you once they are put together, and the places where they end up after you press “post”. This resource gives you a simple rule for deciding what you share, with whom and for how long, so that what links back to you is something you chose.

A. Why this matters

Sharing is part of ordinary life online: a photo with friends, a comment in a group, a question in a forum, a clip from a game. None of that is a mistake, and this resource is not about sharing less. It is about sharing on purpose.

In this course, privacy is deciding what others know about you; anonymity is being able to act without what you do being linked back to who you are. Identifying information is what does the linking. A review written under a nickname, a gaming profile or an account for a hobby stays separate from your name only as long as nothing in it points back to you.

Lists of things never to share are useful, but a list cannot cover every life: what is harmless for one person is identifying for another. A rule you can apply in a few seconds travels further than a list. This resource looks at identifying information online through that rule, and leaves the settings themselves to the Online Privacy resources mentioned below.

What the sources say

The UK’s Information Commissioner’s Office (ICO), the independent data protection authority, explains that a person can be identified directly, or “indirectly identified from that information in combination with other information.” Its guide adds that “a combination of identifiers may be needed to identify an individual.”

In the United States, the National Institute of Standards and Technology (NIST) uses the term “personally identifiable information” for information that identifies someone “either alone or when combined with other information that is linked or linkable to a specific individual.”

The Electronic Frontier Foundation (EFF), a digital rights organisation, adds the anonymity angle in its Surveillance Self-Defense guide: “For a lot of us, it’s critical to keep different account identities separate.” It warns that photos, in particular, “can sneakily link accounts you intend to keep separate.”

B. Key concepts: identifying information online

Five ideas behind the three questions: two about what identifies you, one about what links your accounts, and two about where your information goes next.

Direct identifiers

Some details point to you on their own: your full name, your face, your phone number, your email address, an identification number. The ICO’s list of identifiers includes a name, an identification number, location data and “an online identifier”. In the United States the usual umbrella term is personally identifiable information, or PII; in the UK and the EU, the law speaks of personal data.

Why it matters to you: A single direct identifier is enough to connect a post, a profile or a conversation to you. These are the details worth the most thought, because one appearance can be enough.

Identifying in combination

Other details are ordinary on their own and identifying together: the university you attend, the street you live on, the bus you take at eight, where you work on Saturdays, your pet’s name. Each one is shared by many people. A few of them together may be shared by very few. Why a handful of details narrows the crowd so quickly is explained in the re-identification resource of this course.

Why it matters to you: You do not have to hide every ordinary detail. It usually helps more to notice which details you tend to share together, and to keep one of them back.

Links between your accounts

Identifying information also links one part of your life to another. The same username in a game and on a social network, the same profile photo, the same email address or phone number used to register: each one can join accounts you meant to keep apart. The EFF suggests that if you want to keep an account’s identity separate, you “use a separate email address and avoid giving your phone number”, and use an image you do not use anywhere else.

Why it matters to you: This is often where anonymity holds or slips. A nickname protects you only while nothing else in that account matches your named one.

Audience: who sees it, and who they can pass it to

Every post has a first audience: the public, your followers, a group chat, one person. But an audience is made of people, and people forward, quote and screenshot. The EFF notes that “friends can still unintentionally identify you, report your location, and make their connections to you public.”

Even disappearing messages have this limit. Signal, whose app offers them, explains that the feature is “not for situations where your contact is your adversary”, because a recipient “can always use another camera to take a photo of the screen before the message disappears.”

Why it matters to you: Choosing a smaller audience changes who sees something first. It does not decide where it goes next, so the question is also whether you trust that audience with it.

Time: how long it stays

What you share today may still be findable in five years. Pages can be copied or archived: the Internet Archive’s help pages explain that its “Save Page Now” feature can be used “to save a specific page one time”, on request. Search engines can keep showing a page long after you have forgotten it.

In the EU you can ask a search engine to remove certain results linked to your name, but the European Data Protection Board (EDPB) points out that “delisting does not mean deleting the original content from the internet.”

Why it matters to you: Deleting a post is worth doing, but it is not the same as never having shared it. For details you would not want attached to your name later, the best moment to decide is before you share.

C. A practical example: Marco’s gamer tag

Marco is 22, studies engineering and plays online games most evenings. He has used the same gamer tag for years: on his gaming platform, on the video site where he posts clips, and on his main social profile, which shows his real name and his face. On a gaming chat server with a few hundred members, he chats freely: the city where he studies, his course, the supermarket where he works on Saturdays, the name of his dog, who often barks in his clips.

One evening a player he barely knew sent him a friendly message: “You work at the supermarket near the station, right? I think I saw you there.” Nothing bad happened. But Marco realised that someone he had never told his name had put it together, and that the link ran through details he had shared without thinking: one gamer tag, used everywhere, and a few ordinary facts dropped over months.

What changed when Marco sorted his details

Marco did the exercise in section D the next weekend, curious rather than worried:

• He marked his real name and face as direct identifiers, and his course, his city and his Saturday job as details that became identifying together.
• He noticed that the gamer tag was the link between his gaming life and his named profile. He kept the tag for gaming and gave his social profile a different handle and no gaming clips.
• His Saturday job went into the “keep” pile: he stopped mentioning where and when he works. His course and city went into “fine with a smaller audience”, for a small channel with friends he knows.
• His dog stayed in the clips. It is part of the fun, and on its own it says very little.

He also deleted a couple of old messages about his job, and accepted that someone might have copied them already. He did not give up his gaming identity; he loosened the one link that tied it to his name.

D. Try it yourself: sort ten things you share (15 minutes)

Four short steps, on paper or in a note. Write categories, not the details themselves: “my street”, not the street name. Whatever you decide, it is your context that counts, not someone else’s list.

Step 1 — List ten things you share, or might (3 minutes)

Pick ten from your own life. If you are stuck, start from these:

• Your full name, your face, your phone number.
• Your school, university or employer, and your job title.
• Your neighbourhood or street, and the places you go regularly.
• Your daily routine: the gym, the bus, the café.
• A username or gamer tag, and the email you use to register.
• Your birthday, your pet’s name, your plans for next weekend.
• Photos of tickets, cards or documents, and your current location.

Step 2 — Mark how each one identifies you (3 minutes)

Next to each item, write one or more letters:

• D if it points to you on its own (a direct identifier).
• C if it is ordinary alone but identifying in combination with others on your list.
• L if it appears in two or more accounts you would rather keep apart.

Step 3 — Add the audience and the time (5 minutes)

For each item, ask:

• Where do you usually share it, and who sees it there: anyone, followers, a group, one person?
• Could someone in that audience pass it on, and would that matter to you?
• Would you mind if it were still findable, next to your name, in five years?

Step 4 — Sort into three piles and make one change (4 minutes)

• Fine: you are comfortable with it being public and lasting.
• Fine with a smaller audience: you share it, but only with people you know, or in one place rather than everywhere.
• Keep: it stays out of posts, profiles and group chats. Payment details, passwords and photos of documents usually belong here.

Then choose one change you can make today, such as a separate username, one detail removed from a profile, or one item moved to a smaller audience. One deliberate choice beats a long list of rules.

Already covered in the Online Privacy course

Social Media Privacy Settings: A 10-Minute Visibility Check
It walks through the audience settings of your profile, seen as a stranger sees it; this resource adds a rule for deciding what to share, with whom and for how long, before it reaches a profile at all.

Oversharing Online: What Your Last Ten Posts Really Say
It audits your recent posts for live location, routines, documents and backgrounds; this resource looks ahead, at how identifying details link your accounts and your name before you post.

E. Videos, articles and further resources

Institutional sources first, then a digital rights guide and two pages on how shared content lasts. All in English.

Institutional sources

Information Commissioner’s Office (UK) — What is personal information: a guide
How people can be identified directly or indirectly, and why a combination of identifiers can be enough.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-information-a-guide/

NIST (US) — Glossary: personally identifiable information
The US definitions of PII, including information “linked or linkable” to a person.
https://csrc.nist.gov/glossary/term/personally_identifiable_information

European Data Protection Board — Search engine delisting: When to act and what to do
A 2026 factsheet on asking search engines to remove results linked to your name, and what delisting does not delete.
https://www.edpb.europa.eu/system/files/2026-06/edpb-factsheet-search-engine-delisting_en.pdf

Digital rights guide

Electronic Frontier Foundation — Protecting Yourself on Social Networks
Keeping account identities separate, registering with less information, and how friends and photos can link accounts.
https://ssd.eff.org/module/protecting-yourself-social-networks

How shared content lasts

Signal Support — Set and manage disappearing messages
How disappearing messages work, and why they do not stop a recipient keeping a copy.
https://support.signal.org/hc/en-us/articles/360007320771-Set-and-manage-disappearing-messages

Internet Archive Help Center — Using the Wayback Machine
How public web pages are archived, how a single page can be saved on request, and how to ask for an exclusion.
https://help.archive.org/help/using-the-wayback-machine/

Links checked in November 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Secure Behaviour pillar at level FL2 – Beginner: turning a short rule into a habit you apply before you share.

Skills

• Telling direct identifiers from details that identify you in combination.
• Spotting the usernames, photos and emails that link accounts you want kept apart.
• Sorting what you share into fine, fine with a smaller audience, and keep.

Awareness

• Understanding that ordinary details can identify you once they are put together.
• Knowing that an audience can pass things on, even when a message is set to disappear.
• Recognising that deleting or delisting something is not the same as never having shared it.

Secure Behaviour

• Asking the three questions before you share: what it identifies, who sees it, how long it stays.
• Keeping a separate username, photo and email for an identity you want kept apart.
• Sharing the details that identify you in combination with smaller audiences, not everywhere.

G. Questions to sit with

• Which detail about you is harmless in one place and identifying in another?
• Is there an account or a nickname you would like to keep apart from your name, and what currently links them?
• Which of your audiences do you trust most with what you share, and why?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. Choose the audience before you share

• MS6 — Set your social media accounts to private where you do not need a public profile, so that the first audience of what you share is one you chose (the Online Privacy resource above walks through the settings).
• R23 — Connect only with people you know: a smaller audience only helps if you know who is in it, since each person in it can pass things on.

Minimum commitment: before your next post or message to a large group, ask the three questions once: what does it identify, who will see it, how long will it stay?

2. Loosen the links that already exist

• MS12 — Search for your phone number online and ask sites to remove it: a phone number is one of the most direct links between an account and a person.
• Give an account you want kept apart its own username, photo and email address, rather than reusing the ones linked to your name.

• If old results about you appear when someone searches your name, in the EU you can ask the search engine to delist them, as of November 2026; the original page stays online, so ask the site owner too. Rules vary by country.

Minimum commitment: this week, find one username or profile photo you use in two places you would rather keep apart, and change one of them.

In short

• Identifying information online includes direct identifiers and ordinary details that identify you together.
• Usernames, photos, emails and phone numbers can link accounts you meant to keep apart.
• An audience can pass things on, and what you share can outlast a deletion.
• Before you share, ask what it identifies, who will see it and how long it will stay, then choose: fine, smaller audience, or keep.

Related resources in this course

• Remove Metadata from Photos Before You Share: A Practical Guide
• Share Sensitive Documents Online: Send Only What Is Needed
• How to Prevent Doxxing: Spot the Signs, Reduce Your Exposure
• Re-identification: Why a Few Details Can Identify You

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.