Your Digital Footprint: Map the Data Traces of One Ordinary Day

Additional resource for the lesson “What Data We Generate Every Day” — Online Privacy course

Your digital footprint is not only what you post. It is also what your phone, apps and accounts record while you get on with an ordinary day, and what is worked out from that. This resource helps you see one day’s data traces in three layers, so that you can decide which footprints to leave, rather than trying to erase them all.

A. Why this matters

The lesson used a simple image: footprints on sand, except that here no tide comes in to wash them away. Each trace on its own says very little. Together, across a day, they tell a story you never sat down to write.

Privacy, in this course, means three questions: what is known about you, by whom, and what you choose to let them know. You cannot answer the third until you have some sense of the first two, which is why this resource comes before any setting is changed.

The aim is not to live without traces. Many of them pay for something you value, such as directions or a playlist that suits you. The aim is to move some traces from chance to choice.

What the sources say

Data protection authorities describe personal data broadly. The European Commission explains that “different pieces of information, which together can lead to the identification of a particular person” may also count as personal data. Its examples include things you rarely think of as being about you: an IP address, a cookie ID and “the advertising identifier of your phone”.

The UK’s Information Commissioner’s Office (ICO), the independent authority for data protection in the UK, points out that the data you provide is not only what you type in. In its public guidance on data portability, it says that the data you provide “may include data the organisation has gathered from monitoring your activities when you have used a device or service”. Its examples include search and website history, traffic and location data, and the readings of connected objects such as smart meters and wearable devices.

The ICO also explains profiling: analysing or predicting aspects of someone’s behaviour, interests or habits. It notes that “less obvious forms of profiling involve drawing inferences from apparently unrelated aspects of people’s behaviour.” In the United States, the Federal Trade Commission (FTC) reminds consumers that some apps ask for access to information on your device, “like your location, your contacts, or your photos”, and suggests checking your phone’s privacy settings to see what they can reach.

B. Key concepts

Five ideas that turn the footprint image into something you can work with.

Declared data

What you knowingly provide: the name and email on an account, a photo you post, a review you write.

Why it matters to you: It is the layer you see most easily, because you chose it. But it is only one part of your digital footprint.

Observed data

What a service or device records while you use it: when you connect, where your phone is, what you search for, what you watch and for how long. The ICO’s examples include search activity, location data and the readings of wearable devices.

Why it matters to you: You do not have to do anything for this layer to grow. It builds up quietly, through ordinary use, which is why it can be surprising when you look for it.

Inferred data

What you were never asked and never said: conclusions drawn from the first two layers. Probable interests, likely plans, the kind of buyer you seem to be. The ICO gives the example of predicting whether someone is likely to buy an item based on their past behaviour.

Why it matters to you: You rarely see this layer, yet it can shape the adverts and content you are shown. Limiting what is observed is the most direct way to limit what can be inferred.

Data trail

The chain your traces form when they are combined: across a day, a week, a year, and sometimes across services.

Why it matters to you: A trail can show where you live, when you leave home and what is on your mind. Thinking in trails helps you spot which small habits reveal the most.

Permissions as data decisions

A permission is the access an app asks for on your phone: your location, your contacts, your photos, your microphone. The level you grant decides how much observed data that app can collect.

On Android, Google’s help page lists location options such as “All the time”, “Allow only while using the app”, “Ask every time” and “Don’t allow”. On iPhone, Apple explains that you can choose “Allow Once” for a single session, and that location preferences can be changed in Settings › Privacy & Security › Location Services.

Why it matters to you: “All the time” versus “Allow only while using the app” is the difference between a trace when you open the app and a trace through your whole day. It looks technical; it is a choice about your footprint.

C. A practical example: Marco’s ordinary Tuesday

Marco is 22, a university student, and says, with a smile, that he has “nothing interesting to track”. On a Tuesday when he does nothing special, his day goes like this:

• 7:00: his phone shares its location with three apps that are allowed to use it all the time, including two he has not opened in weeks.
• 7:45: he pays for a coffee by card on the way to the station, as he does most mornings.
• 8:20: on the train, his news app records the two articles he opens, both about renting a flat.
• 13:10: at lunch, he searches “knee pain after running”.
• 18:30: he signs in to a new food delivery app with his social media account, because it is one tap instead of a form.
• 21:30: his streaming service notes that he stops a film after twelve minutes.

None of these moments is dramatic. Put together, the trail suggests where Marco lives and studies, when he leaves home, a financial interest, a possible health concern, his evening habits, and a new link between his social media account and a delivery service. All on a day when he did “nothing”.

What changed when Marco mapped it

Marco did the exercise below one evening. He was not alarmed, only surprised by a few things:

• He had not realised that apps he no longer used still had his location all the time.
• He had not thought of the “sign in with” button as a link between two companies’ records about him.
• The health search made him stop and think, but he decided it was a reasonable trade for the answer he got.

He made one decision that evening: he moved the two forgotten apps to “Don’t allow” and the map app to “Allow only while using the app”. The following week he made a second: he gave the delivery app its own email and password. He kept his coffee and streaming habits as they were. That is the point: not fewer footprints everywhere, but the ones he chose.

D. Try it yourself: map one ordinary day (15 minutes)

Four short steps, best done at the end of a normal day, on paper or in a note on your phone. Nothing you find means you have done something wrong.

Step 1 — Walk your day backwards (5 minutes)

• Start from this evening and go back to the moment you woke up.
• List every moment a device or account could have recorded something: waking up, journeys, payments, searches, messages, photos, music, series, sign-ins.
• Aim for moments, not completeness.

Step 2 — Tag each trace D, O or I (5 minutes)

• Next to each moment, write D if you declared it (you typed or posted it), O if it was observed (recorded while you used something), or I if something could probably be inferred from it.
• One moment can carry more than one letter: a search is observed, and it may also lead to an inference.
• Notice which letter appears most often. It is your own picture, not a score.

Step 3 — Circle the surprises (2 minutes)

• Circle two or three traces you had never thought about before.
• Choose the ones that surprised you, not the ones that seem worst. Surprise is a sign that your awareness has just grown.

Step 4 — Make one decision (3 minutes)

For one circled trace only, choose one of three options:

• Keep it: the convenience is worth the trace, and now you know it is there.
• Limit it: lower a permission or change a setting.
• Stop it: turn the feature off or remove the app.

If your decision is about location, the setting is usually under Settings › Apps or Settings › Privacy on your phone. On Android you can choose “Allow only while using the app” instead of “All the time”.

One deliberate footprint is worth more than a long list of intentions.

Already covered in the Online Security course

Map Your Digital Life: Where Your Protection Really Starts
It maps your accounts and devices from the security side, as an attack surface to protect, while this resource maps the data those accounts and devices produce about you.

E. Videos, articles and further resources

Institutional sources first, then a digital rights guide and official platform help pages. All in English.

Institutional sources

Information Commissioner’s Office (UK) — Your right to data portability
In plain language: the data you provide includes what is gathered while you use a device or service.
https://ico.org.uk/for-the-public/your-right-to-data-portability/

Information Commissioner’s Office (UK) — What is ADM?
Guidance on automated decision-making and profiling: how predictions about behaviour and interests are drawn from personal data.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/automated-decision-making/what-is-adm/

European Commission — Data protection explained
What counts as personal data, with everyday examples such as a cookie ID and your phone’s advertising identifier.
https://commission.europa.eu/law/law-topic/data-protection/data-protection-explained_en

FTC (US) — How Websites and Apps Collect and Use Your Information
How websites and apps follow your activity, and where to check what apps can access on your phone.
https://consumer.ftc.gov/articles/how-websites-and-apps-collect-and-use-your-information

Digital rights guide

Electronic Frontier Foundation — The Problem with Mobile Phones
How a phone reveals where you are, and why it helps to restrict which apps can see your location.
https://ssd.eff.org/module/problem-mobile-phones

Platform documentation

Android Help — Change app permissions on your Android phone
Where to find each app’s permissions and the location options you can choose.
https://support.google.com/android/answer/9431959?hl=en-GB

Apple Support — About privacy and Location Services on iOS, iPadOS and watchOS
How location permissions work on iPhone and where to change them.
https://support.apple.com/en-gb/102515

Google Account Help — How Sign in with Google works
What is shared with an app when you sign in with your Google Account, and how to review linked apps.
https://support.google.com/accounts/answer/12849458?hl=en-GB

Links checked in October 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Awareness pillar at level FL1 – Basic, where the work is seeing your own data clearly before configuring anything.

Skills

• Telling declared, observed and inferred data apart in your own day.
• Reading an app permission as a decision about your footprint.
• Finding the location permissions on your own phone.

Awareness

• Recognising that your digital footprint includes what is recorded and inferred, not only what you post.
• Understanding that single traces combine into a trail that says much more.
• Treating surprise as useful information, not as a reason for alarm.

Secure Behaviour

• Turning one surprise into one deliberate choice: keep, limit or stop.
• Granting location only while an app is in use, unless there is a clear reason for more.
• Repeating the day map now and then, because apps and habits change.

G. Questions to sit with

• Which single trace on your map would tell a stranger the most about your routine?
• Which convenience in your day feels fairly paid for by its trace, and which no longer seems worth it?
• If you could see the inferences drawn from your day, which one would you most like to check?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. Location and apps

• R12 — Turn off Bluetooth and location when you do not need them, so that your phone leaves fewer traces of where you are.
• R13 — Check what your apps can do: review each app’s permissions and lower the ones it does not need.

Minimum commitment: today, move one app with no clear reason for constant location access to “Allow only while using the app” or “Don’t allow”.

2. Accounts and what they link

• R31 — Limit social login: signing in “with” a social or Google account links that account to a new service. In your Google Account you can review the apps linked this way and remove the ones you no longer use.
• MS7 — Limit access to your account, photos and posts by changing privacy settings, so that what you declare reaches only the people you choose.

Minimum commitment: choose one service you signed in to with a social account and decide, knowingly, whether to keep the link or give it its own sign-in.

In short

• Your digital footprint has three layers: what you declare, what is observed while you use things, and what is inferred from both.
• Single traces say little; combined into a trail, they describe your day.
• Permissions are data decisions: “Allow only while using the app” leaves fewer traces than “All the time”.
• The goal is not to erase every trace. It is to decide which ones to leave.

Related resources in this course

• Social Media Privacy Settings: A 10-Minute Visibility Check
• Oversharing Online: What Your Last Ten Posts Really Say
• Privacy Dashboard: What ‘Free’ Services Know About You

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.