Most of your digital footprint is created without a decision to share. This guide explains cookies, metadata, who collects your data and why, your rights, and practical habits that shrink your footprint, with diagrams and worked examples.
Every search, tap, purchase and photo leaves something behind, and most of it is collected without you ever making a decision to share it. That trail is called your digital footprint. It can be useful, because it lets apps remember your settings and recommend things you like, but it can also be used to profile you, to target you with scams, or to expose details you meant to keep private. This guide explains what the trail is made of, how websites and apps follow you, who collects the data and why, what the law says, and which habits reduce your exposure. The aim is not to frighten you off the internet. It is to help you make informed choices.
Helpful background: Search Engines & Web Browsers explains cookies and private windows, and Cybersecurity Basics covers the passwords and phishing protections that go hand in hand with privacy.
Your digital footprint is the record of data about you that exists because of your online activity. It helps to separate it into three layers, depending on how much you control it:
There is also data about you that other people create, such as a photo a friend posts and tags you in. The passive and inferred layers are usually far larger than the active one, and far less visible.
Here is a made-up school day. For each activity, think about what data it probably creates.
| Activity | Data likely created | Kind |
|---|---|---|
| Weather app checked at breakfast | Approximate location, device details, time | Passive |
| Map app used on the way to school | Route and location history | Passive |
| Logging in to the school learning platform | Account, login times, activity records | Passive |
| Paying for lunch with a cashless card | Purchase record | Passive |
| Watching videos and searching in the evening | Search and watch history; interest guesses | Passive and inferred |
| Posting a photo to friends | The photo, caption, time, possibly location | Active |
Tally: six activities, but only one was a deliberate decision to share. That is 1 ÷ 6 ≈ 17%. The other five happened as a side effect of ordinary life. This is why a footprint is so much bigger than most people expect, and why habits and settings matter more than any single post.
Fairness note: not all of this is harmful. Much of it makes the services work. The question is who else can see it, how long it is kept, and whether you were told.
A cookie is a small piece of data that a website asks your browser to store, so the site can recognise you on your next request. First-party cookies, set by the site you are visiting, keep you logged in or remember items in a basket. Third-party cookies are set by another company whose code is embedded in the page, often an advertising or analytics company. Because the same company's code appears on many different sites, it can recognise you across all of them and build up a picture of what you browse.
Cookies are not the only method:
Browsers differ in how they treat third-party cookies, and some block them by default, but the rules and settings keep changing, so check your own browser's privacy settings. In many places the law requires websites to ask for your consent before using non-essential cookies, which is why you see cookie banners. Where there is a choice, the options usually separate essential cookies (needed for the site to work), analytics (counting visits) and advertising (profiling and targeting). Choosing only what is necessary is a simple way to cut tracking.
Metadata is data about data. Think of a posted letter. The writing inside is the content. The sender, the receiver, the postmark and the date on the outside are the metadata. A photo has content (the picture) and metadata, which may include the time it was taken, the camera model and sometimes the exact GPS location. A message has content and metadata: who sent it, to whom, when, how often, and from which device.
Here is an invented week of call and message records for a student called Sam. No one has read a single message or heard a single call.
| Day and time | Record |
|---|---|
| Mon 07:10 | Call to "City Taxis" (2 min) |
| Mon 22:40 | 45 messages with "Alex" |
| Tue 16:05 | Call to "Coach Rao" (1 min) |
| Wed 07:10 | Call to "City Taxis" (2 min) |
| Wed 22:15 | 52 messages with "Alex" |
| Sat 10:00 | Call to "Central Library" (1 min) |
Possible inferences: Sam probably takes a taxi on some mornings, is in frequent late-evening contact with Alex, has some connection to a coach (perhaps a sport) and may use the library on weekends.
What this shows: routines, relationships and interests can be sketched from labels alone.
The other lesson: inferences are only guesses. The taxi could be for a sibling, "Coach Rao" might be a tutor, and Alex might be a cousin. Metadata creates a picture that is detailed but not always right, which is also why profiles built from it can be misleading.
Many social platforms remove location data from photos when you upload them, but not all do, and sending the original file directly may keep it. Check your phone's camera settings if you do not want locations stored in photos.
| Who | Why they collect it |
|---|---|
| Apps and websites | To make the service work, improve it and, often, to show advertising. Many free services are paid for by advertising. |
| Advertisers and analytics firms | To measure which adverts work and to target them at people likely to respond. |
| Data brokers | To combine data from many sources into profiles that can be sold or licensed to others. |
| Schools, employers and admissions staff | Some check public profiles or search results, in addition to the systems they run themselves. |
| Governments | In some situations, under the laws of that country, they can require companies to hand over data. |
| Criminals | To steal identities, craft convincing scams or sell stolen data, often through breaches. |
Companies usually describe what they collect in a privacy policy. These are long, but you can scan for a few key points: what data is collected, who it is shared with, how long it is kept, and how to delete it.
Privacy laws differ widely between countries. Examples include the European Union's General Data Protection Regulation (GDPR), which applies in the European Union and has inspired laws elsewhere, California's consumer privacy law, the United States' children's online privacy law (COPPA, which sets rules for collecting data from children under 13), and India's Digital Personal Data Protection Act, 2023. Many of these laws give people some rights, which commonly include:
The details, and whether a law protects you, depend on where you live and where the company operates, so check the rules in your own country. Many services also offer a privacy dashboard or "download my data" tool even where the law does not require it.
You cannot erase your footprint, but you can shrink it and take back control. The most useful habit is data minimisation: share and allow only what is needed.
You open your phone settings and review what each app is allowed to use. Ask of each permission: does the app really need this to do its job?
| App | Permission | Needed? | Decision |
|---|---|---|---|
| Maps | Location | Yes, to give directions | Allow only while using the app |
| Calculator | Microphone | No | Deny |
| Photo editor | Photos | Yes, to edit them | Allow (or choose selected photos only) |
| Photo editor | Contacts | No | Deny |
| Puzzle game | Location | No | Deny |
Result: of five permissions, two are needed and three are not. Denying the three costs you nothing but reduces what each app can collect. If an app stops working without a permission it should not need, that is useful information about the app.
Suppose you have 150 friends, and each of them also has about 150 friends. Imagine a post that your friends can see and share.
Step 1: The direct audience is 150 people.
Step 2: If every one of them shares it with their own friends, the next layer could be up to 150 × 150 = 22,500 people.
Step 3: Altogether: 150 + 22,500 = 22,650 people, at most.
Step 4: One more layer of sharing could reach up to 150 × 150 × 150 = 3,375,000 people.
Reality check: these are upper limits. Many friends overlap, many people never share, and privacy settings can cut reach sharply. The point is how quickly sharing multiplies, and how little control you keep once something is copied.
Your online activity can also be used to train or personalise services. Recommendation systems learn from what you watch and click. Many AI chat tools keep or review what you type unless you change a setting, and policies differ between tools. A sensible rule is to avoid putting private details into any online tool unless you understand what happens to them, and to check the tool's privacy settings. Photos and voice clips that are public can also be misused to create fake images or audio of a person, which is another reason to think about what you make public.
Young people grow up with a footprint that often starts before they can choose it, for example when relatives post baby photos. Families can help by talking openly about what is shared, asking permission before posting pictures of each other, setting privacy defaults together and agreeing what to do if something goes wrong. Many services set a minimum age and may need a parent's permission, and some countries have extra rules for children's data, so check each service's terms. If someone shares a private image or detail of you without your agreement, or threatens to, keep the evidence, do not give in to pressure, and tell a trusted adult. You are not to blame.
Try each question first, then tap it to reveal the answer. A scored multiple-choice quiz follows below.
Active data is what you deliberately share, such as posts and profiles. Passive data is collected automatically, such as browsing history, location and device details.
The same outside company's code is embedded on many different sites, so it can recognise you across all of them and link your visits together.
Any two of: the time and GPS location stored in a photo; the sender, recipient and time of a message; the author and edit history of a document.
150 + (150 × 150) = 150 + 22,500 = 22,650.
Deny it. A calculator does not need a microphone, so allowing it only lets the app collect data it does not need.
Other people may already have copied, screenshotted, shared or archived it, and copies can remain on other services or in backups.
Footprint day-log (no accounts needed): ask students to write down, on paper, what they did online in one day and what data each activity probably created, then sort the list into active, passive and inferred, as in Worked Example 1.
Permissions pair-check: in pairs, students review their own phone settings, or a sample list you provide, and decide for each permission whether the app needs it. Students should never be asked to show private content to each other.
Reach calculation: use Worked Example 4 with different numbers, and discuss why real reach is lower than the maximum.
Safety note: use invented examples for discussion rather than real people's posts. Remind students they can always talk to a trusted adult if something online worries them, and that sharing someone else's private images is harmful.
This article is original EDUSAMBAM writing. The explanations of cookies, metadata, tracking and data minimisation reflect widely taught privacy practice, and the diagrams are original EDUSAMBAM schematics. All people and records in the worked examples are invented, and the figures are arithmetic for practice, not statistics. Privacy law is summarised in general terms only and is not legal advice.
Laws, browser features and app settings change often, so check the current rules and menus yourself. This article does not recommend any particular company's products.
10 questions. Select an answer for each, then submit to see your score instantly.