When I visit a web site, can the server identify me?

Your IP address

The one piece of information that a web server gets is the IP address of your internet connection.

In fact, the Ask Leo! web server believes that yours is 54.234.231.49.

If your computer is connected directly to the internet, that's its IP address. If you're connected through a router, that's the IP address that's been assigned to your router.

If you're connecting through a corporate network, a proxy, or some other more complex private networking scheme, then that's the IP address assigned to the equipment that connects that network or proxy to the internet.

The IP address is a core component of how the internet works. The server must know the IP address to which it should send its response. It's like the return address on an postal mail envelope - you can't reply if you don't know where to send it.

Is your IP address "you"?

So, does your IP address identify you, specifically?

Well, yes and no. And maybe.

In cases where you're connected through an IP address that can be somehow associated with you - perhaps the IP address assigned to your connection by your internet service provider - then yes, the IP address does (kind of) identify you. Your ISP knows where you live and has records of what your IP address is. If you have multiple users or multiple machines, they can't necessarily tell who did what from which computer, but they can at least say, "This came from that customer's connection".

The average person can't get at this information, of course, and neither can web servers. It typically takes legal action of some sort force the ISPs to release it.

So, a server knows the IP address through which you connect and that might be used to identify you, assuming law enforcement gets involved.

With your cooperation, much more is possible

I hope it's obvious, but I'll state it anyway: any site that you can login to knows who you are to the extent that you provided accurate information when you signed up.

When you return, that site might still know who you are, even if you don't necessarily login on that return, and even if you don't explicitly tell it to "remember me." It's still quite possible for the site to remember you anyway and only request that you login if it needs to confirm that you are who it thinks you are.

All that's as simple as a cookie - perhaps even the same cookie that makes it possible to go from page-to-page within a site without having to login over and over again for every single page.

And thus are conspiracy concerns born

Ads are just content served up by web servers. So the advertisers web servers know your IP address and can do things like leave cookies so that they know which sites (using that same advertising network) you visit.

Well, not you, you, but rather "some computer at your IP address" is all they really know.

Perhaps.

Perhaps until you login to one of those sites.

IF (and it's a very big if) that site that now knows who you are shares that information with their advertising network, then the advertising network knows who you are if you visit any other site on which they provide ads.

So, in that sense, it is possible exactly who you are could be accompanying you to the websites that you visit, depending on how you control your personal information, what sites you use, and in turn what services those sites use.

Just how real is this?

I'm always reluctant to talk about online privacy, especially when it relates to advertisers, because there are many people who are absolutely convinced that every little thing they do online is indeed being monitored in excruciating detail using the techniques that I've outlined above and other similar approaches.

I don't believe that for a second.

I've said it many, many times before: you and I just aren't that interesting.

I login to dozens of sites throughout the day. Many have advertising and I'm certain that many use the same networks as some of the others.

I'm just not concerned.

Could they pool all their resources and information - my IP addresses, cookie-based information, surfing habits, account logins and such - to closely monitor what I do?

I suppose they could.

Do I think that they do?

No.

Why would they? I'm just not that interesting.

Taking steps anyway

Perhaps you really are that interesting (I'm not doubting that there are people who are).

What do you do?

Well, my knee-jerk reaction is to say: stay off the internet, period. The internet was never designed to provide the level of anonymity and privacy you might need. There are things that can be done, but unless you understand them and know how to use them both consistently and well, you run the risk of being identified.

I touch on fake accounts, anonymous proxies, anonymization services, and more in How can I send anonymous email?, and those are all steps well-worth considering if this is an important issue for you.

The practical answer for the average netizen

No, servers don't identify you as an individual, unless you tell them who you are.

To me (or rather my server), you're just 54.234.231.49. Even if you leave your name in a comment below, which also records the IP address from which the comment was made, there's no attempt to automatically figure out who you are the next time you visit. There's no need, and there's nothing I would do with that information anyway.

I honestly believe that the vast majority of sites operate exactly the same way.

(This is an update to an article originally published December 1, 2004.)