The most common way a website knows who you are.
You’re asking two different questions.
- Can a website identify your IP address? Yes. It’s part of the “show me a webpage” protocol.
- Can an IP address identify you? Not very easily.
Let’s look at these two distinct issues.
Become a Patron of Ask Leo! and go ad-free!
Can a website identify me?
Websites do get your IP address when you visit, but that alone is not enough to identify who you are or where you’re located. Most commonly, websites know who you are because you told them — either by signing in or in some other explicit way.
Your IP address
Here’s your IP address: 188.8.131.52.1
The IP address is a fundamental component of how the internet works. The server must know the IP address to which it should send its response. It’s like the return address on a postal mail envelope — you can’t reply if you don’t know where the request came from.
Your IP address is not “you”
In most homes and small businesses, the IP address is assigned by your ISP to your router’s internet connection.
That identifies you only to the degree you’re associated with that location. Your ISP knows where you live, after all. If you have multiple users or multiple machines, they’ll all share the same IP address through the router.
The average person can’t get at this IP location information. Neither can web servers. All my server sees is 184.108.40.206. Where that IP address is specifically, and whether there’s one person there or a hundred, I can’t tell. It typically takes legal action to force an ISP to release such information.
So, a server knows the IP address through which you connect, and that might be used to identify your location, assuming law enforcement gets involved.
Obscuring your IP address
If your internet connection is through a corporate network, proxy, or VPN, things get more complex. The IP address seen by the web server only indicates the company providing your internet connection, proxy, or VPN service, completely hiding your “real” IP address and location.
In fact, this is one of the reasons that TOR — The Onion Router — exists. It uses a multi-layered series of proxies in such a way that even with things like court orders and legal justifications, your origin IP address cannot be determined.
So to answer at least part of your question: to hide your IP address, use something like a VPN service or TOR.
But your IP address is really only a small part of the issue.
You give away much more information yourself
Any site you log into knows who you are to the extent that you provided accurate information when you signed up or that that information can be cross-referenced elsewhere.
For example, if you register on a site with a specific email address — email@example.com — anything from a simple Google search to behind-the-scenes data-exchange agreements can cause any and all information associated with that email address to be discoverable… and then associated with your IP address.
Consider how much information we post to social media. All of that information could potentially be cross-referenced in a variety of ways, including but not limited to the IP address of the computer(s) you use to sign in. Privacy policies posted by the services we use define how much of this sharing happens and with whom.
Advertising does and does not care who you are
Ads are just content served up by web servers. Advertisers’ web servers know your IP address and can do things like leave cookies so they know which sites (using that same advertising network) you visit.
Well, not you, you, but rather “some computer at your IP address”, since that’s all they really know.
Until you log in to one of those sites.
If (and it’s a very big if) the site that now knows exactly who you are shares that information with their advertising network (which they should not), then the advertising network knows who you are if you visit any other site on which they provide ads.
So in that sense, it is possible that exactly who you are could be accompanying you to the websites you visit, depending on how you control your personal information, what sites you use, and what services those sites use in turn.
Just how real is this?
I’m always reluctant to talk about online privacy when it relates to advertisers because there are many people who are absolutely convinced that every little thing they do online is being monitored in excruciating detail using the techniques that I’ve outlined above and other similar approaches.
I don’t believe that for a second.
I’ve said it many, many times before: as individuals, you and I just aren’t that interesting.
I log into dozens of sites throughout the day. Many have advertising, and I’m certain many use the same networks as some of the others. I’m just not concerned.
Could they pool all their resources and information — my IP addresses, cookie-based information, surfing habits, account logins and such — to closely monitor what I do?
I suppose they could.
Do I think that they do? No. Why would they spend the time and money? I’m just not that interesting.
Taking steps anyway
Perhaps you really are that interesting. (I don’t doubt there are people who are.)
What do you do?
Well, my knee-jerk reaction is to say, “Stay off the internet, period.” The internet was never designed to provide the level of anonymity and privacy you might need. There are things you can do, but unless you understand them and know how to use them consistently and well, you run the risk of being identified.
If this is an important issue for you, my post How Can I Send Anonymous Email? touches on fake accounts, anonymous proxies, anonymization services, and more.
You generally don’t need to worry about this at all.
No: servers don’t identify you as an individual unless you tell them who you are.Even then, does it really matter?
To me (or actually, my server), you’re just 220.127.116.11. If you happen to be logged in to your Ask Leo! account, I’ll know who you are because you logged in and told me who you are.
Otherwise, you’re just another anonymous visitor.
On the other hand, I’d love for you to tell me who you are: subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week. (Yup, I’ll know your IP address — but then, I already do — right, 18.104.22.168?)
Footnotes & References
1: Most of the time, this is accurate. If you’re already taking steps as discussed later in the article, of course, it won’t be.