How to Find the Identifiers Companies Leave on Your Device
Do not simply ask «what do you know about me». Show them their own ID, which they left without asking. This changes everything.
Why this matters
Most people, when they learn about GDPR, start with a general request — «provide my data». Companies respond with a template. They send the minimum. There is another approach. More precise. More inconvenient for the company. You open the browser. Press three buttons. And you see a concrete identifier — a unique code that the company assigned specifically to you and stores in your browser without your knowledge. Now in the request you write not «provide the data» — but «provide all data associated with the identifier f7a3c291-4e8b-4d12-b063-9a2e17f83c44 that your company set in my browser». This is specifics. This is proof. This is something companies find inconvenient to dodge.
Step 1 — open the developer tools
This is built into every browser. You do not need to download anything.
On a computer — three ways to open
Press Shift + Ctrl + I (Windows/Linux)
Press Cmd + Option + I (Mac)
- Or: right-click on any place on the page → «View source» or «Inspect» A panel will open — a set of tabs with technical data of the page. It looks complicated. But we only need two tabs.
Step 2 — the Application → Cookies tab
This is the first place where identifiers live.
How to find it
- In the open panel find the «Application» tab (in Chrome/Brave) or «Storage» (in Firefox)
- In the left menu find the «Cookies» section
- Press the arrow next to it — a list of domains will unfold
- Press any domain — a table will appear on the right
What you see
A table with columns — Name, Value, Domain, Expires.
- Name — the name of the cookie. For example: _ga, uid, visitor_id, tracking_id, fbp, _gcl_au
- Value — this is the identifier itself. A long string of letters and digits
Domain — which company set it
Expires — until which year it is stored
An example of what you will see
Name: _ga Value: GA1.2.1234567890.1234567890 Domain: .google-analytics.com Expires: 2027-03-21 Name: fbp Value: fb.1.1882649224814.78823961242658533 Domain: .facebook.com Expires: 2025-09-21 Name: _uetsid Value: f7a3c291-4e8b-4d12-b063-9a2e17f83c44 Domain: .bat.bing.com Expires: 2026-01-15 Each line is a company that tracks you. Each Value is your unique ID in their system.
Red flags — what to pay attention to
An expiry of 2026–2027 — this is not a technical cookie. It is a tracker that lives for years and collects the history of your behaviour. The domain differs from the site you opened — this is a third-party tracker. You visited a news site, and the cookie was set by an advertising company you never chose. Names like uid, visitor_id, tracking_id, cid, _fbp, _ga — classic tracking identifiers.
Step 3 — the Network tab filter
Here you can see to whom your browser sends data right now, in real time.
How to find it
- In the developer panel press the «Network» tab
- Refresh the page — press F5 or Ctrl+R
- A list of requests will appear — the browser sends them when the page loads What you see: dozens of lines. Each — a request to some server. Most — loading of images and text. But some — the sending of your data to trackers.
How to filter out the trackers
In the search bar above the list, enter one by one
track — will find tracking requests
pixel — will find surveillance pixels
analytics — will find analytics systems
collect — will find data-collection requests
Press any line — the details will open on the right. The «Headers» tab, the «Request URL» section — this is the address where your data went. The «Payload» or «Request» tab — this is what exactly was sent. Sometimes your IP, fingerprint, ID are visible there.
An example of a suspicious request
pixel.advertising.com/collect? uid=KPX4RA9Q-2C-BT81& event=pageview& url=news-site.ee/article& ref=google.com& screen=1920x1080& lang=ru-RU See? The advertising server received your ID, the address of the page you are reading, where you came from, the screen resolution, the language. All of this in a millisecond. Without your knowledge.
Step 4 — record what you found
Create a simple document. Record
Site: [the name of the site you checked] Date: [today’s date] Tracker company: [the domain from the Domain column] Identifier: [the value from the Value column] Storage period: [the date from the Expires column] This is your evidence base. A screenshot of the panel with this data — attach it to the request.
Step 5 — how to use this in a request
Now you have specifics. A request under Article 15 GDPR becomes a precise strike rather than a general letter.
A request template with the identifier
To: [the company’s DPO or support] Subject: Data subject request — Article 15 GDPR I, [name], an EU resident, am submitting an official request. In the course of analysing my browser’s network requests, I discovered an identifier set by your company in my browser: Identifier: [insert Value] Cookie name: [insert Name] Domain: [insert Domain] Date of discovery: [date] Site where discovered: [name of site]
On the basis of Article 15 GDPR, I request
— All data associated with this identifier — The purposes of processing the data collected through this identifier — The list of third parties to whom this data was transferred — The legal basis for setting this identifier — The storage period of the data On the basis of Article 25 GDPR, I note that setting the identifier before obtaining consent is a violation of the data-protection-by-default principle. The response deadline is 30 days, per Article 12 GDPR.
[Name, date, contact]
Preferably in English if you are within the EU. Your email and place of residence are of no interest to anyone. Remember, you are a CODE in a huge database. Keep a diary where you collect data about all the companies. All responses are evidence for the regulator and for the court. This is a mandatory rule. Without evidence there is no case.
What to do if there are very many trackers
On an ordinary news site there can be 20–50 of them simultaneously. You do not need to send a request to each one. Strategy: Choose one or two companies with the longest storage periods — they collect data for years. Or those you recognise — Google Analytics (_ga), Facebook Pixel (_fbp), Microsoft (_uets). Start with one request. See how they react. This is a practice that teaches you to understand the system.
What the main identifiers mean
Cookie — Company — What it does _ga, _gid — Google Analytics — Tracks behaviour on the site _fbp, _fbc — Meta / Facebook — Pixel — tracks even without an account _uetsid, uet — Microsoft Bing — Conversion tracking IDE, DSID — Google DoubleClick — Advertising profile uid, visitor_id — Various brokers — Unique user ID AMCV, s_vi — Adobe Analytics — Corporate analytics fr — Facebook — Advertising ID for targeting __cfduid — Cloudflare — Technical — not a tracker
The bottom line
The developer panel is an X-ray of the page. It shows what is happening behind the screen. Who sees you. To whom you send data. What ID they assigned to you. Most people never open it. Companies count on this. You opened it. You saw the identifier. You know its meaning. Now you can ask the company specifically — what exactly you collected under this ID and to whom you sold it. This is not a technical skill. It is a skill of protecting your rights. If you cannot figure it out, look for those who can, look for tools for checking — it is all in your hands.
The first step right now
Open any news site. Press Shift+Ctrl+I. Go to Application → Cookies. Look at how many companies you find there. Just look. Without actions. Just see. One press — and you see who is watching you.