Fact check: How to be UNTRACEABLE and anonymous online

How to be UNTRACEABLE and anonymous online - spoiler alert, it’s basi...

Original video: https://vm.tiktok.com/ZGd9shV7d/

Fact checked on: August 6, 2026

Fact Check Analysis

Summary

The text is broadly right that online anonymity is difficult and depends on many possible identifiers. However, several claims are overstated, technically imprecise, or presented as certain when they are only possible in particular circumstances.

Checked claims

“It’s basically impossible to be untraceable on the internet.” — Partly true. Perfect anonymity is difficult to guarantee, especially against well-resourced investigators, but privacy tools and careful operational security can substantially reduce traceability.
Buying a phone with cash does not make the purchase anonymous. — True. Retail records, inventory data, timestamps, loyalty-program information, payment details, and surveillance footage may link a device to its purchaser. The availability and usefulness of those records vary by retailer and jurisdiction.
A phone’s serial number is recorded in store inventory records. — Partly true. Retailers often track device identifiers such as IMEI, serial number, or SKU, particularly for expensive electronics. However, not every store records the identifier of every prepaid phone in a way that can be easily searched.
A cash-register timestamp can be used to find corresponding surveillance footage. — Partly true. Transaction times can help investigators locate relevant footage, but footage retention, camera coverage, image quality, and access policies determine whether this is actually possible.
A random buyer or disguise would solve the purchase-identification problem. — False or misleading. Those measures might reduce one link in the chain but do not guarantee anonymity. Other evidence could include location data, communications records, device identifiers, account activity, or later surveillance.
Phones can provide precise GPS location. — True, with qualification. Smartphones can determine location using GPS, Wi‑Fi positioning, cell towers, and other sensors. The accuracy depends on the environment, hardware, permissions, and which services are active.
Turning off location services only stops apps from receiving GPS data. — Partly true. Disabling location permissions can prevent or limit ordinary app access, but it does not necessarily disable all location-related signals. Cellular networks can estimate a device’s location, and operating-system, carrier, emergency, or security functions may operate under separate rules.
A phone continues to communicate with cell towers after location services are disabled. — True. A cellular phone generally must communicate with networks to register, make calls, send messages, or use mobile data. Towers can infer an approximate location from this communication.
Phones can infer location from nearby Wi‑Fi and Bluetooth signals. — True. Nearby networks and Bluetooth devices can contribute to location estimation. Whether data is collected or transmitted depends on the operating system, apps, permissions, and network configuration.
Any Wi‑Fi connection necessarily identifies the user. — False. A Wi‑Fi network can associate a connection with a location, router, account, or subscriber, but that does not automatically establish who was physically using the device. Public networks, shared access, changing identifiers, and other factors complicate attribution.
Nearby Wi‑Fi networks form a reliable identifying “habitat.” — Partly true. A repeated pattern of nearby networks can contribute to device fingerprinting or location inference. It is not necessarily unique or stable enough to identify a person by itself.
Surveillance footage can always link a device on Wi‑Fi to a person on camera. — False. Such correlation may be possible if dates, locations, camera coverage, network logs, and image quality all align. “Always” is unjustified.
A VPN routes traffic through the VPN provider and can conceal the user’s IP address from websites. — True. In the usual VPN model, the website sees the VPN server’s address rather than the user’s public IP address. The VPN provider can still observe or potentially infer connection metadata, depending on its technology and logging.
A VPN merely shifts trust from the internet provider to the VPN company. — Partly true. A VPN changes which party can observe particular traffic and metadata. It does not eliminate trust, and it does not necessarily provide anonymity from websites, accounts, browser fingerprints, cookies, or endpoint compromise.
VPN providers may retain logs or disclose information. — True. Providers differ substantially in logging practices, legal obligations, technical design, and transparency. “No-logs” claims are not automatically proof that no useful data exists.
Logging into a normal personal account can reveal the user’s identity. — True. Authentication directly links activity to that account, regardless of whether a VPN is used.
A person must never log into any account previously used elsewhere if they want privacy. — Overstated. Reusing an account clearly links activity, but privacy goals differ. Separate accounts, privacy-preserving browser configurations, and other measures can reduce linkability; they cannot guarantee separation.
Writing style, repeated typos, and typing patterns can identify users. — Partly true. Stylometry and behavioral biometrics can sometimes link authors or sessions, especially with sufficient data. Their reliability varies by sample size, language, device, context, and the number of possible users.
Typing intervals measured to the microsecond can identify people in ordinary web use. — Mostly false or misleading. Keystroke dynamics research can use timing features, but browser and operating-system timing limitations, network effects, varied keyboards, and sparse data make the claim of routine microsecond-level identification far too strong.
Websites collect behavioral and fingerprinting data for marketing or tracking. — True. Cookies, device and browser characteristics, identifiers, analytics, and behavioral data are widely used for advertising, fraud prevention, personalization, and security. Not every site collects or uses all of these techniques.
One login or one Wi‑Fi visit can definitively expose someone. — Partly true. Such events can create a strong link under the right circumstances, but they do not automatically prove identity. Attribution normally depends on corroborating evidence.
“Everything you do is traced.” — False as an absolute statement. Many activities generate records, but collection is incomplete, retention varies, and some data is inaccessible, anonymized, encrypted, or never generated.

Context & nuance

Anonymity is not a single condition. It can mean hiding an IP address from a website, preventing an internet provider from seeing content, avoiding account-based identification, resisting commercial tracking, or remaining anonymous from a capable investigator. A method may help with one goal while failing at another.

The text also conflates several different entities: the mobile carrier, Wi‑Fi operator, VPN provider, website, app developer, retailer, advertising network, and government investigator. Each may see different data, and none necessarily has a complete record. Correlating those records can be powerful, but it requires access, time, compatible timestamps, and sufficient data.

A phone does not inherently “emit” a complete identity. It exposes identifiers and signals that may become identifying when combined with subscriber records, account logins, location history, browser characteristics, surveillance, or other evidence. Some identifiers are persistent, while others can be randomized or rotated.

VPNs are also not designed to make a user universally anonymous. They mainly alter network routing and the parties that can see traffic metadata. Encryption protocols, browser configuration, account separation, tracker blocking, device security, and minimizing unnecessary data collection may all matter, depending on the threat model.

Finally, the strongest claims use words such as “always,” “never,” and “basically impossible.” Those formulations make the passage rhetorically effective but factually weaker. Privacy is better understood as risk reduction rather than a binary state: careful practices can make identification substantially harder without making it impossible.

Takeaway

The passage correctly warns that anonymity can fail through purchase records, network metadata, account logins, tracking, and behavioral patterns. Its main weakness is treating possible correlations as inevitable and describing several technical mechanisms with more certainty and precision than the evidence supports.

Video transcript

how to be untraceable on the internet. Spoiler, it's basically impossible, but it's a fun thought experiment for supporters of privacy rights. So first, you're gonna need a device to browse the web with. Let's call it the burner phone. You gotta buy it with cash. No credit card, no debit card, no email receipt, and you think you'd be in the clear, right? Not really, because cash doesn't erase that the event happened. It just shifts to where you gotta look for evidence. The trail is at the store you buy the phone from. The burner phone has a serial number. The store has inventory records for that phone with that serial number. The cash register then has a timestamp of when that phone was bought. So if someone wanted to check the surveillance footage for an item sold at register three at 2.14 p.m., it wouldn't be too hard to link you to the phone. So surveillance footage could be pulled to show you standing there buying it. Boom, not anonymous anymore, browsing on your new burner phone. So what to do? Well, you'd have to go through the ridiculous lengths of having a random person who could never identify you buy that particular phone for you, or you'd have to wear a disguise. Those 15% of you who made it past the first 30 seconds, stay tuned. I have a special treat for now as a thanks for your attention. Mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm, mm. Okay, next off, you can never even power on the burner phone near any real electronic devices that you typically use inside of your home. Some phones have pinpoint GPS data to map your exact location. The system may not know who owns the burner phone yet, but if it can say, this unknown device keeps appearing geographically near this known person's typical phone, then you're in trouble because you could be correlated through some person who's trying to surveil you, or the government, or service providers. So you activate the phone only far from your real phone in your house. You think, I didn't give my name, so I'm fine, but the system still sees the SIM card, the device ID, the time, the network, the first place it connected, maybe the IP address used during activation. That becomes kind of a birth certificate from the phone, which could be connected to you if you're not careful. So now you use the device. You turn off location services immediately, but that just stops the phone from politely telling apps where it is through GPS. The phone still talks to cell towers. It still sees Wi-Fi networks around it. It still has Bluetooth apps that can infer location tangentially. A phone is basically a location-emitting object by design. So you definitely can't use home Wi-Fi because then it could be associated with you, but it's bigger than that. You can't use office Wi-Fi, gym Wi-Fi, you know, Wi-Fi at your favorite coffee shop, your friend's router. Even the surrounding networks become kind of a habitat for identifying you. Devices don't need to say your name if they keep showing up in the place where you show up. Remember, surveillance footage can always be used to cross-reference your device's presence within a Wi-Fi network to your physical on-camera location at the same place. So next you might add a VPN, and a lot of people think a VPN means invisibility. It doesn't. A VPN is basically a tunnel. Your internet traffic goes from your device to the VPN company first, and then the VPN company routes you to the website from their server. So the website may see the VPN's IP address instead of your own, but now you're trusting the VPN company. If they keep logs of who's connecting with it, they may be able to connect your burner phone to your online activity. And some VPN companies are shady, vague, foreign, or cheap, built around marketing more than privacy. So they could technically out you to government or whoever's looking for you. You've basically moved your trust from an internet provider to a company with a cool logo and a promise that they'd never identify you. And even if the IP address problem is handled well by the VPN company, identity leaks elsewhere too. The second you log into your real Gmail, your iCloud, your Instagram, your TikTok, or any account, the mask comes off. So you can never log in on your burner phone where you're browsing the web to any website you've ever used before through the login that you typically use. Even that doesn't resolve the issues. You're still identifiable by the way you use language, your speaking style, your typing style. You use the same typos over and over again. Even the precise time it takes between typing different letters down to the microsecond can be used to match your burner accounts to you. And websites can and do keep that data to try to identify people for marketing purposes. The internet doesn't always need your name. Sometimes it recognizes your pattern and your searches, your habits betray you. So what's my point? The privacy that you would seek to obtain through browsing the web anonymously is practically unobtainable. You can be burned by one login, one time locating yourself on a wifi network and then being on camera in that same location. So my point is basically we live in a crazy world where everything you do is traced and there's really no way around it. Whoop! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr! Brrr!