The internet doesn't know you: digital identity in the age of AI
Somewhere there is a version of you assembled from data brokers, search results and leaked databases. In 2026, machines read it, summarise it and, more and more often, impersonate it. Here is how digital identity actually works now, who gets to edit it, and what you can do this week to take some of it back.
Ask the internet who you are and it will answer with confidence. A data broker has your past addresses and a guess at your income. A search engine has whatever ranks highest under your name. A chatbot has a tidy paragraph built from both, which may or may not be true. None of these is you. The gap between the person and the profile is where most of the trouble in digital identity now lives: fraud, impersonation, and reputations rewritten by software that has never met you. This guide walks through that gap: what your online identity is made of, which parts you have real rights over, how AI has changed the threats, and what the next generation of digital ID is trying to fix.
01The three versions of you online
"Digital identity" sounds like one thing. In practice it is at least three, and they behave very differently.
The first is your credentials: the logins, passwords, passkeys and ID documents that prove you are you. Security people obsess over this layer, and it is the one you control most directly.
The second is your data profile: the records other organisations keep about you, built from purchases, location pings, app activity, public records and whatever data brokers buy and resell. You rarely see it and you did not write it, but it shapes what you are shown, what you are offered and what you are charged.
The third is your reputation: what comes back when someone, or something, looks you up. For twenty years that meant search results. Increasingly it means an AI system's summary, which squeezes the first two layers into a few confident sentences.
The internet doesn't know you. It knows a composite of these three layers, stitched together from sources of uneven quality, and it is the composite, not you, that gets approved for a loan, flagged as a fraud risk or cloned for a scam. Most of what follows is about who gets to edit it.
02Who owns your data? Mostly, nobody
The intuitive answer is that your data belongs to you. Legally, that is rarely how it works. What modern privacy law gives you is not ownership but a set of rights over data that other people hold. Europe's GDPR is the template. You can demand a copy of what an organisation holds about you, have inaccurate data corrected and, in many circumstances, have it erased, and the organisations themselves are obliged to keep personal data accurate and up to date.1 Since a landmark 2014 ruling by the EU's top court, Europeans have also been able to ask search engines to delist results about them that are inadequate, irrelevant or no longer relevant: the so-called right to be forgotten.2
Other places are catching up in pieces. India notified the rules for its Digital Personal Data Protection Act in November 2025, with most obligations on companies phasing in over the following 18 months.3 California has gone furthest on the hardest part of the problem: the data brokers you have never heard of. Its Delete Request and Opt-out Platform (DROP) lets a resident send one deletion request that reaches every registered broker in the state. Brokers have had to process those requests since 1 August 2026, must check for new ones every 45 days, and face penalties of $200 per request for every day they fail to act. More than 325,000 people had signed up by July 2026.4
Notice the pattern. None of these laws gives you a property right you can sell or license. They give you leverage: the right to see, correct, delete and object. That is less romantic than ownership and, in practice, more useful, because it works on data you never knew existed.
03When the machine gets you wrong
Reputations used to break slowly: a bad review, an old news story, a namesake with a criminal record. AI systems add a faster failure mode, which is confident fabrication. In March 2025 the European privacy group noyb filed a GDPR complaint on behalf of a Norwegian man after ChatGPT, asked about him, described him as someone who had murdered his own children. None of it was true. Worse, the answer wove the invention around real details of his family, which made it more believable, not less. The complaint rests on the GDPR's accuracy principle, the duty to keep personal data correct.5
Whatever regulators decide in that case, it shows the new problem clearly. For a growing share of lookups, the first description of you that someone reads is generated, not retrieved. A search engine at least shows its sources; a chatbot blends them into one smooth answer. If that answer is wrong, you may never learn that someone received it, and the ways to get it corrected are still being argued over. That makes the rights in the previous section more important in the age of AI, not less: access and correction are among the few existing tools that might reach what a model says about a real person, and cases like this one will decide how far they go.
A search engine shows you where it found something. A chatbot just tells you who someone is.
04Identity theft, by the numbers
The scale of identity fraud is easy to state and hard to take in. In 2024 the US Federal Trade Commission received 6.5 million consumer reports, more than 1.1 million of them about identity theft.6 In 2025 people reported 3 million frauds to the FTC and $15.9 billion in losses, up from just over $12 billion the year before; investment scams alone accounted for more than $7.9 billion.7 Imposter scams, in which someone pretends to be a bank, a government agency, a boss or a relative, drew about a million reports and $3.5 billion in losses.8 The FBI's Internet Crime Complaint Center, which counts differently, logged just over a million complaints and $20.9 billion in reported losses for 2025, a 26% jump on 2024.9
Two caveats keep these numbers honest. They are American figures because the US publishes the most detailed public data, not because the problem is American. And they only count what people reported: the FTC itself notes that reported losses are a fraction of the real total.7
What has changed is the toolkit. Identity theft used to mean stealing data: a card number, a Social Security number, a password from a breached database. Increasingly it means stealing a presence: a voice, a face or a writing style convincing enough to move money. The FBI's 2025 report has a section on AI used in cybercrime, warning that the technology lets criminals produce convincing synthetic content, from fake social media profiles to personalised conversations, in mass quantities. It counted 22,364 complaints involving AI, with more than $893 million in losses.9
05Deepfakes: your face and voice are now copyable
The case that made boardrooms pay attention came from Hong Kong. In 2024 the engineering firm Arup confirmed that a finance worker in Hong Kong had joined a video call with people who looked and sounded like the company's chief financial officer and other colleagues. They were deepfakes, built from publicly available video and audio of the real people. Over 15 transfers, the worker sent HK$200 million, about US$25.6 million, to the fraudsters.10 Nobody hacked a server. The attack worked on a person, using faces that person trusted.
The FBI's warning about synthetic content in mass quantities is the real point. What was a bespoke attack on a multinational is now cheap enough to aim at anyone, and the raw material, the clips and photos people post every day, is public by default.9
The law is starting to respond, unevenly. In the US, the TAKE IT DOWN Act made it a federal crime to publish non-consensual intimate images, including AI-generated ones, when it was signed in May 2025. Since 19 May 2026 the FTC has enforced its second half: platforms must remove such images within 48 hours of a valid request, with civil penalties of up to $53,088 per violation.11 The broader NO FAKES Act, which would give people a federal right to control digital replicas of their voice and likeness, cleared the Senate Judiciary Committee in June 2026 but is not law yet.12 In the EU, the AI Act's transparency rules have, since 2 August 2026, required anyone who deploys AI to generate or manipulate deepfakes to disclose that the content is artificial.13 We cover the machine-readable labelling side of that law, and its December deadline, in our AI watermarking guide.
The common thread is a shift from protecting your data to protecting your likeness. That is real progress, but enforcement after the fact does not claw back a wire transfer. Against a deepfake call, the best defence is still procedural: a code word, and a call-back on a number you already have.
06The next version of identity: carried, not kept
If the old model was "every website keeps a copy of you", the one now being built is closer to "you carry proofs, and show only what is needed".
The European Union's version is the EU Digital Identity Wallet: an app that holds government-backed credentials, such as your national ID and driving licence, and lets you present them online and in person.14 Under the revised eIDAS regulation, every member state must offer at least one wallet by 24 December 2026. Rollout is uneven (Germany, for one, is expected to launch in early 2027), and the duty on regulated private services such as banks to accept the wallet follows around late 2027. The design feature that matters most is selective disclosure: proving you are over 18, for example, without revealing your date of birth.15
The US is getting there state by state. Mobile driver's licences stored on phones are now accepted at TSA airport checkpoints from about 20 states and territories.16 Passkeys belong to the same family of ideas: they replace a shared secret with a cryptographic proof that only works on the site it was made for, as we explain in our passkeys guide.
Age checks are the most visible, and most contested, frontier. Since 25 July 2025, UK services that allow pornography or other content harmful to children have had to use "highly effective" age checks under the Online Safety Act.17 Since 10 December 2025, Australia has required major social media platforms to take reasonable steps to stop under-16s from having accounts.18 Done badly, age assurance means handing a full scan of your passport, or your face, to every site that asks. Done well, with wallet-style selective disclosure, it means proving one fact and nothing else.
The promise is real: a well-built wallet exposes less of you than today's habit of uploading ID scans. The risks are real too. A credential you can show everywhere can become one you are asked for everywhere, turning casual browsing into identified browsing. People without smartphones, documents or a fixed address risk being locked out of services that go wallet-only. And any identity system is only as trustworthy as whoever runs it. Selective disclosure, open standards and the freedom to use services without the wallet are the safeguards worth watching.
07What to do this week
None of this calls for paranoia, just a few hours spread over a week. In rough order of payoff:
Freeze your credit if you live in the US. A freeze at each of the three national bureaus (Equifax, Experian and TransUnion) stops new accounts from being opened in your name, and it has been free since 2018. Lift it temporarily when you actually need credit.19
Put a passkey on your email account. Email is the reset path for almost everything else, so it is the one account worth hardening first.
Agree a family code word. A short phrase that only your household knows, asked for on any urgent call about money or secrets, costs nothing and does not depend on spotting the fake. Pair it with a rule: hang up and call back on a number you already have.
Use your data rights. In California, a single DROP request reaches every registered data broker.4 In the EU, an access request under the GDPR shows you what a company holds about you, and a correction or erasure request fixes it.1
Check your exposure. A breach-notification service such as Have I Been Pwned shows which known leaks include your email address. Change any password that appears there, and stop reusing it anywhere.
Look yourself up, including in AI. Search your name, then ask the major chatbots who you are. If one gets something materially wrong, keep a screenshot: it is the start of a paper trail for the rights described above.
If it happens anyway, US residents can report identity theft and get a personalised recovery plan at IdentityTheft.gov, the FTC's official site.20 Elsewhere, start with your bank and your national police or consumer-protection agency.
08Where OCXLY lands
Our tools are built on one rule: your data never leaves your device. The token counter, the password generator and the rest run entirely in your browser, with nothing uploaded, stored or logged. We build that way because of everything above. Every copy of your data that someone else keeps is a copy that can be breached, sold, misread by a model or folded into a profile you never see. The safest data is the data nobody collected.
That is also the honest answer to this article's title. The internet doesn't know you, and in one sense that is good news: identity was never supposed to be a file on somebody else's server. The direction worth backing, from passkeys to selective-disclosure wallets, puts the proof back in your hands and lets you share less of yourself to get the same thing done. Until that is everywhere, the practical habit is simple: keep more of yourself local, and hand over only what a task truly needs.