Printer tracking

The best-documented scheme is the one used by Xerox DocuColor printers, which the EFF decoded in 2005. Each colour page carries a grid of 15 by 8 tiny yellow dots, repeated across the whole page with slight offsets. Read as binary, the grid holds the printer's serial number, the year, month and day, and the hour and minute of printing, plus parity bits to catch reading errors. The EFF notes that the clock may be set to UTC or simply be wrong (EFF DocuColor decoding guide). Because the pattern repeats, cutting off a margin or a corner does not remove it.

According to the EFF's 2005 research, the codes were developed with manufacturers at the request of the US Secret Service to trace counterfeit banknotes. Distributors can keep records of who bought which serial number, so a decoded page can lead to a buyer. Xerox told the EFF it only identifies suspected currency, but the EFF found no law limiting how the codes are used (EFF white paper). In 2015 the EFF wrote that documents it had obtained under the Freedom of Information Act suggested that all major colour laser makers had secret agreements with governments, though it could not confirm this (EFF list). In 2017 it added that the US is not the only government involved (EFF, 2017).

Other manufacturers use different dot layouts. In 2018, researchers at TU Dresden published an improved method for extracting the dots, decoded further pattern information, described a pattern that had not been documented before, and released the DEDA toolkit (see tools). The EFF also reports, from documents it obtained, a newer generation of tracking that apparently works by slightly rearranging dots the printer was going to print anyway rather than adding new ones, so not every code is visible even under magnification (EFF, 2017).

The 2017 Reality Winner case

In June 2017 The Intercept published a scan of a printed NSA report that a source had mailed to it. Shortly afterwards, Errata Security showed that the yellow dots on the published scan decoded to a printer serial number and a print time of 9 May 2017 at 6:20 (Errata Security). NSA contractor Reality Winner had already been arrested. She pleaded guilty and in 2018 was sentenced to 63 months in prison (Wikipedia summary with sources).

The dots made headlines, but investigators had other evidence. According to the FBI, the pages in the scan looked folded or creased, which suggested they had been printed and carried out of a secure building. An internal audit showed which few people had accessed the report, and her work computer had been used to email The Intercept (Vice, Wikipedia). The EFF points out that the affidavit behind her arrest did not mention the dots at all (EFF, 2017). The lesson: access records and print logs often give a person away before anyone examines the paper.

The EFF kept a public list of printers tested for yellow dots. It is no longer updated, and most models on it are many years old. Models that showed dots came from Brother, Canon, Dell, Epson, HP, Konica Minolta, Kyocera, Lexmark, Ricoh, Toshiba, Xerox and several other brands. The Samsung and Oki models on the list showed none, as did a number of HP and Xerox models.

"None known" is not a guarantee. The EFF says that, as far as it knows, only colour laser and similar printers deliberately encode serial numbers, and that forensic investigation of other printing technologies is still possible. The DEDA authors likewise write that monochrome pages and inkjet prints "might not" contain tracking dots, not that they never do.

• Print defects. Printers leave small mechanical flaws in what they print. In 2004, Purdue University researchers used the light and dark bands caused by uneven drum rotation in laser printers to identify the model for 11 of 12 printer models tested, and expected to tell individual printers apart. They noted that changing the toner cartridge after printing broke the link to that printer, one reason they also worked on deliberately embedded codes (Purdue).
• Print logs at work. Many organisations log who printed what, when and on which printer. PaperCut, a commercial print management system, tracks print activity by default, can record document names, and offers an optional archive that keeps a copy of the content of each printed job (PaperCut privacy options, Print Archiving).
• Copies kept on the machine. Office copiers and multifunction printers contain storage that holds data about the documents they copy, print, scan, fax and email (FTC). In 2010 CBS News bought four used copiers and recovered police records, pay stubs and about 300 pages of medical records from them (CBS News).
• Vendor accounts and telemetry. Connected printers can report usage to their maker. HP's privacy statement (March 2026) lists pages printed, print mode, media, cartridge type, file type, file size and the application used, plus unique device identifiers; HP says it does not collect file contents unless a service you request needs them or you consent (HP privacy statement). Check your own manufacturer's policy, and see choosing a printer.
• Cloud printing. Cloud print services send each job over the internet through the provider. With Microsoft's Universal Print, for example, all print jobs and print management go through Microsoft's service, which also offers central reporting (Microsoft).
• The file you printed from. Word processors and PDFs carry author names, edit history, comments and timestamps. The printout does not show them, but the file on your device, in your sent mail or in a shared drive does. See the metadata guide.
• The text itself. An organisation can give each recipient a slightly different version of a document, with changed wording, spacing or numbers, so that a leaked copy reveals whose it was. This is called a canary trap (Wikipedia).
• Handling and delivery. Folds and creases suggested to the FBI that Winner's pages had been printed and carried out. If you post documents, note that the US Postal Service photographs the outside of mail (Freedom of the Press Foundation).

You can check your own printer in a few minutes. Print a test page in colour mode and use it, rather than a sensitive document.

1. Look. Shine a blue LED torch on the white areas of the page and use a magnifying glass or a cheap USB microscope. Under blue light, yellow dots look black. A regular, repeating pattern of tiny black dots suggests a tracking code (EFF).
2. Scan. Scan the page at 300 dpi or more and save it in a lossless format such as PNG or TIFF rather than JPEG; DEDA expects a lossless file. In an image editor, boost the yellow channel or invert the colours of a white area; inverting is how Errata Security made the dots on the Winner scan visible.
3. Decode. Run DEDA on the scan. deda_parse_print tries to decode known patterns, deda_compare_prints spots a page from a different printer in a set of scans, and deda_extract_yd pulls out unknown patterns for analysis.

Tools that remove hidden data from files before you print or share them, such as author names and edit history, are covered in the metadata guide.

No single step makes a printout untraceable. Pick measures that match who might look at the page and what they can access. If an adversary can read your employer's print logs, hiding the dots achieves little.

No printer model can be verified as untraceable, so this guide does not recommend specific models. These choices reduce what a printer reveals about you:

• Avoid colour lasers. For sensitive pages, use a monochrome laser or an inkjet printer instead. Remember the limits in the table above.
• Avoid printers that need an account or the internet to work. HP+ printers, for example, require an HP account, an internet connection and original HP ink (HP). Ink subscriptions such as HP Instant Ink need the printer connected directly to the internet so it can tell HP when to send cartridges.
• Keep it local. Connect by USB or on your own network, block its internet access at the router, and switch off cloud printing, remote management and "smart" features. If your printer supports driverless printing (IPP Everywhere), Linux, macOS, Windows and ChromeOS can use it without vendor software (PWG), so you can skip the maker's app and account.
• Lock down its admin page. Change the default administrator password and install firmware updates. In June 2025 Rapid7 disclosed eight flaws in 748 printer, scanner and label maker models from Brother, Fujifilm, Ricoh, Toshiba Tec and Konica Minolta. On affected models the default admin password can be worked out from the serial number, and Brother says firmware cannot fully fix this (Rapid7, BleepingComputer).
• Leave less of a purchase trail. Pay cash in a shop and skip warranty registration, since dealers can link a serial number to a buyer (EFF).
• Wipe before disposal. Before you sell, return or recycle a multifunction printer or copier, overwrite or remove its storage. The FTC advises asking the manufacturer or dealer how, because some drives also hold the firmware.

A page that is never printed carries no dots, no print defects and no print log entry. Sharing digitally has its own traces, so do it carefully:

• Use a personal device on a network that is not your employer's or your home connection. An amnesic system such as Tails leaves less behind (see operating systems).
• Strip metadata from files before sending them, and check the result (metadata guide). Freedom of the Press Foundation notes that screenshots usually carry little metadata, and suggests a standalone camera rather than a smartphone if you must photograph documents.
• Send documents to journalists through SecureDrop where the outlet offers it, or through OnionShare. For ongoing conversations, Signal with disappearing messages helps, but FPF notes it is not designed for complete anonymity (see messaging).
• If you post paper documents, leave out a return address linked to you, and remember that the outside of the envelope is photographed in the US.

• Publishing an image of a printout. A scan or photo of a colour laser print carries the dots, plus folds, stamps and handwriting. Journalists should publish a transcript, a cleaned scan or a description where the exact page is not needed.
• Reading "no dots found" as "safe". Codes can be invisible to the eye and unknown to DEDA, and printing in black on a colour laser is not a tested fix for your model.
• Worrying about dots while printing at work. As in the Winner case, access records and print logs are often what investigators check first.
• Photographing the document with your phone. Phone photos can carry location and device details; see the metadata guide. The camera roll may also sync to the cloud.
• Preparing a leak with logged-in online services. SecureDrop's source guidance (September 2026) warns against using any service linked to your identity, such as AI chatbots or search engines while logged in, because prompt and search histories can identify you (SecureDrop). This includes asking a chatbot to retype or summarise a document.
• Forgetting the original file. Cleaning a printout does nothing about the copy, the email or the edit history left on your computer.
• Trusting an untested DEDA mask. Check a masked test page under magnification on the same printer before relying on it.
• Assuming every copy is identical. If a document went to a small group, each copy may differ. Journalists can compare copies from different sources, or describe the substance rather than reproduce the page.

• EFF: List of printers which do or do not display tracking dotseff.orgNo longer updated; read the caveats at the top
• EFF: DocuColor tracking dot decoding guidew2.eff.orgHow one dot pattern encodes serial number, date and time
• EFF: Printer tracking issue pageeff.orgBackground, FOIA documents and posts since 2004
• Freedom of the Press Foundation: How to share sensitive leaks with the pressfreedom.pressPractical advice for sources, updated June 2026
• FTC: Digital copier data securityftc.govWhat office copiers store and how to wipe them