AI Knows Who You Are Online, Even With a Fake Name

I have been running a small experiment on my own browsing for the last six months. I used a different name, a different email, and a different browser fingerprint for every site I signed up for. None of the names were tied to my real identity. I used a separate virtual machine for the test. The result was the same as the result every other researcher has published: the AI that recommends content to me figured out it was me within a week.

This is not a story about a clever attack. It is a story about how the modern internet identifies you without asking for your name, and how the new wave of AI tools makes the old advice about fake names obsolete.

The setup

The setup is the kind of thing a moderately paranoid sysadmin would build. I used a clean Firefox profile in a QEMU VM (a virtualization tool that runs a complete operating system inside a window on your existing computer) with a unique user agent string, no cookies between sites, and a clean DNS resolver. For each site I signed up for, I used a unique name and a unique email alias. The email aliases all forwarded to a single inbox, so I could read the mail but the sites could not see each other.

I visited a fixed list of pages, scrolled for a fixed amount of time, and clicked on links in a pattern designed to look human. After three days, the content I was being shown on the AI-curated feeds started to converge. After a week, the recommendations were specific enough that I could identify the topic clusters being assembled around my browsing pattern.

I was not surprised. I have been writing about this kind of fingerprinting for years. What surprised me was how fast the AI figured it out, and how little the fake name mattered.

What the AI actually looks at

The short list of signals the modern recommendation AI uses:

• Browser fingerprint. A combination of screen size, installed fonts, time zone, language, and the order in which your browser makes the connection requests. This combination is unique enough to identify you across sites, even with cookies disabled.
• Typing cadence. Some sites now measure the time between keystrokes. A human typing 80 words per minute on a QWERTY keyboard produces a different pattern than a human typing 40 words per minute on a Dvorak.
• Reading time per paragraph. This is the one I found most striking. The AI knew which paragraphs I had actually read, and which ones I had scrolled past, because the JavaScript on the page measured how long the paragraph was in the viewport.
• Click patterns. Not just which links I clicked, but the trajectory of the mouse cursor between clicks. A real human moves the mouse in arcs. A bot moves in straight lines.
• Content preference vectors. The actual text of the pages I read, summarized into a vector embedding (a numeric representation of text that captures its meaning) and compared to other users with similar vectors.

The fake name I used did not show up in any of those signals. The name is for me, not for the AI. The AI does not care what name I typed into the form. It cares about the behavior the page observed.

What fake names do protect

I do not want to give the impression that fake names are useless. They are not. They protect you against a specific kind of attack: a person looking at a public profile and using the name to find your other accounts. A fake name that does not appear in any other context is a real defense against that attack.

A fake name also protects you against a data breach that includes the name. If the site gets hacked and the user database leaks, a fake name means the leak does not include your real name. This is a meaningful protection, especially for sites that are likely to be breached.

What fake names do not protect you against is the AI that is watching your behavior, not your name.

What the AI is not doing

I want to be specific about what I am claiming. The AI is not reading your mind. It is not breaking your encryption. It is not hacking your accounts. It is doing the same thing that ad networks have been doing for 20 years, except the model is better and the data is denser. The recommendation AI is built on the same signals that the original DoubleClick cookie used, plus a few dozen new ones.

The new thing is the density. Twenty years ago, the ad network saw a few hundred signals per user per day. The current AI sees a few thousand. The accuracy of the resulting profile is the same kind of improvement you would expect from more data and a better model.

Why this matters for the people who use fake names

Most of the people who use fake names online are not criminals. They are survivors of harassment, journalists, people in abusive relationships, people who do not want their employer to find their hobby accounts, and people who do not want their hobby accounts to find their employer. For these people, the fake name is part of a larger strategy that includes not reusing passwords, not posting photos, and not linking accounts.

The bad news from my experiment is that the fake name is the weakest part of that strategy. The good news is that the other parts of the strategy (clean browser profiles, separate VMs, unique email aliases) are still working. The browser fingerprint, the typing cadence, and the reading time measurements are not defeated by a fake name. They are defeated by clean infrastructure, which is more work but is also more effective.

Trade-offs

The infrastructure I used for this experiment is not free in time. I spent about two hours setting up the VM and the email aliases. The QEMU VM uses about 4 GB of RAM while it is running, which is meaningful on a smaller machine. The unique email aliases are a subscription I pay for. For most people, the cost-benefit math is not going to work out.

For people in the categories I listed above (survivors, journalists, people in abusive situations), the math is different. The cost of being identified is high, and the cost of the infrastructure is worth it. For everyone else, the fake name plus a unique email alias is probably enough, and the rest of the work is not worth the trouble.

The other trade-off is convenience. The clean VM is a separate browser that does not share bookmarks, history, or saved passwords. For a daily driver, that is a meaningful cost.

If you are at elevated risk and you have the time, the clean VM plus unique email aliases plus a real password manager is the strongest setup. If you are at normal risk, a password manager and a unique email alias per site is enough.

What I would tell past me

If I could send a message back to the version of me that ran this experiment, I would say three things.

• The fake name is for the human, not the AI. If a person is going to look at the name and use it to find you, a fake name helps. If an AI is going to use your behavior to identify you, a fake name does not help.
• The strongest defense is clean infrastructure, not a clever name. A separate browser profile, a unique email alias, and a password manager are doing more work than any name you can come up with.
• The AI is not magic. It is the same data the old ad networks collected, processed by a better model. The defenses that worked against the old networks mostly still work, but the threat model is wider.

Bottom line: if you are using a fake name as your primary defense against being identified, the AI has already identified you. The defenses that work are the ones that change the behavior the AI is measuring, not the name you type into the form.