Printer tracking dots: what your printer secretly adds to every page
Most colour laser printers add a pattern of tiny yellow dots to everything they print. It’s invisible under normal light, it’s been there for decades, and it’s almost certainly on pages sitting in your house or office right now.
What the dots actually are
The industry term is machine identification codes. Most people who’ve heard of them call them tracking dots. They’re printed in pale yellow, spaced roughly a millimetre apart in a grid, and yellow on white paper is close to invisible to the naked eye under ordinary lighting. The pattern typically carries the printer’s serial number, and on a lot of models, the date and time the page came out.
They exist because of currency. In the 1990s, colour laser printers got good enough that counterfeiting no longer required a print shop. Printer manufacturers reached arrangements with central banks and governments to make colour output traceable back to the specific machine that produced it. That was the deal, and it was never disclosed to buyers. It’s not on a spec sheet, and it’s not in the box.
It stayed obscure for a long time. Researchers at the Electronic Frontier Foundation started investigating in the mid-2000s, and in 2005 they published decoded patterns from a Xerox printer. The Secret Service later acknowledged the programme existed. Even then, it read like a curiosity, the kind of thing that surfaces in a forum thread and goes nowhere.
Then 2017 happened. A contractor named Reality Winner printed a classified document and mailed it to a news outlet, which published a scan. The dots were in that scan, encoding the printer’s serial number and a timestamp precise enough to narrow the source to a handful of people who’d used that specific machine at that specific moment. That case is the reason most people who know about the dots know about them at all.
What gets encoded, and how to see it
On the common Xerox-style pattern, the code is a grid, roughly 15 dots by 8, read as a set of columns. One section identifies the printer’s serial number, another carries the date, another carries the time, often down to the minute. Layouts vary between manufacturers, and some vendors use schemes nobody has fully decoded publicly. Still, the shape of the information stays consistent across the ones that have been studied.
You can see the dots yourself. Print a page on a colour laser, then look at it under a blue LED light with a magnifier; the yellow stands out clearly under blue light. Scanning at very high resolution and isolating the blue channel works too. The EFF has published a list of the printer models they tested for this, and it’s still the best public reference on which machines do it.
What I’m not going to do here
I’m not going to walk through defeating this. That’s a tool for a narrow set of people in genuinely serious situations, and the honest advice for anyone in that position is to talk to a lawyer and to an organisation that handles source protection properly. Printing tips from a video aren’t a plan.
What’s more useful for almost everyone reading this is the ordinary version of this problem, which gets far less attention than the dots do.
The part that actually affects most people: print logs
Your office printer keeps a log. Not a metaphor, an actual job history, sitting on the device or on a print server, listing who printed what. A typical entry includes the username, the document’s filename, the page count, the timestamp, and often the tray and settings used. Filenames are the detail that catches people out. Nobody thinks about what a file is called until it’s sitting in a list an administrator can read.
On managed office fleets, this is deliberate. Departments get billed for what they print, so something has to count it. Print release systems, where you badge in at the machine before your job comes out, log every step by design. That’s the entire point of them.
The server side adds another layer. A Windows print server can record every job that passes through it, and on Linux the CUPS scheduler keeps its own page log with the user, the document title, and the page count. These logs exist for capacity planning and troubleshooting. They’re mundane by design, and they’re also a fairly precise record of what someone worked on and when.
Where the documents themselves end up
Mid-range and larger office multifunction machines have hard drives or solid-state storage inside them, used as working space. A document you print, a page you scan, a fax you send, any of it can land on that drive, and it can stay there until something overwrites it.
That’s the disposal problem. An office replaces a printer, the old one goes to a broker, and the drive goes with it. Journalists have bought used office copiers on the secondary market and pulled documents straight off the internal storage. A CBS investigation in 2010 bought several machines from a New Jersey warehouse and recovered police records, medical forms, and payroll data. The machines had been sold as furniture, because nobody in the resale chain thought of them as computers full of files.
If you run a small business and you’re getting rid of a multifunction printer, this is the practical takeaway: find out whether it has internal storage. Most vendors publish a data-clearing or sanitisation procedure in the manual, and many machines have a wipe function in the service menu. Some support drive encryption you can turn on while the device is still in service, which makes eventual disposal much less fraught. Do it before the machine leaves the building.
Leases complicate this, and people miss it constantly. A leased copier goes back to the leasing company at the end of the term, and the contract rarely says anything useful about the data on it. Ask. Get the sanitisation step written into the return process, or arrange to keep the drive. Once the machine is on the van, it’s out of your hands.
Public printers and shared machines
Libraries, university labs, copy shops, and hotel business centres run colour laser printers as often as not. They log jobs against whatever account or card you used to release them, and there’s usually no particular reason for the shop to prune that history. If you email a document to a copy shop counter so it’s waiting when you arrive, that email sits in their inbox indefinitely. None of this is sinister. It’s just that a copy of your document ends up somewhere you’ll never look again, held by people who never agreed to look after it and mostly don’t know they have it.
Home printers are a different, smaller story
A cheap home inkjet generally doesn’t do the yellow-dot thing at all. The codes are overwhelmingly a colour laser behaviour. A home inkjet also usually has no meaningful storage, just a small buffer that clears when it loses power.
What home printers do have now is a network connection and an account. A printer that talks to a vendor’s cloud service so you can print from your phone is reporting in, typically covering ink levels, pages printed, the model and serial number, and any errors it’s hit. On a machine tied to an ink subscription plan, that reporting covers enough usage detail to bill you. Read what the app asks for during setup. That’s where the real data relationship sits on a consumer device.
Those subscription programmes deserve a mention of their own. A printer on an ink plan has to report your usage continuously, because the billing depends on it, and some of them stop working entirely if the device loses its connection. That’s a functional dependency on a vendor knowing how much you print. It’s a reasonable trade for some people and a bad one for others, and it’s worth being a choice you made on purpose rather than a default you didn’t notice.
Scanning leaves its own trail
When you scan to email from an office machine, the file goes out through a mail server that logs it, and a copy may sit in the device’s storage or in a scan folder on the network. People scan things at work they’d never email from a personal account: a passport page for an HR form, a bank letter for an expense claim. It’s the same document either way, but the scan path tends to leave more copies behind than the email path does.
One more mechanism, briefly
A printed page also carries physical characteristics of the machine that made it, separate from any deliberate code: roller marks, tiny alignment offsets, toner distribution patterns. That’s forensic territory, and it needs the original sheet rather than a scan, so it doesn’t come up in daily life. It’s worth knowing about only so the tracking dots don’t sound like the only mechanism in existence.
A concrete thing to ask
If you want one useful step at work, ask your IT team two questions: how long print and scan logs are kept, and whether the multifunction machines have their drives encrypted. Both have real answers, and neither is a strange thing to ask. What comes back tells you how much of your own working history sits in a system you don’t control, and it often starts a useful conversation, since retention settings on a printer fleet tend to quietly stay at whatever the vendor shipped by default.
Where this leaves you
For most people, this is fine. If you print a shopping list on a colour laser, the tracking dots are real and the practical consequence is zero. The technology exists for reasons that have nothing to do with you, and it’ll keep existing regardless.
The parts worth acting on are the ordinary ones. Know that your work printer keeps a job history with your name and your filenames in it, and name files accordingly. Treat a scan at the office as a copy that persists somewhere else. If you own or manage a machine with a drive inside it, wipe that drive before it goes out the door. And when a home printer asks for an account, read the permissions the way you would for any other connected device.
A printer is a computer with a paper output. It stores things, it logs things, it phones home, and it gets thrown away carelessly. Every one of those is something we already know to check on a laptop or a phone. The printer just never got added to the list.
No single step here makes you private, and it’s worth saying that plainly. The dots are unavoidable on hardware that has them. The logs are the entire point of the systems they belong to. What you can actually control is the copies that outlive the job, and where the hardware ends up when you’re finished with it.
If you want more explainers like this, ones that look at what a device actually records rather than what it’s rumoured to record, you’ll find them on The Privacy Wire.