I used to think an eSIM was basically a SIM card without the plastic. Then I started working on a data-only eSIM service and had to answer support tickets like "so what do you actually know about me?" It turns out the honest answer is more interesting than "nothing" and more reassuring than "everything".
So here's a plain walk through the identifiers involved, who sees each one, and what a no-KYC provider can and can't hide. Full disclosure up front: I work on Silent eSIM, so I'll use our setup as the worked example, but the plumbing is the same for every travel eSIM out there.
The four numbers that matter
EID. This is the ID of the eUICC chip soldered into your phone. It's 32 digits and it never changes, no matter how many eSIM profiles you install. You can find yours on iPhone under Settings > General > About, or on most Android phones by dialing *#06#.
ICCID. This belongs to the eSIM profile itself, not the chip. It's 19 or 20 digits and almost always starts with 89. Every profile you install gets its own ICCID. This is the number the mobile network bills against, so any provider has to keep it. There's no anonymised version of it.
IMSI. The subscriber identity the network actually uses when your phone attaches. It's tied to the profile, and it's what the visited network sees when you roam.
IMEI. The ID of the phone hardware. Your phone hands this to the network too. Swapping eSIMs does not change it, which is worth remembering if your goal is separation between two identities on the same handset.
What's inside that QR code
The QR code you scan is just a text string. Decode one and you'll see something like this:
LPA:1$smdp.example.com$K2-1ABCD-2EFGH-3IJKL
That's the GSMA activation code format. LPA:1 is the version, the middle part is the address of the SM-DP+ server (the server that holds your profile until it's downloaded), and the last part is a matching ID that says "give this person profile X". When you scan it, your phone's Local Profile Assistant connects to that SM-DP+ and downloads the encrypted profile straight into the chip.
Two practical takeaways:
- Treat the QR code like a password until it's installed. Anyone who scans it first gets the profile.
- During that download, the SM-DP+ learns your EID. That's how the profile gets bound to your chip. So the EID is known to the profile server, even if the shop you bought from never asks for your name.
Who sees what
Here's the map I wish someone had drawn for me:
| Party | Typically sees |
|---|---|
| The shop that sold you the eSIM | ICCID, balance, data used, payment method and reference |
| The SM-DP+ (profile server) | EID, ICCID, time of download |
| The network you roam on | IMSI, IMEI, rough location from cell towers, data volumes |
| Websites you visit | an IP address, often from the issuing network's country, not yours |
That last row surprises people. Lots of travel eSIMs are home routed, meaning your traffic tunnels back to the issuing operator before it hits the internet. So a café in Lisbon might show an IP from somewhere else entirely. That's a side effect of how roaming works, not a privacy feature anyone built on purpose, but it's useful to know when a bank app suddenly asks you to verify a login.
What the provider keeps (a real example)
To make this concrete, here's what we keep, taken from Silent eSIM's privacy policy and not from my memory of it:
- The ICCID, the activation profile and the balance, because the SIM can't run without them.
- Usage records. The network reports data use roughly every ten minutes and we deduct it from the balance. That's volumes and cost, not which sites you opened. We can't see the contents of your traffic.
- Payment metadata: amount, method, the processor's reference. A crypto checkout needs no email. A card checkout sends you to a processor that asks for email and billing details.
- IP addresses in two narrow places: rate limiting on the support chat (those rows are deleted after a day) and a security log of failed eSIM recovery attempts.
If you want to check any of that line by line, the full version is on Silent eSIM's privacy policy page. I'd honestly recommend reading the privacy page of whichever provider you pick, and looking for one that lists what it keeps rather than one that promises it keeps nothing. Every SIM has an ICCID. "We store nothing" can't be literally true.
What no-KYC can't hide
No-KYC is about the purchase. It means nobody asks for a passport or a selfie. It does not make you invisible:
- The network still sees your IMEI and which towers you're near.
- Bitcoin transactions are public. If your wallet is linked to you somewhere else, the payment can be too.
- Card payments carry your name at the processor, by design.
If you're comparing providers on these points, it helps to look at a few side by side. I put together how Silent eSIM compares with Silent.link, checked against their own public pages, including where they win (they take Lightning, we don't).
A quick checklist before you buy
- Find your EID and IMEI so you know what you're exposing.
- Keep the QR code private until it's installed.
- Read what the provider says it stores, not just what it says it doesn't.
- Pick the payment method that matches how private you actually need to be.
- Expect the visited network to know roughly where you are. That part is physics.
Got a question about LPA strings, home routing or EIDs that I didn't cover? Drop it in the comments. I'll answer the ones I can back up.
Top comments (0)