What changes when you switch to an eSIM
When people ask about eSIM privacy, they’re usually picturing the wrong mechanism. The plastic card disappearing doesn’t change who can see you on the network. What actually changes is how your identity gets provisioned, stored, and swapped, and those changes cut in both directions. Some are neutral. A couple are worth knowing about before you activate one.
What an eSIM actually is
A physical SIM is a small removable chip that stores a subscriber identity: your IMSI (the number that identifies your account to the carrier’s network), an authentication key, and some carrier-specific data. An eSIM stores the same information, but the chip (called an eUICC) is soldered directly onto the device’s logic board. Instead of swapping a card, you download a “profile” over the internet or via a QR code, and that profile gets written to the embedded chip.
Functionally, once the profile is loaded, the eSIM behaves exactly like a physical SIM on the network. Same authentication handshake with the tower, same IMSI, same billing relationship with the carrier. The privacy-relevant differences aren’t in how the network treats you. They’re in how you get provisioned and what you can and can’t do with the hardware afterward.
What stays exactly the same
This is the part worth sitting with, because it’s where most of the “eSIM is more private” or “eSIM is less private” claims fall apart.
Your IMEI, the identifier baked into the device itself, doesn’t change based on SIM type. Your carrier can still see your IMEI on every SIM you use, physical or embedded. Device fingerprinting at the network level doesn’t care whether the subscriber identity next to it lives on a card or a chip.
Cell tower triangulation and general location visibility to your carrier also don’t change. Any phone registered to a tower reveals rough location to the network operator, because that’s how cellular networks route calls and data to you. A VPN encrypts your data traffic, but it does nothing at this layer. VPNs operate above the cellular radio stack; the carrier still sees which tower you’re pinging regardless of what’s inside your encrypted packets. eSIM doesn’t change this either. If your threat model includes carrier-level or network-level visibility, switching SIM formats isn’t the lever that moves that needle.
Legal access to subscriber and location records by law enforcement, where it applies, follows the same processes regardless of SIM type. That’s a legal and jurisdictional question, not a technical one, and it’s outside what this article covers. The point for our purposes is narrower: the SIM format itself isn’t part of that equation.
The identifier that’s actually new: the EID
Here’s the one genuinely new piece. Every eUICC chip has its own hardware identifier called an EID (eSIM ID), which is distinct from the IMSI of whatever profile is currently loaded on it. The EID is fixed to the physical chip and doesn’t change when you swap profiles or carriers.
Practically, this means the chip itself is now a persistent, device-bound identifier that exists independently of any specific subscriber account. Device manufacturers and eSIM platform providers can see the EID during provisioning. It’s not broadcast over the air to cell towers the way an IMSI is, so it sits in a different category from that. What it does give you is a new fixed point of correlation between the physical device and whichever profiles get loaded onto it over time.
Provisioning creates a paper trail that physical SIMs didn’t
This is the practical difference that matters most day to day. Buying a physical prepaid SIM at a kiosk, where local law allows anonymous prepaid purchase, is a walk-in, cash, no-account transaction. Activating an eSIM almost never works that way.
eSIM activation happens through a QR code, a carrier app, or increasingly through Apple’s or Google’s own provisioning flows, which are frequently tied to the Apple ID or Google account already signed into the device. Some carriers require you to create an online account with an email address and a payment method before they’ll even generate the QR code. That account creation step is a data trail that a walk-up physical SIM purchase, again depending on local rules, doesn’t necessarily produce.
None of this is unique to eSIM as a format. A carrier can require ID and an account for a physical SIM too, and increasingly many do, especially postpaid plans. But the eSIM provisioning flow nudges the whole industry toward account-based activation because it’s technically the easier path to build, and that shift in convenience is a shift in what gets logged.
You can’t pull it out
A physical SIM can be removed from a device. That matters less for privacy day to day than people assume, since removing the SIM doesn’t erase carrier records that already exist, but it does mean the subscriber identity is separable from the hardware at will. You can move it to another device, hand it off, or physically discard it independent of the phone.
An eSIM profile is tied to the chip that’s tied to the motherboard. Deleting a profile from the device is a software operation, not a physical one, and it depends on the device’s operating system giving you that control (which, on a personal, unmanaged phone, it generally does). But you can’t get physical separation the way you can by popping out a tray. If a device is lost, stolen, or handed over for inspection, the eSIM profile and its provisioning history live inside the device’s own storage and account ties rather than on a card you could have already removed.
Multiple profiles change your exposure surface, not your anonymity
Most eSIM-capable phones support several stored profiles and, on many models, more than one active line at once (dual SIM, dual eSIM, or eSIM plus physical). This is genuinely convenient: a travel eSIM alongside your home line, a work profile alongside personal, all without carrying a second physical card or a SIM pin tool.
The privacy-relevant part is that each active profile is a separate subscriber identity broadcasting to the network, and each one has its own provisioning and billing trail back to whatever account activated it. Running multiple profiles on one device doesn’t isolate them from each other at the device level; the phone that made the calls and the phone that browsed on the other line is still the same physical device with the same IMEI. Anyone correlating identifiers across your accounts, whether that’s a carrier, an advertiser with SDK-level access, or a platform that ties your subscriptions to a signed-in account, has more surface to work with, not less, just because there are more profiles present.
The secondhand device angle
When you sell or hand off a phone with a physical SIM, removing the card is a physical, verifiable step anyone can do without touching settings. An eSIM profile has to be deleted through the OS. If a factory reset isn’t performed correctly, or a carrier-level transfer isn’t completed on their end, a profile or its remnants can persist. That is far less obvious to a new owner than a card left in a tray. This is a good reason to treat a full factory reset and confirmation with your carrier that the line has been transferred or deactivated as a real step before you sell or give away a device, not an optional one.
What this means in practice
eSIM is neither a privacy upgrade nor a privacy downgrade in the way it’s often marketed. It doesn’t make you harder to identify to your carrier, and it doesn’t make you easier to track over the air than a physical SIM does, because the over-the-air behavior is identical. What it changes is administrative. Activation is more likely to run through an account and a signed-in device ecosystem. The chip itself carries a new persistent hardware identifier. And you lose the ability to physically separate the subscriber identity from the device.
If your threat model is about minimizing what a phone company or a device platform can correlate about you, the SIM format is a small piece of a much bigger picture. Your device’s advertising identifiers matter more. So do the accounts signed into it, and how you pay for service. If your threat model is about network-level visibility such as location to a carrier, neither SIM format changes that on its own. Knowing which of those two questions you’re actually asking is more useful than any claim that one SIM format is simply “the private one.”
If you want more explainers like this that stick to how the technology actually works instead of selling you a single fix, you can find the rest of our coverage on the Privacy Wire home page.