--
title: "When Your Footprint Report Flags Something Innocent"
description: "A flagged item is not proof that private data leaked. Five kinds of false positive account for most of the noise, and clearing them fast is what keeps the real cleanup on schedule."
tags: ["privacy", "security", "osint", "howto"]
canonical_url: https://digital-footprint-health.shop/blog/footprint-report-false-positives
When Your Footprint Report Flags Something Innocent
A flagged item is not proof that private data leaked. Five kinds of false positive account for most of the noise, and clearing them fast is what keeps the real cleanup on schedule.
The short version first, then the part that usually gets skipped.
Scanning works by pattern matching, so it recognises shapes rather than intent. A string that looks like a phone number may be an order reference. A place name may sit inside a news post you reshared. An email address may be the work contact you publish on purpose. The threshold leans permissive deliberately, because a missed item is far more dangerous than a false alarm: if a post holding your home address is not flagged, you never learn about it.
What actually works, in order: Apply three tests in order. Context: does the item sit next to order, shipping or event words, or next to address, delivery or contact me? Ownership: is it inside a retweet or someone else's reply, or published by you directly? Currency: does it point to information still in use, or to something that expired years ago? If all three point to a false positive, skip it. If one points to a real risk, treat the item as a risk and stop deliberating.
The numbers worth knowing: Five kinds cover the large majority of false positives: order references and tracking numbers, reshared news, public business contact details, other people's details inside a conversation, and generic geographic phrasing such as street names used in a joke. The score impact is small. A handful of false positives put the number a point or three below reality, and the category breakdown says more than the total, because a cluster in one category usually shares one signature and clears in bulk.
Where people go wrong: Treating the report as a list of instructions instead of a list to review. That costs twice: things that should stay get deleted, and the genuine problems sit behind a pile of noise for another week. The report answers whether a piece of content resembles sensitive information, not whether it actually caused exposure.
A note on defaults. Most guides describe the happy path, where the first attempt works and nothing interrupts it. Real runs get interrupted, hit a ceiling halfway through, or turn out to be based on a filter that was set too wide. Decide what you are optimising for in one sentence, then let that sentence filter the steps. Anything that does not connect to it can wait.
I keep the full walkthrough with the order of operations on my own site, here: https://digital-footprint-health.shop/blog/footprint-report-false-positives
