Various techniques can be used to identify stalkers, malicious hackers et al. that are either gathering data for their target or use the target's digital items without consent.


Canary files
------------


They are 'normal' files (e.g. PDF, word) that can be used to identify an attacker without his knowledge or consent. When the attacker copies the canary file (without permission) and opens it in his computer, he could -unknowingly- send his IP address to the victim.


Google Drive
------------


A victim can upload a big file that most people wouldn't bother searching for, let alone download, yet an attacker doing research on the victim probably will.
By doing so (and under certain circumstances) the following become [available](https://support.google.com/a/answer/4579696?hl=en#zippy=%2Cdata-you-can-view) to the victim:



> 
> User action such as View, Rename, Create, Edit, Preview, Print, Update, Delete, Upload, Download, or Share a Drive file.
> 
> 
> 


Google analytics
----------------


It can sometimes be used to gather information of would-be stalkers. E.g. if a victim creates a website and enables Google Analytics he could place a 'bait' in his webpage like his real name, assuming it's not too common. Then the attacker by searching "Jake Anderson home address" would leave traces like:


* approximate age
* approximate location (e.g. city)
* search term used to find the site in Google


This of course requires that the attacker is reckless with his privacy settings which is quite common.


What limitations does the GDPR create in the use of such techniques when done with the sole purpose of identifying or getting a hint on the attacker's identity?


Note that in some of the cases above the attacker has given consent to his data being used (e.g. being visible to the google drive account owner).



Identifying attackers and GDPR. In which cases is it legal?