Who are you online? The honest answer is a list. A handle on one platform, a different one on another, a login provided by a third company that you use to sign in to a fourth. A purchase history here, a viewing history there, a reputation score somewhere you have never logged into directly. None of those pieces is you, and none of them is yours in any sense that would survive the company holding it deciding otherwise.
How it got this way
Every service needs to know who is asking. The simplest answer was for each service to keep its own record, which is why the average person has hundreds of accounts. Sign-in providers reduced the friction of creating them but concentrated the dependency: lose access to the provider and you lose access to everything behind it.
Meanwhile, the valuable part of identity, the accumulated history and reputation, was never designed to move. A decade of reviews, posts, purchases or contributions lives inside one product’s database. It is yours to look at and theirs to keep.
What portability would mean
Real portability has three parts. You should be able to take your data out in a form another service can read. You should be able to keep your identifier, so that people who know you by a name can still find you. And you should be able to carry your reputation, so that starting somewhere new does not mean starting from zero.
The first part exists in law in many places and in practice in a few. The second is emerging through decentralised identity systems that let a domain name or a cryptographic key serve as an identifier that no single platform issues. The third is largely unsolved, because reputation is context-specific and the contexts do not trust each other.
The security angle
A stack of accounts is also a stack of attack surfaces. Recovery flows, security questions, linked phone numbers and email addresses form a web in which compromising one node often yields the rest. The person who controls your primary email address effectively controls your identity, which is a strange amount of power to hand to a free service most people signed up for as a teenager.
Consolidation helps until it doesn’t. Fewer accounts mean fewer weak points, but a single provider becomes a single point of failure. The pragmatic middle is a small number of well-protected core accounts, hardware-backed authentication where it is offered and a recovery plan you have actually tested.
The policy question
Technical solutions exist for most of this. What is missing is an obligation. Platforms have no incentive to make leaving easy, and voluntary standards for portability have a history of being adopted enthusiastically by the platforms that have the least to lose. Where regulators have required data portability, it has arrived; where they have not, it has been announced and quietly deprioritised.
Identity portability will follow the same pattern. It will exist where it is required and be a talking point everywhere else.
What you can do now
Own a domain name and use it as your durable address. Keep an exported copy of anything that matters. Prefer services that publish how to leave. And treat your primary email and phone number as the critical infrastructure they have become, because to every other service on your list, they are.
