A shop that asks for nothing gets you most of the way. The rest is up to you, because anonymity fails at its weakest link and several of those links are in your pocket. This is the checklist we would follow ourselves. Take the steps that match what you are protecting. Not everyone needs all nine.
Before you buy
1. Decide who you are hiding from
A marketing database, your bank, your home carrier and a government are four different problems. An eSIM bought without ID solves the first three cheaply. The fourth needs every step below and still has limits. Who can see what is the honest map.
2. Reach the shop without showing your address
We keep no access logs, but you do not have to take that on trust. Open the site in Tor Browser through the onion address linked in the footer of every page. The whole shop works there, checkout included, and it works with JavaScript switched off, so Tor Browser's Safest setting is fine.
3. Pay with Monero, from your own wallet
A card ties the purchase to your name at your bank. Bitcoin and stablecoins leave a public record that can be followed back to the exchange where you bought them. Monero hides the sender, the receiver and the amount. Send it from a wallet you control instead of straight from an exchange, so the exchange never learns which shop you paid. The Monero walkthrough covers the mechanics.
At delivery
4. Save the PDF somewhere that is not a cloud
Your eSIM arrives with a PDF holding the QR code, the manual codes and a login key. That key is a random string and it is the entire account. There is no email behind it and no way to reset it. Keep the file offline. A PDF that syncs to a photo library or sits in your inbox has just been tied to your name by someone else's service.
5. Use a separate key for separate lives
Everything bought under one key is visibly one customer's. That is convenient for top-ups, and it is also a link. If two trips or two phones should not be connected to each other, buy them in separate sessions and let each have its own key.
On the phone
6. Choose the phone deliberately
This is the step that matters most and the one most people skip. When an eSIM installs, the phone's eSIM chip identifies itself to the carrier's provisioning server with a permanent hardware ID called the EID. When the eSIM connects, the network sees the phone's IMEI. Both numbers belong to the handset, not to the eSIM, and they stay the same for every eSIM that phone will ever use.
So an eSIM on your everyday phone is unregistered but not unlinked: the device is the thread. If that matters to you, use a phone that was never tied to you, and do not put your personal SIM in it.
7. Install it on a connection that is not home
The install is a download from the carrier's server, and that server sees the address the request came from. A cafe's Wi-Fi tells it less about you than your home broadband does.
8. Cover the traffic
The network that connects you to the internet can see where your traffic goes. A VPN or Tor on top takes that away from it. On a travel eSIM that network is often in a different country from the one you are standing in, which is worth understanding before you rely on it: see why your eSIM has an IP address from another country.
9. Mind the apps
Log in to your personal email on the anonymous phone and it is not anonymous any more. The same goes for messaging accounts registered to your real number, an app store signed in under your name, and anything that syncs. The eSIM does nothing about what your apps tell their own servers.
Three things no checklist fixes
- The network knows where the phone is. Any connected phone is located by the towers it talks to. No SIM changes that.
- Patterns identify people. A phone that sleeps at your address and travels alongside your other phone does not need a name on file.
- A card payment is a name. If any purchase or top-up under a key was made by card, that key is linked to you at your bank.
None of this is a reason to give up. For most people the exposure that matters is the routine kind: accounts, email addresses, ID scans and trackers. Steps two to five remove all of that in about ten minutes. Here is exactly what we collect, and here are the plans.